Dr.G.

NIRMALA

UNIT 4:

Web application security

Common issues in web apps:

Here are seven of the most common web application performances

1. ​DNS issues and network connectivity

2. Slow servers and loading time

3. Poorly written code

4. Lack of load balancing

5. Traffic spikes

6. Specific HTML title tags

7. Failing to optimize bandwidth Usage

1) DNS issues and network connectivity

An essential element of successful web traffic management is DNS queries,

which is why an issue with these systems can result in a plethora of issues.

Without the proper protection, faulty DNS queries can prevent visitors from

reaching your website, while also causing errors, 404s, and incorrect pathways.
Dr.G.NIRMALA

2) Slow servers and loading time

If your servers are particularly slow, they could be hosted using a shared account, which means

that your site is sharing the server with hundreds, possibly thousands of other websites. You can

address this common roadblock by checking with your hosting company to determine whether or

not the site is hosted on a dedicated server. If it isn’t, you can request this service, but it may

come at an additional price.

3) Poorly written code

Another web application performance problem that many face is with poorly written code, which

could refer to inefficient code, memory leaks, or synchronization issues. Your application could

also deadlock due to ineffectual algorithms, as well as the performance degradation of a web
Dr.G.NIRMALA

application. Old versions of software or integrated legacy systems can also take a toll on your

website’s performance.

4) Lack of load balancing

Slow response times can also be caused by poor load distribution. When new site visitors are

assigned incorrectly, it can drown out your servers even if the system is under capacity. Such an

issue can cause a slow response time, especially if your site is receiving too many requests.

5) Traffic spikes

Spikes happen, especially during a marketing promotion with videos, and a company may not be

prepared for the extra traffic. This issue can also cause your servers to slow down, hindering the

performance of your site and harming your brand.

6) Specific HTML title tags

Even the name of your website can affect its performance as HTML title tags are essential to its

success. These tags sum up the entire content of your website or web page to major search

engines such as Google. However, a lack of specificity in your domain name can lower its

visibility.

7) Failing to optimize bandwidth usage

When developing and testing a site, businesses often rely on a local network environment. This

may not seem like an issue at first because adding visual, audio, video or other high-volume data

may not affect your local network.

XSS:

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are

injected into otherwise benign and trusted websites.

XSS attacks occur when an attacker uses a web application to send malicious code,

generally in the form of a browser side script, to a different end user.

Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web

application uses input from a user within the output it generates without validating or

encoding it.

An attacker can use XSS to send a malicious script to an unsuspecting user.

The end user’s browser has no way to know that the script should not be trusted, and will

execute the script.

Because it thinks the script came from a trusted source, the malicious script can access

any cookies, session tokens, or other sensitive information retained by the browser and

used with that site.

These scripts can even rewrite the content of the HTML page

Types of Cross-Site Scripting

● Server XSS

● Client XSS
Dr.G.NIRMALA

Server XSS

Server XSS occurs when untrusted user supplied data is included in an HTML response

generated by the server. The source of this data could be from the request, or from a stored

location. As such, you can have both Reflected Server XSS and Stored Server XSS.

Client XSS

Client XSS occurs when untrusted user supplied data is used to update the DOM with an unsafe

JavaScript call. A JavaScript call is considered unsafe if it can be used to introduce valid

JavaScript into the DOM. This source of this data could be from the DOM, or it could have been

sent by the server (via an AJAX call, or a page load). The ultimate source of the data could have

been from a request, or from a stored location on the client or the server. As such, you can have

both Reflected Client XSS and Stored Client XSS.

SQL Injection:

SQL injection, also known as SQLI, is a common attack vector that uses malicious SQL

code for backend database manipulation to access information that was not intended to be

displayed. This information may include any number of items, including sensitive

company data, user lists or private customer details.

