Yesterday's meeting covered the basics of website-based attacks, and highlighted four common methods of targeting systems, data, and users through server, browser, and API exploits. Members were then given a set of challenges to practice these techniques on.

IDOR - Insecure Direct Object Reference

The first technique is IDOR, Insecure Direct Object Reference, which is an access control vulnerability where a website or web application may inadvertently publicize some reference data which can be intercepted and modified by the attacker. For example, if a website URL contains the query ?user=1, this can easily be edited by the user to ?user=2, potentially revealing other users' information.

XXE - XML External Entity Injection

XXE refers to an exploit of applications which process XML input. Such an application may be abused to read and reveal sensitive files or execute malicious code server-side.

XSS - Cross-Site Scripting

XSS results when JavaScript code fails to properly sanitize malicious code, allowing attackers to potentially access the user's sensitive data. This can allow attackers to steal session data, keylog users' inputs, or redirect the user to other webpages.

SQL Injection

SQL Injection results from improperly parsed user input in the context of database interaction. If an application were to utilize user input to generate a database query without sanitizing it properly first, the attacker may be able to inject logical statements or comment out sections of the query, allowing them to access sections of the database they shouldn't have access to.