Security is one of the most important aspect of any application development process.

 Here we are going to talk about Web Application Security, We enforce security constraints to control the access of resources. Normally we use password challenge mechanism and role based security to ensure that access to any resource is provided to the right user. 

But there are several flaws in design of application or software we use for our application like OS, Webserver, Application Server, Database server. Any intelligent hacker can use these flaws to fool our security mechanism and can get unauthorized access which can further lead to a big loss to you.

 Classification of threats/attacks is:

1. Authentication: attacks to break authentication mechanism

• Brute force attack (automated process of trial and error used to guess username/password, credit card number etc.). To prevent this attack we can use CAPTCHA challenge on login page, or lock access for multiple access from same IP address.
• Insufficient Authentication: When your sensitive information is accessible without proper authentication. This should be taken care in design phase and proper test cases should be prepared.
• Weak Password Recovery: When a web application permits any body to access another users password like Forgot Password displays password on screen. Password recovery challenge is weak.

2.  Authorization: Attacks which uses some other users authenticated session.

• Session Hijacking: Brute force exploitation of Web Application Session ID to gain access to some other users session.
• Insufficient Authorization is when a web site permits access to sensitive content or functionality to any authenticated user arbitrarily. Like: Admin module access is available tonormal user or /log/ directory access is available ti normal user.
• Insufficient Session Expiration: In shared computing environment like in a cybercafe if a user has not logged out properly then other user can access authenticated session of previous user if session is not expired properly.
• Session Fixation: Session Fixation is an attack technique that forces a user's session ID to an explicit value.

3. Client-side Attacks: Attacks to exploit a website's user.

• Content Spoofing: Attack is used to trick a user certain content appearing on a web site is legitimate and not from an external source. Like: (http://foo.example/page?frame_src=http://foo.examp
  le/file.html). An attacker may be able to replace the “frame_src" parameter value with some other website. This kind of crafted links can be sent a users email, ims or bulletin boards and exploit a user.

More on PartII...