ASP Security by Soroush Dalili - Intelligent Exploit
ASP Security by Soroush Dalili - Intelligent Exploit
ASP Security by Soroush Dalili - Intelligent Exploit
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
يكي از گروه هايي كه به طور مداوم در امر امنيت وب فعاليت مي كند و فهرست آسيب پذيري ها وحملاتش از سايرين جامعتر و كاملتر است، اجتماع OW<strong>ASP</strong> 1مي باشد. اين جامعيت به گونه ايستكه مدارك و اطلاعات اين اجتماع، به عنوان مرجع امنيت وب در بسياري از پروژه هاي ديگر امنيتياستفاده مي شود. OW<strong>ASP</strong> طبق جدول زير مهمترين آسيب پذيري هاي سال 2007اعلام كرده است:را به اين شرحOW<strong>ASP</strong> Top 10 2007 جدول OW<strong>ASP</strong> Top 10 2004 MITRE 2006Raw RankingA1 ‐ Cross Site Scripting (XSS) A4 ‐ Cross Site Scripting (XSS) 1A2 ‐ Injection Flaws A6 ‐ Injection Flaws 2A3 ‐ Malicious File Execution3(NEW)A4 ‐ Insecure Direct Object A2 ‐ Broken Access Control (split5Referencein 2007 T10)A5 ‐ Cross Site Request Forgery36(CSRF) (NEW)A6 ‐ Information Leakage and A7 ‐ Improper Error Handling 6Improper Error HandlingA7 ‐ Broken Authentication and A3 ‐ Broken Authentication and14Session ManagementSession ManagementA8 ‐ Insecure CryptographicA8 ‐ Insecure Storage 8StorageA9 ‐ Insecure Communications Discussed under A10 ‐ Insecure8(NEW) Configuration ManagementA10 ‐ Failure to Restrict URL A2 ‐ Broken Access Control (split14Accessin 2007 T10) A1 ‐ Unvalidated Input 7 A5 ‐ Buffer Overflows 4, 8, and 10 A9 ‐ Denial of Service 17 A10 ‐ Insecure ConfigurationManagement29OW<strong>ASP</strong>220071-2 10آسيب پذيري مهم سالبا توجه به سايت1 Open Web Application <strong>Security</strong> Project (http://www.owasp.org)2 http://www.owasp.org/index.php/Top_10_2007-Methodology35
Change language