Ciber Seguridad
Who
Cyver Criminals
States
Researchers
Hobbiest
Cyber Security
Categories
Policy & Risk Management
Defensive Security
Security Tooling
Offense Focuse
App Pen-testing
Hybrid App Assessment
Mobile App Assessment
Advanced Red Teaming
Product Sec. Review
Internal Pen-testing
External Pen-testing
Cloud Sec-review
CIA
Integrity
Availability
Confidentiality
Vulnerabilities
Flaws/oversights taht allows attackers to do something malicious
Exploits
Process of attacking a vulnerability
Risk
Collection of criteria and impacts
Approaches
Developer Center
Functionality Based
Vulnerability Centric
Use Centric
Bugs
Desing defects
Implementation
Operational
Authentication
Authorization
Data Storage
Code Quality
Forbidden/broken fn
Improper impl./spec.
Misconfig
Attacks against users
Unpatched servers
Deployment
Intrusion Points
Direct: Without 3rd party
Indirect: Require 3rd party
Attacks
System Based
SQL injection
Directory Traversal
RCE
File Upload
Insecure Direct Object Browsing
Mass Assignment
User Based
XSS
CSRF
Browser explits
Bad passwords
Auto Complete
Attacks
XSS
DOM: App with JS that pocesses data
from untrusted source in an unsafe way,
writing data to de DOM
Stored / Persistent / 2nd Order: app receives
data from an untrusted source an includes it
within a later HTTP response in an usafe way
Controls
Restricted character
Removal of characters
Space limitations
Location based restrictions (CSP)
Blind XSS: Injects payload and
executed in another part of the app
or in another app
SQL Injection
Prevention
Parameterized queries
ORMs
Stored procedures
Detection
erros
timeout
callbacks
Reflected: app receives and includes
data within the immediate response in
an unsafe way
Insecure Direct
Object Reference
Direct acceso to obj based on
user-supplied input
Directory Traversal