CWE 352

[pandyex]

CWE-352

[pandyex]

CWE_352

[pandyex]

CSRF

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: Cross-site request forgery (Detected by phrase)

Matched on "CSRF"

What is this? (2min video)

Session-related but not session-based, this attack is based on the ability of an attacker to force an action on a user’s browser (commonly in the form of a POST request) to perform an unauthorized action on behalf of the user. This can often occur without the user even noticing it… or only noticing when it is too late. The root cause is that browsers automatically send session cookies with all requests to a given domain, regardless of where the source of the request came from, and the application server cannot differentiate between a request that came from pages it served or a request that came from an unrelated page.

Try this challenge in Secure Code Warrior

[pandyex]

CSRF

[pandyex]

XXE

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: External entity injection (Detected by phrase)

Matched on "XXE"

What is this? (2min video)

An XML External Entity attack is a type of attack against an application that parses XML input. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, server-side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts.

Try this challenge in Secure Code Warrior

[pandyex]

CWE 112

[pandyex]

injection

[pandyex]

code injection

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: Code injection (Detected by phrase)

Matched on "code injection"

What is this? (2min video)

Code injection happens when an application insecurely accepts input that is subsequently used in a dynamic code evaluation call. If insufficient validation or sanitisation is performed on the input, specially crafted inputs may be able to alter the syntax of the evaluated code and thus alter execution. In a worst case scenario, an attacker could run arbitrary code in the server context and thus perform almost any action on the application server.

Try this challenge in Secure Code Warrior

[pandyex]

CWE 89

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE 89)

Matched on "CWE 89"

What is this? (2min video)

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Try this challenge in Secure Code Warrior

[pandyex]

SQL Injection

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: SQL injection (Detected by phrase)

Matched on "SQL Injection"

What is this? (2min video)

This is probably one of the two most exploited vulnerabilities in web applications and has led to a number of high profile company breaches. It occurs when an application fails to sanitize or validate input before using it to dynamically construct a statement. An attacker that exploits this vulnerability will be able to gain access to the underlying database and view or modify data without permission.

Try this challenge in Secure Code Warrior

[pandyex]

CWE 89

[ivyhan-se]

CWE-352

[ivyhan-se]

CWE 494

[secure-code-warrior-for-github[bot]]

Micro-Learning Topic: Download of Code Without Integrity Check (CWE 494)

Matched on "CWE 494"

What is this? (2min video)

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Try this challenge in Secure Code Warrior

[ivyhan-se]

cwe 352

[ivyhan-se]

cwe 494

[ivyhan-se]

cwe 863

[ivyhan-se]

CWE 863