InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Comprehensive overview of web application security, common vulnerabilities, OWASP Top 10, and the security mindset for protecting modern web applications.
What is Web Security?
Web security encompasses all measures taken to protect websites and web applications from cyber threats. As web applications process sensitive data and handle critical business logic, they become prime targets for attackers.
The OWASP Top 10 (2021)
The Open Web Application Security Project (OWASP) maintains the definitive list of critical web security risks:
| Rank | Vulnerability | Description | Impact |
|---|---|---|---|
| A01 | Broken Access Control | Users act outside intended permissions | Data theft, unauthorized actions |
| A02 | Cryptographic Failures | Sensitive data exposure | Data breaches |
| A03 | Injection | SQL, NoSQL, OS command injection | Full system compromise |
| A04 | Insecure Design | Missing security architecture | Fundamental vulnerabilities |
| A05 | Security Misconfiguration | Default configs, open cloud storage | Unauthorized access |
| A06 | Vulnerable Components | Outdated libraries/frameworks | Known exploit execution |
| A07 | Authentication Failures | Broken auth mechanisms | Account takeover |
| A08 | Software/Data Integrity | Untrusted updates, CI/CD issues | Supply chain attacks |
| A09 | Logging/Monitoring Failures | Missing audit trails | Undetected breaches |
| A10 | Server-Side Request Forgery | Server makes requests to unintended URLs | Internal network access |
Web Application Architecture & Attack Surface
Example
Web Application Attack Surface:
==================================
User/Browser Network Server
+-----------+ +------------+ +-----------+
| XSS | | MITM | | SQLi |
| CSRF | ←— HTTPS ——→ | Sniffing | ←— TLS ——→ | RCE |
| Clickjack | | DNS Spoof | | LFI/RFI |
| DOM manip | | SSL Strip | | SSRF |
+-----------+ +------------+ +-----------+
| |
v v
+-------------------+ +------------------+
| Client-Side | | Server-Side |
| - Input validation| | - Input sanitize |
| - CSP headers | | - Parameterized |
| - SRI integrity | | queries |
| - Cookie security | | - WAF rules |
+-------------------+ +------------------+
HTTP Security Headers
Example
# Essential security headers for web applications
security_headers = {
"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
"Content-Security-Policy": "default-src 'self'; script-src 'self'",
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "DENY",
"X-XSS-Protection": "0", # Deprecated, use CSP instead
"Referrer-Policy": "strict-origin-when-cross-origin",
"Permissions-Policy": "camera=(), microphone=(), geolocation=()",
"Cross-Origin-Opener-Policy": "same-origin",
"Cross-Origin-Resource-Policy": "same-origin"
}
# Flask implementation
from flask import Flask, make_response
app = Flask(__name__)
@app.after_request
def add_security_headers(response):
for header, value in security_headers.items():
response.headers[header] = value
return response
The Security Development Lifecycle
| 1. Requirements | Security requirements, threat modeling |
| 2. Design | Security architecture, data flow diagrams |
| 3. Implementation | Secure coding practices, code review |
| 4. Testing | SAST, DAST, penetration testing |
| 5. Deployment | Hardened configs, security headers |
| 6. Maintenance | Patching, monitoring, incident response |
Common Web Vulnerabilities Quick Reference
python example
# VULNERABLE vs SECURE code examples
# SQL Injection
# VULNERABLE:
query = f"SELECT * FROM users WHERE username = '{user_input}'"
# SECURE:
cursor.execute("SELECT * FROM users WHERE username = %s", (user_input,))
# XSS (Cross-Site Scripting)
# VULNERABLE:
html = f"<div>Welcome, {user_input}</div>"
# SECURE:
from markupsafe import escape
html = f"<div>Welcome, {escape(user_input)}</div>"
# Path Traversal
# VULNERABLE:
filepath = f"/uploads/{user_filename}"
# SECURE:
import os
safe_name = os.path.basename(user_filename)
filepath = os.path.join("/uploads", safe_name)Interview Questions
- What is the OWASP Top 10 and why is it important?
- It's a periodically updated list of the most critical web application security risks based on data from hundreds of organizations. It serves as an awareness document and baseline for web security testing, compliance, and secure development training.
- Explain the concept of defense in depth for web applications.
- Multiple security layers so if one fails, others protect: input validation + parameterized queries (against SQLi), CSP + output encoding (against XSS), WAF + application logic + rate limiting (against attacks). No single control is relied upon alone.
- What is the Same-Origin Policy and why does it matter?
- SOP restricts how scripts from one origin can interact with resources from another origin. An origin is defined by scheme + host + port. It prevents malicious scripts on one site from reading sensitive data from another site the user is logged into.
- How would you secure a REST API?
- Authentication (OAuth 2.0/JWT), authorization checks on every endpoint, input validation, rate limiting, HTTPS only, proper CORS configuration, security headers, API versioning, logging, and monitoring.
- What is the difference between authentication and session management vulnerabilities?
- Authentication vulnerabilities allow attackers to compromise identity verification (weak passwords, credential stuffing). Session management vulnerabilities allow attackers to hijack already-authenticated sessions (session fixation, token theft, inadequate expiration).
Continue the lesson path
Study next in this module
01Web SecuritySQL Injection Attacks and PreventionComplete guide to SQL injection vulnerabilities covering attack types, exploitation techniques, prevention with parameterized queries, and real-world case studies.02Web SecuritySession Management SecurityBest practices for secure session management including token generation, cookie attributes, fixation prevention, and timeout strategies.03Web SecuritySecure Coding Practices — Information SecurityEssential secure coding practices for web developers covering input validation, output encoding, error handling, and OWASP guidelines for building resilient applications.04Web SecurityHTTPS and SSL/TLSDeep dive into HTTPS, SSL/TLS protocol handshake, certificate verification, cipher suites, and secure transport layer communication.