Design and detection of Software Website Security and Solutions

Design and detection of Software Website Security and Solutions

Security Testing mainly involves the following aspects:

1. SQL injection (SQL injection)

See the article "preventing SQL Injection solutions ".

2. Cross-Site scritping (XSS): (Cross-Site Scripting)

See "XSS cross-site scripting solution"

3. csrf: (cross-site forgery request)
4. email header injection (mail header injection)
5. Directory Traversal (directory traversal)
6. Exposed error messages (error message)

7. Search for the Management Portal;

8. Authentication Bypass

A. When you view sensitive data, you only need to determine the permissions.

B. When submitting changes to sensitive data, you must also confirm the permission. It is your own

C. You must set the one-time use and validity period when activating the service. The connection string is encrypted with 3DES, and no plaintext string is allowed.

D. Enter the original password for verification when changing the password.

9. File Upload Vulnerability

10. program architecture security

A. Use the CS architecture whenever possible

B. The website's front-end cannot be in the web form, but the backend management can be made into CS.

C. Use. NET and Java in programming languages

11. Security of configuration files

Most of the time, our database passwords are stored in the configuration file, which is in plaintext. It is easy to use. The solution is to use ciphertext storage and 3DES encryption ...... The key is directly written in the Code and cannot be placed in plain text files ......

12. Have you used HTTPS?

13. Cookie Security

See "" improve cookie security-related solutions "", mainly using 3DES encryption cookie = 3DES ("value, time, IP stamp ");

14. Questions about price modification of E-commerce forms

Use the MD5 Signature for verification.

14. Session Security

The permission cannot be determined by null session. A clear value must be set.

15. Verify the server

You cannot rely only on the client for verification.