SlideShare uma empresa Scribd logo
1 de 22
Securitatea aplicatiilor online
Vulnerabilitati
Solutii folosite ,[object Object],[object Object],[object Object]
Codul scris ,[object Object],[object Object],[object Object],[object Object],[object Object]
Network ,[object Object]
SQL Injection ,[object Object],http://www.example.com/view.php?id_cat=4 "SELECT * FROM data WHERE id_category = " +  $_GET[‘id’]  + ";"  http://www.example.com/view.php?id_cat=4 OR 1=1 "SELECT * FROM data WHERE id = 1 OR 1=1;"  OR 1=1
why ? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Protectie ,[object Object],[object Object],[object Object],[object Object]
Demonstratie
XSS ,[object Object],[object Object],[object Object],[object Object],[object Object]
Non-persistent http://www.example.com?search.php?s= <script>alert(document.cookie)</script>
Rezultatul :
persistent
CSRF/XSRF ,[object Object],[object Object],<img src=“http://www.other-example.com?deleteuser.php?u=vasile” />
Email injection
Codul din spate Nu verificam input-ul String-ul trimis la serverul de mail :
Directory traversal HTTP requests
 
MITM attack
[object Object]
Demonstratie
Concluzii ,[object Object],[object Object],[object Object],[object Object],[object Object]

Mais conteúdo relacionado

Semelhante a Prezentarea "Securitatea Aplicatiilor Online" de la ODO

OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesMarco Morana
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure codingHaitham Raik
 
Protecting Your Web Site From SQL Injection & XSS
Protecting Your Web SiteFrom SQL Injection & XSSProtecting Your Web SiteFrom SQL Injection & XSS
Protecting Your Web Site From SQL Injection & XSSskyhawk133
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application SecurityJason Leveille
 
Secure software development presentation
Secure software development presentationSecure software development presentation
Secure software development presentationMahdi Dolati
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And AnishOSSCube
 
Pci compliance writing secure code
Pci compliance   writing secure codePci compliance   writing secure code
Pci compliance writing secure codeMiva
 
Sql injection
Sql injection Sql injection
Sql injection Aaron Hill
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Code injection and green sql
Code injection and green sqlCode injection and green sql
Code injection and green sqlKaustav Sengupta
 
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10Sastry Tumuluri
 
Java EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank KimJava EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank Kimjaxconf
 
Protecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksProtecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksKevin Alcock
 

Semelhante a Prezentarea "Securitatea Aplicatiilor Online" de la ODO (20)

ASP.NET Web Security
ASP.NET Web SecurityASP.NET Web Security
ASP.NET Web Security
 
OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root Causes
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure coding
 
Protecting Your Web Site From SQL Injection & XSS
Protecting Your Web SiteFrom SQL Injection & XSSProtecting Your Web SiteFrom SQL Injection & XSS
Protecting Your Web Site From SQL Injection & XSS
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Secure software development presentation
Secure software development presentationSecure software development presentation
Secure software development presentation
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And Anish
 
Pci compliance writing secure code
Pci compliance   writing secure codePci compliance   writing secure code
Pci compliance writing secure code
 
Sql injection
Sql injection Sql injection
Sql injection
 
Owasp & Asp.Net
Owasp & Asp.NetOwasp & Asp.Net
Owasp & Asp.Net
 
Security 101
Security 101Security 101
Security 101
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
Greensql2007
Greensql2007Greensql2007
Greensql2007
 
Code injection and green sql
Code injection and green sqlCode injection and green sql
Code injection and green sql
 
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
 
ieee
ieeeieee
ieee
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10
 
Java EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank KimJava EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank Kim
 
Protecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksProtecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacks
 

Mais de Gabriel Curcudel

Cum să crești vânzările online
Cum să crești vânzările online Cum să crești vânzările online
Cum să crești vânzările online Gabriel Curcudel
 
Competitive link analysis si link management
Competitive link analysis si link managementCompetitive link analysis si link management
Competitive link analysis si link managementGabriel Curcudel
 
Local search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysLocal search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysGabriel Curcudel
 
Analiza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleAnaliza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleGabriel Curcudel
 
Long tail - Krumel - IMTO Seo & Sem
Long tail -  Krumel - IMTO Seo & SemLong tail -  Krumel - IMTO Seo & Sem
Long tail - Krumel - IMTO Seo & SemGabriel Curcudel
 
SEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineSEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineGabriel Curcudel
 
Working for the client's clients
Working for the client's clientsWorking for the client's clients
Working for the client's clientsGabriel Curcudel
 
Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Gabriel Curcudel
 
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebTraficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebGabriel Curcudel
 
Google Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGoogle Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGabriel Curcudel
 
Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Gabriel Curcudel
 
Cum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareCum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareGabriel Curcudel
 
Webdeveloper Ciprian Berescu
Webdeveloper  Ciprian BerescuWebdeveloper  Ciprian Berescu
Webdeveloper Ciprian BerescuGabriel Curcudel
 
Mituri Despre Antreprenoriat
Mituri Despre AntreprenoriatMituri Despre Antreprenoriat
Mituri Despre AntreprenoriatGabriel Curcudel
 
Online Commercial Intention
Online Commercial IntentionOnline Commercial Intention
Online Commercial IntentionGabriel Curcudel
 

Mais de Gabriel Curcudel (20)

Cum să crești vânzările online
Cum să crești vânzările online Cum să crești vânzările online
Cum să crești vânzările online
 
Local search 2013 Romania
Local search 2013 RomaniaLocal search 2013 Romania
Local search 2013 Romania
 
Competitive link analysis si link management
Competitive link analysis si link managementCompetitive link analysis si link management
Competitive link analysis si link management
 
Local search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysLocal search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM Days
 
Link building Tecomm Cluj
Link building  Tecomm ClujLink building  Tecomm Cluj
Link building Tecomm Cluj
 
Analiza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleAnaliza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2parale
 
Long tail - Krumel - IMTO Seo & Sem
Long tail -  Krumel - IMTO Seo & SemLong tail -  Krumel - IMTO Seo & Sem
Long tail - Krumel - IMTO Seo & Sem
 
Lumea Seo Sem Ppc
Lumea Seo Sem PpcLumea Seo Sem Ppc
Lumea Seo Sem Ppc
 
SEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineSEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri oline
 
Prezentare IMTO - Krumel
Prezentare IMTO - KrumelPrezentare IMTO - Krumel
Prezentare IMTO - Krumel
 
Working for the client's clients
Working for the client's clientsWorking for the client's clients
Working for the client's clients
 
Seo Vs Copywriting
Seo Vs CopywritingSeo Vs Copywriting
Seo Vs Copywriting
 
Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009
 
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebTraficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
 
Google Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGoogle Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi Adwords
 
Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?
 
Cum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareCum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De Cautare
 
Webdeveloper Ciprian Berescu
Webdeveloper  Ciprian BerescuWebdeveloper  Ciprian Berescu
Webdeveloper Ciprian Berescu
 
Mituri Despre Antreprenoriat
Mituri Despre AntreprenoriatMituri Despre Antreprenoriat
Mituri Despre Antreprenoriat
 
Online Commercial Intention
Online Commercial IntentionOnline Commercial Intention
Online Commercial Intention
 

Último

Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...Fwdays
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piececharlottematthew16
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DaySri Ambati
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubKalema Edgar
 

Último (20)

Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks..."LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
"LLMs for Python Engineers: Advanced Data Analysis and Semantic Kernel",Oleks...
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Story boards and shot lists for my a level piece
Story boards and shot lists for my a level pieceStory boards and shot lists for my a level piece
Story boards and shot lists for my a level piece
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo DayH2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
H2O.ai CEO/Founder: Sri Ambati Keynote at Wells Fargo Day
 
DSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine TuningDSPy a system for AI to Write Prompts and Do Fine Tuning
DSPy a system for AI to Write Prompts and Do Fine Tuning
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 
Unleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding ClubUnleash Your Potential - Namagunga Girls Coding Club
Unleash Your Potential - Namagunga Girls Coding Club
 

Prezentarea "Securitatea Aplicatiilor Online" de la ODO