AdvancedTopic 87 of 104Software & Computing
Common vulnerabilities
SQL injection, XSS and buffer overflows exploit unsafe code.
In depth
OWASP Top 10: injection (SQL, command), broken authentication, XSS, CSRF, insecure deserialisation, misconfiguration, vulnerable components, SSRF and others. Buffer overflows in C allow code execution. Mitigate with input validation, output encoding, parameterised queries, updates and memory-safe languages.
Key points
- Threat modelling
- Fuzzing
- CVE databases
ExampleA search box that concatenates user input into SQL allows injection.
What is Common vulnerabilities?
SQL injection, XSS and buffer overflows exploit unsafe code.
Why is it important to understand common vulnerabilities?
Common vulnerabilities show the most frequent ways attackers break software, so knowing them helps you prevent them in your own code.
What is SQL injection?
An attack where input is treated as part of a database command, which lets an attacker read or change data, prevented by parameterised queries.
What is cross-site scripting?
Injecting script into pages seen by other users, which is prevented by escaping output and using content security policies.
How is Common vulnerabilities used in practice?
Typical applications include preventing SQL injection by using parameterised queries in a web form, escaping user input to stop cross-site scripting in a comment field and checking array bounds to avoid buffer overflows in a C program.
What should I learn before Common vulnerabilities?
Study "Authentication and authorisation" first (topic 86 of 104 in Software & Computing). It covers the groundwork this topic builds on.
What are the key points of Common vulnerabilities?
Threat modelling. Fuzzing. CVE databases.
Can you give an example of Common vulnerabilities?
A search box that concatenates user input into SQL allows injection.
What comes after Common vulnerabilities?
The next topic is "Secure software development", which builds directly on this one.
How difficult is Common vulnerabilities?
It is classed as Advanced in Software & Computing (topic 87 of 104). It is an advanced topic. It assumes you are comfortable with the intermediate topics in Software & Computing.