New answers tagged

8

Is the injection in a NoSQL database architecture also called SQL injection... No, it is not called "SQL injection" but this is called a "NoSQL injection", you can read more about in an article titled "Testing for NoSQL injection", written by OWASP. ... and is it still part of the OWASP 2013 Top 10, category A1 Injection? Yes, this is a type of ...


15

Those are called NoSQL Injections instead of SQL injections. You can find more information about NoSQL injections, in the OWASP Testing Guide.


0

There are hundreds of web-apps based vulnerabilities and can be categorized into these: Input Validation (XSS, SQL Injection) Authentication (weak password, user enumeration) Authorization (privilege escalation, insecure direction object reference) Session Management (session fixation, absent logout button) Disclosure of Information (Detailed error ...


1

This is highly opinionated and controversial, but I wanted to provide food-for-thought for you to make your own decision. There's OWASP, CWE, and WASC. I don't like any of them. Why shouldn't I use any of these categorization methods? OWASP Top 10 attempts to provide a most common list at a high-level view of what has happened in the last two years. But ...


0

It sounds like you are worried about your web server code trusting a third party library that generates content within your HTTP response. This is a very valid concern. If all that it generates is CSRF tokens, i.e. some strings, it makes sense to add XSS protection (whitelisting chars, escaping special characters ...). This should eliminate most of the ...



Top 50 recent answers are included