1. Injection – SQL, XML
2. Cross-site scripting – data context leaking into the xml context –
3. Broken authentication and session management
4. Insecure direct object reference – where a hacker can get to assets against which they are authenticated but not authorised. mitigation: user access controls, indirect references
5. Cross site forgery request – you go to evil. HTML. In that page is eg an image tag which contains a link to an instruction to a bank to withdraw money from your account. For it to work you must be logged in and authenticated against the bank. It feels like a very targeted hit as the hacker needs to know the page to hit surely.
Mitigation is anti-forgery tokens
6. Security misconfiguration:
tracing still on, custom errors off
7. insecure cryptography
hashing, salts, sha1, google, 1000 repetitions, encyrption, data protection layer – issue if the app server gets stolen, but OK if the database is stolen. Encoding is not encryption, Character rotation is not encyrption
9. Insufficient cryptographic transport… and storage?
10. Unvalidated redirects
Hm… changed for 2013:
