Chetan Jindal

Cross-Site Scripting (XSS) Cross Site Scripting (XSS) enables attackers to inject malicious script into web pages by targeting vulnerability in security of web applications. There are two types of Cross Site Scripting: Stored (Persistent) XSS : Malicious script is injected by the attacker at the trusted site’s server. It could be present in the database, message forum or comment field. Every time users requests for this information they also retrieves the malicious script. This type of attack does not require targeting victims individually and continue to attack victims when they request data associated with malicious script , hence, called persistent XSS. Reflected (Non - Persistent) XSS : Victims are targeted individually and no script is injected at the trusted site’s server. This attack is delivered to victims through email or from some other website. The bait could be a URL pointing towards a trusted site, clicking which will execute the malicious script. The ...

     This article is about how different groups of scientists and researchers discovered methods and techniques to analyze web and prevent web from the sql injection attacks. Different tools and tactics used by them are also mentioned in this article. ·          Salas et.al. use WSInject as a tool to analyse web services. A general purpose fault injection tool that unlike other security testing tools can make various scenarios of different types of attacks. Thus they were able to compare it with results of a vulnerability scanner soapUI. They also concluded that soapUI was less efficient as compared to WSInject. XSS attack was performed with WSInject tool and then they created different attack scenarios and emulated attacks with this tool. The analysis was documented and verified using WSInject technology . A number of vulnerabilities were reduced by the security and made it possible to build a number of variations to new ty...

Cross Site Request Forgery (CSRF) Definition: Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user's Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated. For example, this attack could result in a transfer of funds, changing a password, or purchasing an item in the user's context. Session Id: Long string, randomly generated to identify a logged in user. Session ids are locked with the IP address of system for which it was generated (same session id cannot be used on 2 different systems; this is a simple way through which Session Ids make connections secure). Typically short lived and expires as soon as user logs out or shuts the system down. Token Id: Cryptographically secured large random string, generated once for each session. After initial generation of this token, the value is stored in the session and i...