- A01 Broken Access Control:
- Privilege escalations
- CORS misconfiguration allaowing APi access from untrusted origins
- Accessing restricted methods like PUT, DELETE
- Force browsing authenticated pages without valid credentials
- Preventive steps:
- Deny by Default
- Rate limit APIs,
- Session identifier should be invalidated
- A02 Cryptographic Failures - Sensitive Data Exposure(2017) : Focus on Cryptographic failures which often leads to sensitive data exposures
- Plain text data Transmission
- Deprecated Hash fuinctions in use line MD5, SHA1
- Security headers missing in reuqest and response
- Server certicated properly and trust chain properly validated?>
- Preventive measures:
- Encrypt data at rest
- Use authenticated encryption
- A03 Injection:
- A04 Insecure Design
- A05 Security Misconfiguration
- A06 Vulnerable and Outdated Components
- A07 Identification and Authentication Failures
- A08 Software and Data Integrity Failures
- A09 Security Logging and Monitoring Failure
- A10 Server Side Request Forgery (SSRF)
No comments:
Post a Comment