disc 猫头鹰

安全风险和漏洞(Security Risks & Vulnerabilities)

什么是OWASP？(What is OWASP?)

OWASP stands for the Open Web Application Security Project, an online community that produces articles, methodologies, documentation, tools, and technologies in the field of web application security.

OWASP代表Open Web Application Security Project，这是一个在线社区，在Web应用程序安全领域中提供文章，方法论，文档，工具和技术。

OWASP前十名是什么？ (What is the OWASP Top 10?)

OWASP Top 10 is the list of the 10 most common application vulnerabilities. It also shows their risks, impacts, and countermeasures. Updated every three to four years, the latest OWASP vulnerabilities list was released in 2018.

OWASP Top 10是10个最常见的应用程序漏洞的列表。 它还显示了它们的风险，影响和对策。 每三到四年更新一次，最新的OWASP漏洞列表于2018年发布。

2020年十大OWASP漏洞 (The Top 10 OWASP vulnerabilities in 2020)

注射(Injection)

Injection flaws allow attackers to relay malicious code through an application to another system. These attacks include calls to the operating system via system calls, the use of external programs via shell commands, as well as calls to backend databases via SQL (i.e., SQL injection). Whole scripts written in Perl, Python, and other languages can be injected into poorly designed applications and executed. Any time an application uses an interpreter of any type there is a danger of introducing an injection vulnerability.

注入漏洞使攻击者可以通过应用程序将恶意代码中继到另一个系统。 这些攻击包括通过系统调用对操作系统的调用，通过shell命令对外部程序的使用以及通过SQL对后端数据库的调用(即SQL注入)。 可以将用Perl，Python和其他语言编写的整个脚本注入设计欠佳的应用程序中并执行。 每当应用程序使用任何类型的解释器时，都有引入注入漏洞的危险。

认证失败 (Broken Authentication)

Broken authentication is an umbrella term for several vulnerabilities that attackers exploit to impersonate legitimate users online. Broadly, broken authentication refers to weaknesses in two areas: session management and credential management. Both are classified as broken authentication because attackers can use either avenue to masquerade as a user: hijacked session IDs or stolen login credentials.

身份验证失败是攻击者用来在线冒充合法用户的多个漏洞的总称。 广义上讲，损坏的身份验证指的是两个方面的弱点：会话管理和凭据管理。 由于攻击者可以使用任何一种方式伪装成用户身份：被劫持的会话ID或被盗的登录凭据，两者均被视为破坏身份验证。

Attackers employ a wide variety of strategies to take advantage of these weaknesses, ranging from huge credential stuffing attacks to highly targeted schemes aimed at gaining access to a specific person’s credentials.

攻击者采用了多种策略来利用这些弱点，从巨大的凭据填充攻击到旨在针对特定人员的凭据进行访问的高度针对性的方案。

敏感数据暴露 (Sensitive Data Exposure)

Sensitive data exposure occurs when an application, company, or other entity inadvertently exposes personal data. Sensitive data exposure differs from a data breach, in which an attacker accesses and steals information.

当应用程序，公司或其他实体无意间公开个人数据时，就会发生敏感数据公开。 敏感的数据公开与数据泄露不同，在数据泄露中，攻击者访问和窃取信息。

Sensitive data exposure occurs as a result of not adequately protecting a database where information is stored. This might be a result of a multitude of things such as weak encryption, no encryption, software flaws, or when someone mistakenly uploads data to an incorrect database.

由于未充分保护存储信息的数据库而导致敏感数据暴露。 这可能是由于多种原因导致的，例如弱加密，无加密，软件漏洞或有人错误地将数据上传到错误的数据库。

Different types of data can be exposed in a sensitive data exposure. Banking account numbers, credit card numbers, healthcare data, session tokens, Social Security number, home address, phone numbers, dates of birth, and user account information such as usernames and passwords are some of the types of information that can be left exposed.

可以在敏感数据公开中公开不同类型的数据。 银行帐号，信用卡号，医疗保健数据，会话令牌，社会保险号，家庭住址，电话号码，出生日期以及用户帐户信息(例如用户名和密码)是一些可以公开的信息类型。

XML外部实体(XXE) (XML External Entities (XXE))

XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application’s processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

XML外部实体注入(也称为XXE)是一个Web安全漏洞，它使攻击者能够干扰应用程序对XML数据的处理。 它通常使攻击者可以查看应用程序服务器文件系统上的文件，并与应用程序本身可以访问的任何后端或外部系统进行交互。

In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks.

