Begining of a security geek
A RAT is a form of malware that lets attackers track and control your machine remotely.
Employees, former employees, contractors, or business associates who have legitimate access to your systems and data but can use that access to kill or steal your data or systems are known as insider threats. Insiders may turn malicious for a variety of reasons, such as revenge, manipulation, ideology, ego, or monetary benefit via intellectual property theft.
There are a variety of ways to defend yourself from malicious insiders, depending on the organization, systems, culture, environment, and how well this information is communicated and understood by employees.
Ransomware is a form of malware that encrypts a victim’s data. The attacker then asks for ransom. Once the ransom is paid the the user access to data is restored..
XSS is a type of injection which if successful, allows an attacker to run scripts on the victim’s machine. A web-app is vulnerable, if it uses unsanitized user input.
Using frameworks that automatically escape XSS by design.
Escape mistrusted HTTP request data.
Apply context-sensitive encoding when modifying the browser document on the client side.
Enable a CSP (Content Security Policy).
Security misconfigurations are when security could have been configured properly but was not, and can happen at any level of an application stack. Automated scanners are useful for detecting the misconfigurations.Often this Vulnerability give attackers unauthorized access to system data, sometimes can end up in a complete system compromise.
Broken Access Control is exploitation of access control, which is a primary skill of an attacker. The broken access control allows attackers to bypass authorization which can allow them to view sensitive data or perform tasks as if they were a privileged user. Access control weaknesses are common because of the lack in detection and the lack in effective functional testing by the developers. The attack if executed successfully, it does not have a limitation on the impact since based on the access that has been bypassed, the attacker might be able to read or modify the data.
XXE is where an attackers can exploit a vulnerable XML processor (file that reads and processes the XML), if the attacker can upload a payload in the form of XML document, can cause problems (such as it can allow the attacker to communicate to the system that the server is connected to and read data that is not for the users, cause the DOS (Denial Of Service) attack or may make changes in the configuration to allow port scanning or port opening which can then give them the option for RCE (Remote Code Execution))
1) In-band XXE attack:
The in-band XXE attack allows the attacker to receive a response to the XXE payload.
2) out-of-band XXE attacks (also called blind XXE):
The blind XXE attack does not receives an immediate response from the web application.
Sensitive Data Exposure is when a web application reveals the sensitive data (often user information). this often happens when the web-app is either using weak encryption or no encryption at all and involve attacks such as MITM (Man In The Middle) attack, which means that the attacker intercepts the connection between the user and the server or forces the user connection through a they have access to. Sometimes the sensitive data is available on the web-server itself. If this vulnerability is exploited, it reveals the sensitive data (aften PII (Personally identifiable information)), which then often require response as defined by the Laws or regulations.
Authentication and session management are the core of modern web applications. While authentication is used to allow the verify a user and let them login to their accounts, Cookies are used as a tool for session management. A user will login using their credentials (Most common form of authentication), and then the user is assigned a cookie. A cookie is used to keep track, since the web protocol HTTP & HTTPS protocols are state-less (which means that the servers will not remember whether a client has or has not used the application before, and how many time).
A brute-force attack means to figure out a password by trying possible combination of letters, numbers, and symbols unless you find a combination that works. Depending on the password’s length and complexity, the process can take a long time, and you get unnecessary traffic. To speed up the process, an attacker ussually uses an attack known as dictionary attack, where they use the dictionary words or some midified version of those words. The attackers can also automate this process by using a tool like “Hydra”, “Hashcat”, or their custom scripts. Attacks like these are fairly easy to detect but if defended against them they could result in a catastrophe (For example if an admin account is compromised, or even if a standard user account is also compromised it can allow the hacker to laterally move in the network).
This means to make sure that users are using strong passwords: long unpredictable passwords, avoid reusing passwords, and change passwords regularly.
Account lock out means, after a defined number of incorrect login attempts the account will automatically get locked (For example the account can get lock for 30 seconds after the second attempt, 1 min and the 3rd and 4th attempt, and after the 5th attempt it, locks out and needs manual unlocking by an administrator).
The problems with account lockouts are:
This means locking out authentication attempts from known and unknown browsers or devices separately based on the information collected (via the cookies, locations or IP addresses).
CAPTCHAS are helpful to stop those automated attacks which means that the attacker will need to login manually which can take a long time, and the team has time to work on the recovery measures once alarmed.
