SystemsCyber Security
Web Security Cheat Sheet
Web Security Cheat Sheet
Core Concepts
- OWASP Top 10: A standard awareness document for developers and web application security representing a broad consensus about the most critical security risks to web applications.
- SQL Injection (SQLi): Occurs when malicious SQL statements are inserted into entry fields for execution. Can lead to data leakage, modification, or destruction. Mitigation includes parameterized queries and input validation.
- Cross-Site Scripting (XSS): An attacker injects malicious executable scripts into the code of a trusted application or website. Often used to steal session cookies or tokens.
- Stored XSS: Payload is permanently stored on the target server.
- Reflected XSS: Payload is immediately returned by a web application in an error message or search result.
- DOM-based XSS: Payload is executed as a result of modifying the DOM environment in the victim's browser.
- Cross-Site Request Forgery (CSRF): Forces an end user to execute unwanted actions on a web application in which they are currently authenticated. Mitigation includes Anti-CSRF tokens and SameSite cookie attributes.