在某些情况下，攻击者可以利用XXE漏洞执行服务器端请求伪造(SSRF)攻击，从而升级XXE攻击以破坏底层服务器或其他后端基础结构。

存取控制中断 (Broken Access control)

Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside of the limits of the user. Common access control vulnerabilities include:

访问控制强制执行策略，以使用户不能在其预期的权限之外采取行动。 故障通常会导致未经授权的信息泄露，所有数据的修改或破坏或执行超出用户能力范围的业务功能。 常见的访问控制漏洞包括：

Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or simply using a custom API attack tool

通过修改URL，内部应用程序状态或HTML页面或仅使用自定义API攻击工具来绕过访问控制检查 Allowing the primary key to be changed to another’s users record, permitting viewing or editing someone else’s account.

允许将主键更改为另一个用户的记录，从而允许查看或编辑其他人的帐户。Elevation of privilege. Acting as a user without being logged in, or acting as an admin when logged in as a user.

特权提升。 无需登录即可充当用户，或者以用户身份登录时可以充当管理员。 Metadata manipulation, such as replaying or tampering with a JSON Web Token (JWT) access control token or a cookie or hidden field manipulated to elevate privileges, or abusing JWT invalidation

元数据操作，例如重放或篡改JSON Web令牌(JWT)访问控制令牌或Cookie或隐藏字段，以提高特权，或滥用JWT无效 CORS misconfiguration allows unauthorized API access.

CORS配置错误允许未经授权的API访问。Force browsing to authenticated pages as an unauthenticated user or to privileged pages as a standard user. Accessing API with missing access controls for POST, PUT and DELETE.

强制以未经身份验证的用户身份浏览经过身份验证的页面，或以标准用户身份强制浏览特权页面。 在缺少POST，PUT和DELETE访问控制的情况下访问API。

安全配置错误 (Security misconfigurations)

Security misconfigurations are security settings inappropriately configured or left insecure that put your systems and data at risk. Basically, any poorly documented configuration changes, default settings, or a technical issue across any component in your endpoints could lead to a misconfiguration.

安全配置错误是指安全设置配置不当或保持不安全状态，使您的系统和数据面临风险。 基本上，任何记录不当的配置更改，默认设置或端点中任何组件的技术问题都可能导致配置错误。

isconfigurations can occur due to a myriad of reasons. Modern network infrastructures are highly complex; organizations often overlook crucial security settings, including new network equipment that might retain default configurations. A developer might write flexible firewall rules, and create network shares for his convenience while building software and leave them unchanged. Sometimes, administrators allow configuration changes for testing or troubleshooting purposes, and forget to revert to the original state resulting in a misconfiguration. Some common security misconfiguration vulnerabilities are logon security, user account management, password policy, browser hardening, and legacy protocols.

由于多种原因，会发生isconfiguration。 现代网络基础设施非常复杂。 企业经常忽略关键的安全设置，包括可能保留默认配置的新网络设备。 开发人员可以编写灵活的防火墙规则，并在创建软件时为方便起见创建网络共享，并使它们保持不变。 有时，管理员出于测试或故障排除的目的而允许更改配置，而忘记恢复到原始状态，从而导致配置错误。 一些常见的安全性错误配置漏洞是登录安全性，用户帐户管理，密码策略，浏览器强化和旧版协议。

跨站点脚本(XSS) (Cross Site Scripting (XSS))

Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application. The actual attack occurs when the victim visits the web page or web application that executes the malicious code. The web page or web application becomes a vehicle to deliver the malicious script to the user’s browser. Vulnerable vehicles that are commonly used for Cross-site Scripting attacks are forums, message boards, and web pages that allow comments.

跨站点脚本(XSS)是一种客户端代码注入攻击。 攻击者旨在通过在合法网页或Web应用程序中包含恶意代码，在受害者的Web浏览器中执行恶意脚本。 当受害者访问执行恶意代码的网页或Web应用程序时，就会发生实际的攻击。 网页或Web应用程序成为将恶意脚本传递到用户浏览器的工具。 经常用于跨站点脚本攻击的脆弱工具是论坛，留言板和允许评论的网页。

A web page or web application is vulnerable to XSS if it uses unsanitized user input in the output that it generates. This user input must then be parsed by the victim’s browser. XSS attacks are possible in VBScript, ActiveX, Flash, and even CSS. However, they are most common in JavaScript, primarily because JavaScript is fundamental to most browsing experiences.

