GWAPT Certification!Recently I achieved getting my GIAC Web Application Penetration Tester (GWAPT) certification. I passed with a 96% and I highly recommend anyone considering going into web application pentesting to take. I took a SANS course with Kevin Johnson and had a great experience.
Ok, so let's get to today's post.
Basic Security Tenets for protecting web applicationsI'm going to attempt to consolidate the many attacks we see against web applications and some steps you can take to prevent them in your web applications. Again, these are some basic things coming off the top of my head and is by no means a comprehensive list.
Client Side Code:
With AJAXified (is that actually a word now?!?) websites, more and more logic is being passed down to the client. This presents a problem (or an opportunity if you're someone like me) as anything being passed down to the client can be modified and used.
Seriously avoid putting things like input validation and authentication logic on the client side as it makes the bad guy's job much much easier. Remember that anything on the client can (and will) be turned against you.
One of the ways attackers go after web applications is attacking the session management system itself. If an attack is able to get a legitimate session, they've essentially unlocked a door and allowing them to continue through your application. Here are some things you can do to help eliminate session vulnerabilities.