SlideShare una empresa de Scribd logo
1 de 22
Securitatea aplicatiilor online
Vulnerabilitati
Solutii folosite ,[object Object],[object Object],[object Object]
Codul scris ,[object Object],[object Object],[object Object],[object Object],[object Object]
Network ,[object Object]
SQL Injection ,[object Object],http://www.example.com/view.php?id_cat=4 "SELECT * FROM data WHERE id_category = " +  $_GET[‘id’]  + ";"  http://www.example.com/view.php?id_cat=4 OR 1=1 "SELECT * FROM data WHERE id = 1 OR 1=1;"  OR 1=1
why ? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Protectie ,[object Object],[object Object],[object Object],[object Object]
Demonstratie
XSS ,[object Object],[object Object],[object Object],[object Object],[object Object]
Non-persistent http://www.example.com?search.php?s= <script>alert(document.cookie)</script>
Rezultatul :
persistent
CSRF/XSRF ,[object Object],[object Object],<img src=“http://www.other-example.com?deleteuser.php?u=vasile” />
Email injection
Codul din spate Nu verificam input-ul String-ul trimis la serverul de mail :
Directory traversal HTTP requests
 
MITM attack
[object Object]
Demonstratie
Concluzii ,[object Object],[object Object],[object Object],[object Object],[object Object]

Más contenido relacionado

Similar a Prezentarea "Securitatea Aplicatiilor Online" de la ODO

OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesMarco Morana
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure codingHaitham Raik
 
Protecting Your Web Site From SQL Injection & XSS
Protecting Your Web SiteFrom SQL Injection & XSSProtecting Your Web SiteFrom SQL Injection & XSS
Protecting Your Web Site From SQL Injection & XSSskyhawk133
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application SecurityJason Leveille
 
Secure software development presentation
Secure software development presentationSecure software development presentation
Secure software development presentationMahdi Dolati
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And AnishOSSCube
 
Pci compliance writing secure code
Pci compliance   writing secure codePci compliance   writing secure code
Pci compliance writing secure codeMiva
 
Sql injection
Sql injection Sql injection
Sql injection Aaron Hill
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defenseamiable_indian
 
Code injection and green sql
Code injection and green sqlCode injection and green sql
Code injection and green sqlKaustav Sengupta
 
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10Sastry Tumuluri
 
Java EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank KimJava EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank Kimjaxconf
 
Protecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksProtecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksKevin Alcock
 

Similar a Prezentarea "Securitatea Aplicatiilor Online" de la ODO (20)

ASP.NET Web Security
ASP.NET Web SecurityASP.NET Web Security
ASP.NET Web Security
 
OWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root CausesOWASP Top 10 And Insecure Software Root Causes
OWASP Top 10 And Insecure Software Root Causes
 
PCI Security Requirements - secure coding
PCI Security Requirements - secure codingPCI Security Requirements - secure coding
PCI Security Requirements - secure coding
 
Protecting Your Web Site From SQL Injection & XSS
Protecting Your Web SiteFrom SQL Injection & XSSProtecting Your Web SiteFrom SQL Injection & XSS
Protecting Your Web Site From SQL Injection & XSS
 
Web Application Security
Web Application SecurityWeb Application Security
Web Application Security
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Secure software development presentation
Secure software development presentationSecure software development presentation
Secure software development presentation
 
Php Security By Mugdha And Anish
Php Security By Mugdha And AnishPhp Security By Mugdha And Anish
Php Security By Mugdha And Anish
 
Pci compliance writing secure code
Pci compliance   writing secure codePci compliance   writing secure code
Pci compliance writing secure code
 
Sql injection
Sql injection Sql injection
Sql injection
 
Owasp & Asp.Net
Owasp & Asp.NetOwasp & Asp.Net
Owasp & Asp.Net
 
Security 101
Security 101Security 101
Security 101
 
Writing Secure Code – Threat Defense
Writing Secure Code – Threat DefenseWriting Secure Code – Threat Defense
Writing Secure Code – Threat Defense
 
Greensql2007
Greensql2007Greensql2007
Greensql2007
 
Code injection and green sql
Code injection and green sqlCode injection and green sql
Code injection and green sql
 
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программированияSECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
SECON'2017, Евстифеев Петр, Антипаттерны безопасного программирования
 
ieee
ieeeieee
ieee
 
Application Security around OWASP Top 10
Application Security around OWASP Top 10Application Security around OWASP Top 10
Application Security around OWASP Top 10
 
Java EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank KimJava EE Web Security By Example: Frank Kim
Java EE Web Security By Example: Frank Kim
 
Protecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacksProtecting your data from SQL Injection attacks
Protecting your data from SQL Injection attacks
 

Más de Gabriel Curcudel

Cum să crești vânzările online
Cum să crești vânzările online Cum să crești vânzările online
Cum să crești vânzările online Gabriel Curcudel
 
Competitive link analysis si link management
Competitive link analysis si link managementCompetitive link analysis si link management
Competitive link analysis si link managementGabriel Curcudel
 
Local search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysLocal search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysGabriel Curcudel
 
Analiza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleAnaliza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleGabriel Curcudel
 
Long tail - Krumel - IMTO Seo & Sem
Long tail -  Krumel - IMTO Seo & SemLong tail -  Krumel - IMTO Seo & Sem
Long tail - Krumel - IMTO Seo & SemGabriel Curcudel
 
SEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineSEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineGabriel Curcudel
 
Working for the client's clients
Working for the client's clientsWorking for the client's clients
Working for the client's clientsGabriel Curcudel
 
Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Gabriel Curcudel
 
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebTraficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebGabriel Curcudel
 
Google Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGoogle Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGabriel Curcudel
 
Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Gabriel Curcudel
 
Cum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareCum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareGabriel Curcudel
 
Webdeveloper Ciprian Berescu
Webdeveloper  Ciprian BerescuWebdeveloper  Ciprian Berescu
Webdeveloper Ciprian BerescuGabriel Curcudel
 
Mituri Despre Antreprenoriat
Mituri Despre AntreprenoriatMituri Despre Antreprenoriat
Mituri Despre AntreprenoriatGabriel Curcudel
 
Online Commercial Intention
Online Commercial IntentionOnline Commercial Intention
Online Commercial IntentionGabriel Curcudel
 

Más de Gabriel Curcudel (20)

Cum să crești vânzările online
Cum să crești vânzările online Cum să crești vânzările online
Cum să crești vânzările online
 
Local search 2013 Romania
Local search 2013 RomaniaLocal search 2013 Romania
Local search 2013 Romania
 
Competitive link analysis si link management
Competitive link analysis si link managementCompetitive link analysis si link management
Competitive link analysis si link management
 
Local search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM DaysLocal search Romania 2012 - Krumel - SEM Days
Local search Romania 2012 - Krumel - SEM Days
 
Link building Tecomm Cluj
Link building  Tecomm ClujLink building  Tecomm Cluj
Link building Tecomm Cluj
 
Analiza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2paraleAnaliza SEO ptr site-uri din 2parale
Analiza SEO ptr site-uri din 2parale
 
Long tail - Krumel - IMTO Seo & Sem
Long tail -  Krumel - IMTO Seo & SemLong tail -  Krumel - IMTO Seo & Sem
Long tail - Krumel - IMTO Seo & Sem
 
Lumea Seo Sem Ppc
Lumea Seo Sem PpcLumea Seo Sem Ppc
Lumea Seo Sem Ppc
 
SEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri olineSEO si SEM – strategii pentru afaceri oline
SEO si SEM – strategii pentru afaceri oline
 
Prezentare IMTO - Krumel
Prezentare IMTO - KrumelPrezentare IMTO - Krumel
Prezentare IMTO - Krumel
 
Working for the client's clients
Working for the client's clientsWorking for the client's clients
Working for the client's clients
 
Seo Vs Copywriting
Seo Vs CopywritingSeo Vs Copywriting
Seo Vs Copywriting
 
Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009Google Analytics The Fruits Salad Sibiu 2009
Google Analytics The Fruits Salad Sibiu 2009
 
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor WebTraficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
Traficul Organic Si Relevanta Pentru Vizitatori A Paginilor Web
 
Google Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi AdwordsGoogle Ad Planner Pentru Plasamente anunturi Adwords
Google Ad Planner Pentru Plasamente anunturi Adwords
 
Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?Cum vinde GOOGLE pentru tine?
Cum vinde GOOGLE pentru tine?
 
Cum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De CautareCum Folosesti Motoarele De Cautare
Cum Folosesti Motoarele De Cautare
 
Webdeveloper Ciprian Berescu
Webdeveloper  Ciprian BerescuWebdeveloper  Ciprian Berescu
Webdeveloper Ciprian Berescu
 
Mituri Despre Antreprenoriat
Mituri Despre AntreprenoriatMituri Despre Antreprenoriat
Mituri Despre Antreprenoriat
 
Online Commercial Intention
Online Commercial IntentionOnline Commercial Intention
Online Commercial Intention
 

Último

Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfRankYa
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLScyllaDB
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr BaganFwdays
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionDilum Bandara
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Enterprise Knowledge
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebUiPathCommunity
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyAlfredo García Lavilla
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfAddepto
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Mark Simos
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxNavinnSomaal
 

Último (20)

Search Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdfSearch Engine Optimization SEO PDF for 2024.pdf
Search Engine Optimization SEO PDF for 2024.pdf
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
Developer Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQLDeveloper Data Modeling Mistakes: From Postgres to NoSQL
Developer Data Modeling Mistakes: From Postgres to NoSQL
 
"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan"ML in Production",Oleksandr Bagan
"ML in Production",Oleksandr Bagan
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Advanced Computer Architecture – An Introduction
Advanced Computer Architecture – An IntroductionAdvanced Computer Architecture – An Introduction
Advanced Computer Architecture – An Introduction
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 
Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024Designing IA for AI - Information Architecture Conference 2024
Designing IA for AI - Information Architecture Conference 2024
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
Dev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio WebDev Dives: Streamline document processing with UiPath Studio Web
Dev Dives: Streamline document processing with UiPath Studio Web
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easy
 
Gen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdfGen AI in Business - Global Trends Report 2024.pdf
Gen AI in Business - Global Trends Report 2024.pdf
 
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
Tampa BSides - Chef's Tour of Microsoft Security Adoption Framework (SAF)
 
SAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptxSAP Build Work Zone - Overview L2-L3.pptx
SAP Build Work Zone - Overview L2-L3.pptx
 

Prezentarea "Securitatea Aplicatiilor Online" de la ODO