Author: Zen and the Art of Computer Programming
1 Introduction
In the Internet era, security has always been a very important issue. Not only that, more and more people believe that their data on the computer is more private and want to protect their privacy. But even the best measures can't prevent attackers from invading users' systems in various ways. Therefore, there is still a lot of work to be done in protecting user privacy, and security is always a long-term and arduous task. In the past few years, I worked as a security engineer. In order to help those who are new to the security field or need to improve their security awareness, I think I should write an article to teach you some knowledge about security. This article will start with ten common security attacks and give solutions based on actual cases. I hope it can help developers who are new to or need to improve their security awareness.
This article does not involve security vulnerabilities related to personal privacy such as sensitive data leakage and malicious code release. For those with some security awareness, these vulnerabilities can be detailed in other articles. In addition, this article assumes that readers have a basic understanding of network security, including basic knowledge such as TCP/IP protocol stack, VPN technology, encryption algorithms, etc. If readers do not have relevant basic knowledge, they can refer to the relevant chapters in my other article "Illustrated Computer Networks".
The structure of the article is as follows: First, introduce some basic concepts, terminology and basic knowledge involved in this article. Then, each attack type is analyzed in detail, its principles are introduced, how it is used to obtain sensitive information and how to defend against this attack. Finally, concluding suggestions are given as the end of this article.
2. Introduction to basic concepts, terminology and basic knowledge
2.1 Concepts, terms and definitions
2.1.1 XSS cross-site scripting attack (Cross-Site Scripting)
XSS is a common attack method in web application security&