The impact SQL injection can have on a business is far reaching. A successful attack may

result in the unauthorized viewing of user lists, the deletion of entire tables and, in certain

cases, the attacker gaining administrative rights to a database, all of which are highly

detrimental to a business.
Dr.G.NIRMALA

When calculating the potential cost of a SQLI, it’s important to consider the loss of

customer trust should personal information such as phone numbers, addresses and credit

card details be stole

CRSF:

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute

unwanted actions on a web application in which they're currently authenticated.

CSRF attacks specifically target state-changing requests, not theft of data, since the

attacker has no way to see the response to the forged request.

With a little help of social engineering (such as sending a link via email or chat), an

attacker may trick the users of a web application into executing actions of the attacker's

choosing.

If the victim is a normal user, a successful CSRF attack can force the user to perform
state changing requests like transferring funds, changing their email address, and so forth.
If the victim is an administrative account, CSRF can compromise the entire web
application.

PASSWORD VULNERABILITES:

A number of possible vulnerabilities arise from the use of passwords:

Measures mitigating one of these vulnerabilities can increase exposure to another. For example,

strong passwords can be difficult to remember and this may lead to their being forgotten or

written down and subsequently stolen.

Here are the two general classifications of password vulnerabilities:

● Organizational or​ ​user vulnerabilities: ​This includes lack of password policies that are

enforced within the organization and lack of security awareness on the part of users.

● Technical vulnerabilities:​ This includes weak encryption methods and unsecure storage

of passwords on computer systems.

SSL:
Secure Sockets Layer (SSL) is a computer networking ​protocol​ for securing connections

between network application clients and servers over an insecure network, such as the

internet. Due to numerous protocol and implementation flaws and ​vulnerabilities​, SSL

was ​deprecated​ for use on the internet by the Internet Engineering Task Force (​IETF​) in

2015 and has been replaced by the Transport Layer Security (​TLS​) protocol.

SSL uses a combination of ​public key​ and symmetric key ​encryption​ to secure a connection

between two machines, typically a web or ​mail server​ and a client system, communicating

over the ​internet​ or another ​TCP/IP​ network. SSL provides a mechanism for encrypting

and authenticating data sent between ​processes​running on a client and server.

How it works

The SSL protocol includes two sub protocols: the record protocol and the "handshake"

protocol.

The handshake protocol defines how a client and server establish an SSL connection,

including the negotiation of which cryptographic systems each host is willing (or unwilling)
Dr.G.NIRMALA

to use for communication, as well as the exchange of cryptographic material, such as public

keys and session keys for encryption or authentication of transmitted data.

The record protocol defines how communicating hosts exchange data using SSL, including

specifications for how data is to be prepared for transmission and how it is to be verified or

decrypted on receipt

CAPTCHA:

Completely automated public Turing test to tell computers and humans apart, better known

as CAPTCHA, is a test to ensure responses through a human versus a computer program.

CAPTCHA automatically generates response challenges by providing a problem which can

only be solved by humans, automatically preventing access to system software and

requesting a typed character series.

A computer administers CAPTCHA to a human, whereas a human administers the Turing

test to a machine​.

Session hijacking (TCP session hijacking):

session by surreptitiously obtaining the ​session ID​ and masquerading as the authorized user.

Once the user's session ID has been accessed (through ​session prediction​), the attacker can

masquerade as that user and do anything the user is authorized to do on the network.

The session ID is normally stored within a ​cookie​or URL. For most

communications, ​authentication​procedures are carried out at set up.

Session hijacking takes advantage of that practice by intruding in ​real time​, during a session.

The intrusion may or may not be detectable, depending on the user's level of technical

knowledge and the nature of the attack.

If a Web site does not respond in the normal or expected way to user input or stops responding

altogether for an unknown reason, session hijacking is a possible cause.

AUDIT TRAIL:

A record showing who has accessed a ​computer system​ and what operations he or she has

performed during a given period of time. Audit trails are useful both for maintaining ​security​ and

for recovering lost transactions. Most accounting ​systems​ and ​database management

system​s​ include an audit trail component. In addition, there are separate audit

trail ​software​ products that enable ​network administrators​ to monitor use of network ​resources​.

