vault backup: 2025-03-16 18:59:42

Penetration Testing/Week 20/Week 20 - Web Application Attacks.md

@@ -81,16 +81,19 @@ Malicious script sent to user
 - Recommendations for session IDs (OWASP)
 
 ### Method
+
 Log in to application
 Provide service, user stays logged in
 Email info about session ID
 Other user can access website as first user
 
 ### Fixes
+
 - Authentication linked to time
 - OWASP recommendations followed
 - Link session ID to IP address, TLS session, etc.
 Reconnaissance Assignment
+
 ## [OWASP Top-10](https://owasp.org/Top10/) Web Application Risks (as of 2017):
 
 - Injection, Broken Authentication, Sensitive Data Exposure, XML External Entity (XXE), Security Misconfiguration, Cross-Site Scripting (XSS), Insecure Deserialization, Using Components with Known Vulnerabilities, Insufficient Logging & Monitoring
@@ -109,4 +112,4 @@ Tampering - Can an attacker modify data as an application runs?
 Repudiation - If an attacker denies interaction, can we prove it?
 Information Disclosure - Can an attacker gain PII?
 Denial of Service - Can an attacker crash or reduce availability?
-Elevation of Privilege - Can an attacker assume the identity of a privileged user?
+Elevation of Privilege - Can an attacker assume the identity of a privileged user?