如果网页或Web应用程序在生成的输出中使用未经过滤的用户输入，则容易受到XSS的攻击。 然后必须由受害者的浏览器解析此用户输入。 在VBScript，ActiveX，Flash甚至CSS中都可能发生XSS攻击。 但是，它们在JavaScript中最常见，主要是因为JavaScript是大多数浏览体验的基础。

不安全的反序列化 (Insecure Deserialization)

Deserialization is the process of restoring this byte stream to a fully functional replica of the original object, in the exact state as when it was serialized. The website’s logic can then interact with this deserialized object, just like it would with any other object.

反序列化是将字节流还原为原始对象的完整功能副本的过程，其状态与序列化时的状态完全相同。 然后，网站的逻辑可以与此反序列化的对象进行交互，就像与任何其他对象进行交互一样。

Serialization is the process of converting complex data structures, such as objects and their fields, into a “flatter” format that can be sent and received as a sequential stream of bytes. Serializing data makes it much simpler to:

序列化是将复杂的数据结构(例如对象及其字段)转换为“更扁平”格式的过程，该格式可以作为顺序的字节流发送和接收。 序列化数据使其更容易：

Write complex data to inter-process memory, a file, or a database

将复杂数据写入进程间内存，文件或数据库 Send complex data, for example, over a network, between different components of an application, or in an API call

例如，通过网络，在应用程序的不同组件之间或在API调用中发送复杂的数据

Crucially, when serializing an object, its state is also persisted. In other words, the object’s attributes are preserved, along with their assigned values.

至关重要的是，在序列化对象时，其状态也将保留。 换句话说，将保留对象的属性及其分配的值。

使用具有已知漏洞的组件 (Using Components with known vulnerabilities)

Known vulnerabilities are vulnerabilities that were discovered in open source components and published in the NVD, security advisories or issue trackers. From the moment of publication , a vulnerability can be exploited by hackers who find the documentation. According to OWASP, the problem of using components with known vulnerabilities is highly prevalent. Moreover, use of open source components is so widespread that many development leaders don’t even know what they have. The possible impact of open source vulnerabilities ranges from minor to some of the largest breaches known.

已知漏洞是在开源组件中发现并在NVD，安全公告或问题跟踪程序中发布的漏洞。 从发布之日起，发现文档的黑客便可以利用该漏洞。 根据OWASP，使用具有已知漏洞的组件的问题非常普遍。 而且，开源组件的使用是如此广泛，以至于许多开发领导者甚至都不知道他们拥有什么。 开源漏洞的可能影响范围从轻微到已知的一些最大漏洞。

日志记录和监控不足 (Insufficient logging and monitoring)

When an organization has insufficient logging, detection, monitoring, and response, attackers rely on these weaknesses to achieve their goals without being detected. This lack of best practices includes things such as:

当组织的日志记录，检测，监视和响应不足时，攻击者将依靠这些弱点来实现其目标而不会被发现。 缺乏最佳实践包括：

Auditable events, such as logins, failed logins, and high-value transactions that are not logged.

可审核事件，例如登录，登录失败和未记录的高价值交易。 Warnings and errors that generate no, inadequate, or unclear log messages.

不会生成，不足或不清楚的日志消息的警告和错误。 Logs of applications and APIs that are not monitored for suspicious activity.

未监视可疑活动的应用程序和API的日志。 Logs that are only stored locally.

仅本地存储的日志。 Appropriate alerting thresholds and response escalation processes not in place or effective.

适当的警报阈值和响应升级过程不到位或没有有效。 Penetration testing and scans by DAST tools that don’t trigger alerts.

DAST工具进行的渗透测试和扫描不会触发警报。 Applications that are unable to detect, escalate, or alert for active attacks in real time or near real time.

无法实时或近实时地检测，升级或警告活动攻击的应用程序。

Hope you found this helpful. Do share with the people around you.

希望对您有所帮助。 与周围的人分享。

翻译自: https://medium.com/@enosjeba/owasp-2020-ee052aa509d1

disc 猫头鹰

相关资源：jdk-8u281-windows-x64.exe