Website Security (Learn)

Recording

First, security fundamentals 1.1, security

• The importance of website security
• Basic Security Properties
• Attack methods and principles of website intrusion
• The defensive idea of web security

1.2, the main application of site security

• Electronic commerce
• E-government
• Ticketing system
• Company internal System

1.3. Several common safety issues

• denial of service (dos-denial of services) phenomenon: massive invalid access, causing network congestion, users cannot access
• illegal sign-in phenomenon: get the password of the website user, change the content at random on the website
• database-level phenomena: arbitrarily altering database data and selling database data
• Get site Administrator permissions: Web site management is confusing, no basic protection

1.4. Basic properties of security

• Confidentiality of
• Integrity
• Availability of
• Reliability
• Non-repudiation

Ii. common attack methods and principles of website intrusion 2.1, Brute Force hack

Attack principle

Attack content: various login passwords.

Use the tool's repetitive heuristic attack.

Reduce the number of test attempts: Dictionary files, rule cracking

Attack method: Remote hack and local file hack

2.2. SQL injection:

Attack principle:

Enter a special SQL command in a Web form or query string

Implement spoofing server or bypass login authentication

2.3. Upload Vulnerability

Use upload vulnerability to go directly to Webshell

Security vulnerabilities for Web services:

• Character filtering is not strict
• File type not detected
• Upload not weighted

2.4.XSS Cross-site attack

Xss-cross Site Scripting

Attack principle:

• Malicious users inserting HTML or JS scripts into a Web page
• Entice users to click or enter user privacy data
• Hackers get user accounts, cookies and other privacy data

Common attack modes:

• JS mode
• iframe mode
• Ajax Way

Common attack modes:

• Phishing mails
• Image link

2.5.Cookie Fraud

Principle:

• Cookies are user data stored on the client
• Hackers can impersonate administrators or users by modifying local cookies.

Cookie viewing tool: Guilin veterans, etc.

2.6.Dos attackThird, web security defense ideas

Website Security (Learn)