Cybersecurity — Web Security

OWASP Top 10

1. Injection
2. Broken Authentication
3. Sensitive Data Exposure
4. XML External Entities
5. Broken Access Control
6. Security Misconfiguration
7. Cross-Site Scripting
8. Insecure Deserialization
9. Using Components with Known Vulnerabilities
10. Insufficient Logging

Security headers

# Flask example
@app.after_request
def security_headers(response):
    response.headers['X-Content-Type-Options'] = 'nosniff'
    response.headers['X-Frame-Options'] = 'DENY'
    response.headers['X-XSS-Protection'] = '1; mode=block'
    response.headers['Content-Security-Policy'] = "default-src 'self'"
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains'
    return response

Input validation

import re

def validate_email(email):
    pattern = r'^[\w\.-]+@[\w\.-]+\.\w+$'
    return bool(re.match(pattern, email))

def sanitize_input(input):
    # Remove dangerous characters
    return re.sub(r'[<>"\';]', '', input)

Secure coding practices

1. Validate all inputs
2. Use parameterized queries
3. Encode output
4. Implement CSRF protection
5. Use secure session management

Tools

• Burp Suite: Web testing
• OWASP ZAP: Security scanning
• Nikto: Vulnerability scanner
• SQLMap: SQL injection

Mini Practice

1. Set up security headers
2. Implement input validation
3. Test with Burp Suite
4. Scan with OWASP ZAP

Up Next

Continue with SQL Injection - Database attacks.