Web Vulnerabilities

In this week we will start to look at web site vulnerabilities.

We will cover two main themes

• Can we Classify vulnerabilities
• How do we look for vulnerabilities in our code.

Why the Web

While many of you will go on to write traditional desktop software, there is no escaping the fact that we are likely to have an "Online" version of our software.

However, while desktop software has a limited "attack surface" (ie we need to be on the machine it is running on), web applications by their nature are accesable to everyone, meaning the chance that a flaw will be discovered or exploited is much greater.

Additionally, many of the flaws described in classification systems like OWASP are equally applicable to the more traditional desktop applications.

Lab

• Reconnaissance