Preventing Path Traversal Vulnerabilities
By far the most effective means of eliminating path traversal vulnerabilities is to avoid passing user-submitted data to any file
Read moreweb application
Bypassing Filters
In some situations, an application that is vulnerable to SQL injection may implement various input filters that prevent you from
Read moreInjecting Code
The topic of code injection is a huge one, encompassing dozens of different languages and environments, and a wide variety
Read moreDisclosure of Tokens in Logs
Aside from the clear-text transmission of session tokens in network communications, the most common place where tokens are simply disclosed
Read moreImplementation Flaws in Authentication
Even a well-designed authentication mechanism may be highly insecure due to mistakes made in its implementation. These mistakes may lead
Read moreHandling User Input
Recall the fundamental security problem described in Chapter 1: all user input is untrusted. A huge variety of different attacks
Read moreHandling User Access
A central security requirement that virtually any application needs to meet is to control users’ access to its data and
Read more