1

I have a Attack and Defence security project for school and I dont know how to protect it since all classic ways are forbidden by rules ,so

Assume the following project :

A web application with the following functionality:

  1. account registration.

  2. Database connection where all information is stored.

  3. Presentation of this information according to input from user.

  4. The web app will be pentested on LAN level

Rules:

  1. No firewalls allowed.

  2. No fail2ban like applications.

  3. No WAF.

  4. No xss library can be used.

  5. No mitm to inject javascript to add defence layers. (The project will be pentested from within the network.)

  6. No https

Any help is appreciated.

7

I‘m not sure, why you think you might need any of those things that are forbidden.

What you need is protection against the OWASP Top10, especially

  • input validation,
  • prepared statements to counter SQLi,
  • output encoding,
  • CSRF-Token,
  • proper header settings.

All of those things can be learned from the owasp project.

  • 2
    OWASP Top Ten - if you go through each of those in turn and guard for them, you will be most of the way there. If they truly have access to the network between the web server and the database, you'll be in trouble - look at encrypting THAT connection (since it isn't banned) and you want to protect the db password, but don't worry about it if it is on the same machine. Just keep it simple - watch injection, xss, csrf - you don't need libraries for those, just good practices. – crovers Oct 4 '17 at 18:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.