So let us continue with our top 10 attacks in the last lecture.
These are the first five top 10 attacks and I'm in this lecture.
We will explore the remaining attacks.
ASX security misconfiguration using misconfiguration vulnerabilities like unvalidated inputs, parameter
tampering, improper error handling, insufficient transport, layer protection, etc., attackers gain
unauthorized access to default accounts, unused pages, retrade unprotected files and directories and
minimum security.
Misconfiguration can occur at any level of application stack, including the platform web server application
server framework and custom cool water unvalidated inputs.
It refers to Web application vulnerability, where input from a client is not validated before being
processed by other applications and back in.
So what is parameter tampering?
It involves manipulation of parameters like price tags or sessions exchanged between client and server
in order to modify application data.
Improper error handling.
It gives insight into source code such as logic flaws, default accounts, etc. and using the information
received from error message, attacker can identify vulnerabilities for launching various application
attacks.
The next is a seven that is cross site scripting attack.
You have heard of the storm in many different hacking forums or blogs.
So what is Exercice Cross site scripting?
That is Exercice Odysseas attacks exploit vulnerabilities in dynamically generated Web pages, which
enables malicious attackers to inject Clydeside script into Web pages viewed by other users.
So if you are an attacker, you will inject a malicious code into that web browser or the application.
And whenever a legitimate user will open that web application, he can see your executed error message.
No exercice occurs when invalidated input data is included in a dynamic content that is sent to the
user's web browser for rendering attackers in malicious JavaScript VB Script ActiveX HTML or flash for
execution on a victim system by hiding it within legitimate requests.
Some of the excesses attack exploitation include malicious script execution, redirecting to malicious
server exploiting user privileges now adds a hidden Ephraim's and pop ups are also exercice attacks.
We will explode Xerces attacks and practicals in this section.
Where can you see Exercice attacks?
Well, you can see an exercise attack in e-mails, in blogs, in command fields and websites which are
vulnerable to attacks and other things.
It insecure.
The serialisation, data, serialisation and database utilization is an effective process of línea raising
and dealing, erasing data objects in order to transport it to other network assistance attackers in
malicious code and to serialize data and follow the malicious serialized data to the victim.
Insecurities, utilization, because realizes the malicious serialized content along with the injected
malicious code, compromising the system or network, the last on the second act is using components
with no known relatives, no components such as libraries and frameworks that are used in most of the
Web applications always execute with full privileges and flaws in any component can result in serious
impact.
Attackers can identify components or dependencies by scanning or performing manual analysis.
For example, if you are developing an app and you want to insert a payment gateway to your app, you
will not write an entire code to develop a payment gateway by yourself.
You will hire or they will just get a plug in for a third party payment gateway and then include it
in your code.
But what if that third party payment gateway has already exploited Audobon the dignity that is known
as using components with nonlinearities and the last of the up stopped and vulnerabilities is insufficient.
Logging and monitoring web applications maintain logs to track usage patterns such as user login credentials
and admin login credentials.
Insufficient logging and monitoring refers to the scenario whether detection software either does not
record the malicious event or ignores the important details about the event.
Attackers usually inject, delete, tamper with applications to engage in malicious activities or hide
their identities, insufficient logging and monitoring when that really makes the detection of malicious
attempts of the attacker more difficult and allowing the attacker to perform malicious attacks like
brute forcing passwords to steal confidential passwords.
Now, these are the Web's top 10 vulnerabilities.
But that doesn't mean that these are the only vulnerabilities present.
Other vulnerabilities like directly traversal denial-of-service, hidden field manipulation, platform
exploits, cross site request forgery, waterhole attacks, broken session management, network access
attacks, kookie snooping and many more, you name it, and you get a vulnerability for that attack.
So basically, these are the most common attacks and therefore they are being listed as the top 10 attacks
by all APS or APS is open source free organization, which provides bank testing methodologies.
Then it also provides tutorials, various books and a framework to carry out a proper web application
penetration testing.
So in the next lecture, we will see how to footprint a website using different tools, such as who
is built with current employees and others.
So in short, from the next lecture will be starting the application penetration testing practicals.