LOCAL FILE INCLUSION:

Local File inclusion (LFI), or simply File Inclusion, refers to an inclusion attack through which

an attacker can trick the web application in including files on the web server by exploiting

functionality that dynamically includes local files or scripts. The consequence of a successful

LFI attack includes Directory Traversal and Information Disclosure as well as Remote Code

Execution.
Dr.G.NIRMALA

Typically, Local File Inclusion (LFI) occurs, when an application gets the path to the file that has

to be included as an input without treating it as untrusted input. This would allow a local file to

be supplied to the include statement.

Local File Inclusion is very much like ​Remote File Inclusion (RFI)​, with the difference that with

Local File Inclusion, an attacker can only include local files (not remote files like in the case of

RFI).

REMOTE FILE INCLUSION:

Remote File inclusion (RFI) refers to an inclusion attack wherein an attacker can cause the web

application to include a remote file by exploiting a web application that dynamically includes

external files or scripts. The consequences of a successful RFI attack include Information

Disclosure and ​Cross-site Scripting (XSS)​ to ​Remote Code Execution​.

Remote File Inclusion (RFI) usually occurs, when an application receives the path to the file that

has to be included as an input without properly sanitizing it. This would allow an external URL

to be supplied to the include statement.

WEB SERVER ISSUES:

5 Common Server Problems That Can Affect Your Website

One of the most effective ways to prevent common server problems is to entrust the running of

your web services to a respected managed host. When trouble strikes and a server goes down, a

managed hosting provider knows just how to get things back on track. Often, they can head off

the problem before it takes effect – leaving your web service users none the wiser
Dr.G.NIRMALA

1. Slow Page Loads:

Over half of visitors say they will abandon a web page ​loading ​if its time exceeds three seconds​.

This may seem excessive, but with faster web speeds and better access, consumers are more

demanding than ever before. Lots of things can contribute to slow page loading, including image

rendering, complicated forms, videos that autoplay and site usage at the time of visiting.

Sometimes it may just be that ​the client’s web browser​ is to blame! However, the problem often

lies with the website being accessed. If your web service is running slowly, you could start to see

a real loss in revenue and your business could suffer.

2. Cyber Attacks and Viruses:

Security is a concern for every business; you need to keep yourself, your company, your

employees and your clients safe at all times. Online services can carry some risk, especially

when dealing with personal details or payment information. ​Netcraft’s recent web server

survey​ highlighted that cyber attacks on data centers are still common – these ​varied attacks​aim

to disrupt a service, or to steal and abuse personal information​.

3. High Traffic Problems:

The primary goal of almost every website, online profile, and all associated web services is to

generate leads. An increase in traffic is therefore usually a positive thing, signaling that one of

your marketing campaigns is working well and that your brand is being well received. However,

when high traffic to a website is sudden and unexpected, this can cause issues with functionality.
Dr.G.NIRMALA

Too much traffic can cause pages to load slowly, features on the site to stop working, and, in

some cases, the whole web service can crash.

4. Hardware and Software Failures:

A study by Storage craft​ found that 99% of surveyed respondents had experienced a hardware

failure, and 71% of IT professionals have worked with clients who went through data loss or

disaster. At some point, every business is likely to experience problems with their hardware.

Having a team you can rely on means that when disaster does strike or when an issue starts to

look likely, a fix can be applied and downtime can be avoided.

5. Site Outages and Downtime:

The biggest problem that can affect a server is a total crash. A physical problem such as a fire or

flood might cause you to completely lose your server. A cyber attack may cause your server to

shut down completely. Hardware and software failures can also lead to a full shutdown. Or, even

worse than suffering through slow server performance, your web service could become entirely

unavailable – and without a proper backup, you could be out of action for quite some time.