Reading Notes: security of website architecture

PS: This article analyzes the technical architecture of large websites and core principles and cases (by Li smart paper) book Reading Notes // ============================================== ========================================================== ================= *: about 70% of Web application attacks around the world come from XSS attacks and SQL injection. In addition, they include CSRF and Session hijacking. 1. XSS attacks 1. XSS attacks: Cross Site Scripting) *: a hacker embeds a malicious JavaScript script into a webpage file. When a user opens a webpage, the script controls the browser to perform malicious operations *: reflected XSS: attackers trick users into clicking a link to embed malicious scripts. malicious scripts are stored on the attacker's server * Persistent XSS: the attacker submits requests with malicious scripts and stores them on the server of the attacked Web site, normal user access to the Web site is under attack *: disinfect: Escape special characters, such as "<> *: HttpOnly attribute: Cookie adds the HttpOnly attribute, which prevents attackers from using JavaScript scripts to steal cookies. 2. SQL injection 1. SQL injection: attackers inject malicious SQL commands in HTTP requests, this allows the application server to construct an SQL statement by calling the request and construct it together with a malicious SQL command. Execute SQL injection in the database. 2. The attacker needs to understand the database structure. Generally, the attacker can obtain the SQL statement by using the following method :*: open-source software, such as Discuz *: disinfect: Filter possible SQL statements such as "drop table" using regular expressions *: parameter binding: Pre-compile and bind parameters is the best method, malicious SQL statements are only treated as SQL parameters rather than command 3. CSRF attacks (identity Forgery) 1. CSRF attacks: Cross Site Request Forgery (Cross Site Request Forgery )*: attackers use cross-site requests to perform illegal operations as legitimate users, such as transfer transactions. * The core is to use users' browser cookies or server Session policies to steal user identities. *: Form Token: CSRF is used to forge a user request. All parameters of the user request must be constructed. The form Token is blocked by adding a random number Token to the request parameter. The tokens on each response page are different *: verification Code: You need to manually enter the verification code, but this is a bad user experience *: Referer source check: The request source is recorded in the Referer domain of the Http request header, check the request source to determine whether the request is legal. 4. Other attacks and vulnerabilities. 1. Error ECHO: when the Web server is abnormal, the exception stack information is directly output to the client browser *: the defense scheme is very simple. You only need to configure to jump to the 500 page to the special error page. 2. HTML comment: Comment the relevant program information in the HTML code of the client to facilitate hacker attacks. 3. File Upload: attackers can use the file upload function provided by the website to upload executable files *: attackers can defend against the upload by specifying the file format. 4. Path Traversal: attackers can use relative paths in URLs, traverse unopened directories and files in the system *: the defense method is mainly to independently deploy Js, HTML, and other resource files/ /======================================================== =============================== 1. Unidirectional hash encryption *: one-way hash encryption is used to calculate the information of different input lengths in a hash to obtain a fixed-length output, such as MD5 and sha1 *: although the one-way hash encryption algorithm is not cracked, however, because some common modes (such as 123) are used to set passwords, attackers often use rainbow tables (ing of common passwords and corresponding ciphertext) to crack the attacks by speculation *: to enhance the security of one-way hash calculation, you can add salt to the hash algorithm. Salt is equivalent to the Encrypted Key. 2. symmetric encryption *: symmetric encryption refers to the use of the same key for encryption and decryption, such as DES and RC. It is often used in scenarios where information needs to be securely exchanged and stored, such as Cookie encryption. * The advantage is that the algorithm is simple and the encryption efficiency is high, the disadvantage is that how to securely exchange keys in remote communication is a challenge. 3. asymmetric encryption *: asymmetric encryption uses different keys for encryption and decryption, one of which is a public key, A private key that only the owner knows, such as RSA. It is often used in scenarios such as secure information transmission and digital signature *: Information encrypted with a public key must be unlocked with a private key. On the contrary, only the public key can be used to unbind the Information encrypted with the private key. 4. Key Security Management *: The preceding encryption methods provide an important prerequisite for the security effect: Key Security, that is, information security is ensured by keys *: solution 1: put keys and algorithms on an independent server for maintenance by dedicated personnel. Secure, but high application performance overhead. A remote service call is required for each encryption/Decryption *: solution 2: deploy the encryption/decryption algorithm on the application server and the key on the independent server. You can split keys into slices for separate storage, both security and performance improvement // ========================================== ========================================= 1. Text matching *: it is mainly used to solve the sensitive word filtering problem *: regular expressions can be used, but the efficiency is low. Generally, Trie tree variants are used, and the space and time complexity are better. II. Classification Algorithm *: it is mainly used for identification of website spam information *: a simple and practical classification algorithm is Bayesian classification, which is an algorithm used for classification using probability statistics. 3. Blacklist *: blacklist the IP addresses or users that have published junk information, and filter out the IP addresses or user information. * The blacklist can be implemented using the Hash table and stored in the memory for computing, however, if the blacklist is very large, it will occupy a lot of memory. You can use the bloom filter to replace the Hash table without the need for full accuracy.