"Cloud knows" how to understand security testing

Pay attention to the clouds and help raise the salary.
Cloud knows
Know more than a professional knowledge sharing platform keywords: Cognitive Web security Test no longer the security test topic is very large, is a depth and a wide range of content, but you can narrow down the scope, so that more people can easily understand what is the Web security test, this is one of the most basic security.
The most common Web application attack technology cross-site scripting Attack (Cross-site SCRIPTING,XSS)
Cross-site scripting is a means of security attacks, usually easy to ignore, this way through the dynamic interface to send special parameter information to the server, and the server then put the parameter content in the dynamic page, this situation appears in a number of query function page, in order to maintain each operation can retain the previous operating conditions and data, But this happens to be used, to see an example, of course, do not think that the input is to use the keyboard input, JS casually can block out, generally need to through the interface to achieve this process.
When there is a value for the condition, the user enters 10 and submits the query, then the HTML content at this time is:

<input name= "Price" value= "ten"/>

But if this is the case, then the code that executes JS is changed to a lot of things that can be done.

<input name= "Price" value= "ten"/><script>alert (123) </script>

SQL injection attack SQL injection attack (SQL injection)
SQL injection of this attack, although it is not difficult to prevent, but once the negligence caused the problem, the harm is great, the attacker can obtain any internal data he wants, even through such a way to break through the login, permissions and other key logic control. So here's a simple example of the data that can only be queried for a single ID, and it changes to be able to look up all the data.
Let's look at a normal data situation.

Select * from datatable where id = ' Test '

One more effect after being attacked.

Select * from datatable where id = ' Test ' or ' 1 ' = ' 1 '

Malicious file Upload file upload, as the name implies, is that some sites will support the ability to upload files, such as common is the picture, there are some other common file types, many people think this is very simple ah, the file has a suffix name, judge can, but the suffix is also people casually decided, want to write anything can, Then the new method appears, the upload protocol will also have MIME type, most Web services can be configured to allow the MIME type, or can self-judge the filter MIME type, it does the role of protection, unfortunately, mime can be forged, but the relative suffix name is not so easy to modify, Need to modify the interface data to do, basically no tool can directly detect the problem.

If you want to know how to deal with malicious files upload, remember to reply oh, we will see in the following topics.
End of course, there is no such thing as absolute security in the world, not just computers, there are dangerous factors lurking in any human activity. We can only say to avoid security problems as much as possible, even to prevent possible problems.
Cloud Knowledge sharing platform Do you have a question? Can be in the cloud to know the topic of the direct message Oh, if selected, will be the next issue of the question and answer content, will be a professional expert to answer, many times by the selected will also get the cloud to provide a gift, remember more attention OH ~
full stack test aggregation Test Learning | Test Communication | Test recruitment
Public number reply column name or number "2" to view the past period content OH

Cloud knows how to understand security tests