13.1 Hacking web apps Introduction

Hacking Web Applications, Section: Introduction
Web app is a client–server program in which the client runs in a web browser. Examples: webmail, online store, wikis, instant messaging services etc.
Web application security
– deals with security of websites, web applications and web services.
– draws on the principles of application security but applies them to Internet and Web systems.
Security threats
Emergence of Web 2.0, increased information sharing through social networking and increasing business adoption of the Web as a means of doing business and delivering service, websites are often attacked directly.
• Hackers either seek to compromise the corporate network or the end-users accessing the website by subjecting them to drive-by downloading.
• The majority of web application attacks occur through Cross-site scripting (XSS) , SQL injection and Phishing.
• Web 2.0 refers to World Wide Web websites that emphasize user-generated content, usability, and interoperability for end users.
• A Web 2.0 website allow users to interact and collaborate with each other in a social media dialogue. Examples include social networking sites like Facebook, blogs, wikis, YouTube etc.
OWASP is the emerging standards body for Web application security, published the OWASP Top 10 on the major threats against web applications.
• The Web Application Security Consortium (WASC) has created the Web Hacking Incident Database (WHID) and also produced open source best practice documents on web application security.
• The WHID became an OWASP project in 2014.
The most common structure is the three-tiered application which are presentation, application and storage.
– Presentation - Web browser
– Application - An engine using dynamic Web content technology (such as ASP, CGI, ColdFusion, Dart, JSP/Java, Node.js, PHP, Python or Ruby on Rails)
– Database (storage) - The web browser sends requests to the middle tier, which services them by making queries and updates against the database.
– Security breaches on these kinds of applications are a major concern because it can involve both enterprise information and private customer data.
– The processes for authentication, authorization, asset handling, input, and logging and auditing must be included in the development process.
– Building security into the applications from the beginning can be more effective and less disruptive in the long run.
– Cloud Computing model web applications are software as a service (SaaS) provided for enterprises.
– Resiliency is well built in the cloud apps along with security.