企業(yè)網(wǎng)站服務(wù)之建置與管理(編輯修改稿)
2025-02-05 17:36 本頁面
【文章內(nèi)容簡介】 A2. 注入缺失 (Injection Flaw)： SQL Injection與 Command InjectionA3. 惡意檔案執(zhí)行 (Malicious File Execution) A4. 不安全的物件參考 (Insecure Direct Object Reference) A5. 跨網(wǎng)站的偽造要求 (CrossSite Request Fery，簡稱 CSRF) A6. 資訊揭露與不適當錯誤A7. 遭破壞的鑑別與連線管理 A8. 不安全的密碼儲存器A9. 不安全的通訊 (Insecure Communication)A10. 疏於限制 URL存取 (Failure to Restrict URL Access)資料來源： OWASP臺灣分會OWASP: Open Web Application Security Project (2023)The Ten Most Critical Web Application Security Vulnerabilities1. Unvalidated Parameters2. Broken Access Control3. Broken Account and Session Management4. CrossSite Scripting (XSS)5. Buffer Overflows6. Command Injection Flaws7. Error Handling Problems8. Insecure Use of Cryptography9. Remote Administration Flaws and Application Server Misconfiguration(1). Unvalidated Parameters? Information from web requests is not validated before being used by a web application.? Attackers can use these flaws to attack background ponents through a web application.(2). Broken Access Control? Restrictions on what authenticated users are allowed to do are not properly enforced.? Attackers can exploit these flaws to access other users39。 accounts, view sensitive files, or use unauthorized functions.(3). Broken Account and Session Management? Account credentials and session tokens are not properly protected.? Attackers that can promise passwords, keys, session cookies, or other tokens can defeat authentication restrictions and assume other users39。 identities.(4). CrossSite Scripting (XSS)? The web application can be used as a mechanism to transport an attack to an end user39。s browser.? A successful attack can disclose the end user39。s session token, attack the local machine, or spoof content to fool the user.XSS Example~留言版 ~XSS Web Application Hijack Scenario(5). Buffer Overflows? Web application ponents in some languages that do not properly validate input can be c
環(huán)評公示相關(guān)推薦
鄂ICP備17016276號-1