Scribd
Upload
3 views5 pages

Chapter 1 Cyber Security

The document discusses the importance of SSL in securing data transmission but highlights that SSL alone does not guarantee website security. It details common vulnerabilities like Cross-Site Scripting (XSS) and others, emphasizing that these can lead to serious risks such as session hijacking and data theft. Ultimately, while SSL protects data in transit, it does not safeguard against vulnerabilities in web applications themselves.

Uploaded by

sofiya29814
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
3 views5 pages

Chapter 1 Cyber Security

The document discusses the importance of SSL in securing data transmission but highlights that SSL alone does not guarantee website security. It details common vulnerabilities like Cross-Site Scripting (XSS) and others, emphasizing that these can lead to serious risks such as session hijacking and data theft. Ultimately, while SSL protects data in transit, it does not safeguard against vulnerabilities in web applications themselves.

Uploaded by

sofiya29814
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 5

 The Site is Secure: It uses secure socket layer(SSL)- In

order to provide a high degree of privacy, SSL encrypts data


that is transmitted across the web. This means that anyone
who tries to intercept this data will only see a garbled mix of
characters that is nearly impossible to decrypt.

 SSL initiates an authentication process called a handshake


between two communicating devices to ensure that both
devices are really who they claim to be.

 SSL also digitally signs data in order to provide data integrity,


verifying that the data is not tampered with before reaching
its intended recipient.

Most people think that if they use ssl and adopt the PCI(payment card
industry) standards the website is secure. But even after using ssl and
adopting PCI scanning methods still website is insecure.

Authors tested some common vulnerabilities between


2007 to 2011

Cross site scripting -XSS(94%successfull)

Cross-Site Scripting (XSS) is a web security vulnerability that


enables attackers to inject malicious scripts into web pages that are then
executed in the browsers of other users. The vulnerability arises when
a web application allows users to input data without proper validation or
escaping, leading to the execution of harmful code within the user's
browser.

2. How XSS Works:

1. User Inputs Data:

o A user submits input on a web page (e.g., in a form, search bar,


comment section).

o If the input isn’t properly sanitized or encoded, the data might


include malicious code (usually JavaScript).

2. Injection of Malicious Script:

o The attacker inputs malicious code, such as:

o <script>alert('XSS Attack!');</script>

o This script is treated as part of the page’s content instead of


being neutralized.

3. Script is Stored or Reflected:

o Stored XSS: The script is saved to the server (e.g., in a


database) and is then displayed to other users who visit the
affected page.

o Reflected XSS: The script is included in a URL, and when


clicked, it’s reflected back to the user in the server's response.

o DOM-based XSS: The malicious script is executed by client-side


JavaScript when it manipulates the DOM.

4. Execution in Victim’s Browser:


o When other users visit the affected page, the malicious script
runs in their browsers as if it’s part of the website’s content.

o The attacker’s script can then perform various malicious actions


such as stealing cookies, hijacking sessions, redirecting users, or
executing any code that runs in the context of the website.

3. Example:

Scenario (Stored XSS):

1. User Submits Malicious Input:


An attacker submits the following comment on a blog post:

2. <script>alert('XSS Attack');</script>

3. Website Stores Input:


The website stores this input in its database and then displays it when
someone views the comment section.

4. Victim Visits the Page:


Another user views the page, and their browser executes the script
embedded in the comment.

5. Result:
The attacker’s alert script pops up, showing a message in the victim’s
browser, as if it was a legitimate part of the website.

Real Impact Example:


An attacker can use XSS to steal a user’s session cookies, impersonate
the user, and perform actions on their behalf, such as transferring funds
from an online bank account or changing account settings.

Conclusion:
XSS vulnerabilities occur when user input is not properly sanitized,
allowing attackers to inject malicious scripts that are executed by other
users' browsers. It’s a serious risk because it can lead to session hijacking,
data theft, or other forms of exploitation.

https://www.geeksforgeeks.org/what-is-cross-site-scripting-xss/

link for better explanation with diagram.

2. Cross site request forgery(92%):

3. Information leakage(78%):

4.Broken access control(71%):

5.Broken authentication(71%):

6.SQl injection(32%):

SSl: SSL is a strong technology that helps protect the confidentiality of


your data, meaning it keeps your private information (like passwords or
credit card numbers) safe from others while it's being sent between your
browser and the website. It also protects the integrity of the data,
making sure it isn’t changed or tampered with during transmission. Plus,
SSL provides authentication, so you can be more confident that you're
really talking to the right website.

But SSL only protects data in transit—while it's moving between your
browser and the server. It does not protect against attacks on the website
itself (the server) or your browser (the client). Many successful attacks
happen because of flaws in the application, not the connection. So even if
a website uses SSL, it can still have serious security vulnerabilities.

You might also like