Broken Access Control: Logged In Is Not the Same as Allowed
The most common serious web bug is also the most boring: the server checks who you are, then forgets to check whether you may touch this particular thing.
Security From the Ground Up05
Subject · 5 posts
web security
Cross-Site Request Forgery: Making the Victim's Browser Do It
The attacker never steals the session. They get the victim's own browser to send an authenticated request, using cookies the browser attaches for them.
Security From the Ground Up04
Cross-Site Scripting: Running Your Code in Someone Else's Browser
The same bug as SQL injection, moved to the browser. How attacker text becomes attacker script in your users' sessions, the three flavours, and the layered fix.
Security From the Ground Up03
SQL Injection: When Your Query Is Written by the Attacker
The clearest case of data becoming code. How a login form ends up running the attacker's SQL, why escaping is the wrong fix, and the one that actually ends it.
Security From the Ground Up02
What Security Actually Is: Trust Boundaries and the Two Master Bugs
Security is not a product you add. It is a property of where you decide to trust, and almost every vulnerability is one of two confusions crossing that line.
Security From the Ground Up01