Business Security for Web Attack and Defense: Input/Output Module Testing.

Business Security for Web Attack and Defense: Input/Output Module Testing.

Business security refers to measures or means to protect business systems from security threats. Business security in a broad sense should include the software and hardware platforms (operating systems, databases, middleware, etc.) that run the business, the business system itself (software or equipment), and the security of services provided by the business ; business security in the narrow sense refers to the business system’s own software and service security .

---

directory :

I/O module tests:

Test principle and method:

Testing process:

(1) SQL injection vulnerability test:

(2) XSS vulnerability test:

(3) Command execution vulnerability test:

Defense method suggestions:

(1) Suggestions for SQL injection vulnerability defense methods:

(2) Suggestions for XSS vulnerability defense methods:

(3) Suggested defense methods for command execution vulnerabilities:

---

Disclaimer:

It is strictly forbidden to use the technology mentioned in this article to carry out illegal attacks, otherwise the consequences will be at your own risk, and the uploader will not bear any responsibility.

---

I/O module tests:

Test principle and method:

The input/output module may have: SQL injection, XSS, command execution and other vulnerabilities.

---

Testing process:

(1) SQL injection vulnerability test: https://tianyuk.blog.csdn.net/article/details/122903983

---

(2) XSS vulnerability test: ①  https://tianyuk.blog.csdn.net/article/details/123396714

                                   ② https://tianyuk.blog.csdn.net/article/details/123555545

---

(3) Command execution vulnerability test: https://tianyuk.blog.csdn.net/article/details/122916853

---

Defense method suggestions:

(1) Suggestions for SQL injection vulnerability defense methods:

① Limit data type

② Regular expressions match incoming parameters

③ function filter escape

④ Precompiled statement

---

(2) Suggestions for XSS vulnerability defense methods:

① You can set httponly in the cookie . ( The browser prohibits the js of the page from accessing the cookie with the httponly attribute )

② Output check. ( encoding, escaping, common encoding: html encoding, js encoding, hexadecimal, etc. )
③ xss filter. ( check input, set whitelist method )
④ use different processing methods for output in different locations.

⑤ There may be filtering measures in the background, and the constructed script may be filtered out, but cannot take effect or the environment restricts execution. ( Browser )
⑥ Process rich text.  Use the content-Sencurity-Policy field  in the header  to specify the domain name of the requested js  List. ( CSP Policy )

---

(3) Suggested defense methods for command execution vulnerabilities:

① Do a strict filter on incoming commands.

② Do not use external execution commands as much as possible

③ Use  the escapeshellarg  function as much as possible to process the incoming command parameters.