The security bug is never stupid, attackers just need to be lucky once, we are in deep s**t.
The story
Often I have been asked:
“I introduced this bug because I fixed a useless bug for the pen-test report, spent 3 days!”.
“To fix that reported small security issue, now login is broken, this is stupid I know”.
“Why do we need to validate this parameter? It is just an internal function call”.
“After adding those validations, now our performance dropped so much, why do we do this?”
“Who will hack this system? It is LAN, why do we need to care about persistent cookies and XSS”.
“The report says web cache poisoning, what does it mean? does it even matter to us why we need to fix it?”
“My interviewer asked me to write raw SQL query and asked me about SQL injection!? I told him we are using ORM why do we even care about this?”
…
Well, I know your concern, security is boring, not exciting at all, however, security is essential, important, and must have. Let’s see the what, how, and why.
CSRF (Cross-Site Request Forgery)
- Dangerous level ★★★☆☆
- What it is: CSRF is a type of attack that tricks the user’s browser into executing unwanted actions on a different site where…
