{"id":84184,"date":"2020-06-05T19:42:31","date_gmt":"2020-06-05T17:42:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god"},"modified":"2020-06-05T19:42:31","modified_gmt":"2020-06-05T17:42:31","slug":"smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","title":{"rendered":"Smrteln\u00e9 h\u0159\u00edchy bezpe\u010dnosti webu: co jsme se nau\u010dili ze statistiky skeneru zranitelnost\u00ed za rok","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u0159ibli\u017en\u011b p\u0159ed rokem jsme v DataLine spustili servis<\/a><\/noindex> slu\u017ebu pro hled\u00e1n\u00ed a anal\u00fdzu zranitelnost\u00ed v IT aplikac\u00edch. Cel\u00e9 \u0159e\u0161en\u00ed je postaveno na cloudov\u00e9 platform\u011b Qualys, o kter\u00e9 jsme u\u017e psali<\/a><\/noindex>. Za rok vyu\u017e\u00edv\u00e1n\u00ed t\u00e9to slu\u017eby jsme provedli 291 skenov\u00e1n\u00ed r\u016fzn\u00fdch web\u016f a nasb\u00edrali statistiky o b\u011b\u017en\u00fdch zranitelnostech ve webov\u00fdch aplikac\u00edch.\u00a0<\/p>\n

V n\u00e1sleduj\u00edc\u00edm \u010dl\u00e1nku uk\u00e1\u017eu, jak\u00e9 bezpe\u010dnostn\u00ed nedostatky se skr\u00fdvaj\u00ed za r\u016fzn\u00fdmi \u00farovn\u011bmi z\u00e1va\u017enosti. Pod\u00edv\u00e1me se, kter\u00e9 zranitelnosti skener nach\u00e1zel nej\u010dast\u011bji, pro\u010d k nim m\u016f\u017ee doch\u00e1zet a jak se br\u00e1nit.\u00a0<\/p>\n

\"Smrteln\u00e9
\n<\/a><\/noindex>
\nV\u0161echny zranitelnosti webov\u00fdch aplikac\u00ed Qualys d\u011bl\u00ed na t\u0159i \u00farovn\u011b z\u00e1va\u017enosti: n\u00edzkou, st\u0159edn\u00ed a vysokou. Pokud se pod\u00edv\u00e1me na rozd\u011blen\u00ed podle \"z\u00e1va\u017enosti\", zd\u00e1 se, \u017ee to nen\u00ed tak \u0161patn\u00e9. Zranitelnost\u00ed s vysokou \u00farovn\u00ed z\u00e1va\u017enosti je m\u00e1lo, v\u011bt\u0161inou jsou v\u0161echny nekritick\u00e9:\u00a0<\/p>\n

\"Smrteln\u00e9
\n
\nAle nekritick\u00e9 \u2013 neznamen\u00e1 bezobsa\u017en\u00e9. Takov\u00e9 zranitelnosti mohou tak\u00e9 zp\u016fsobit v\u00e1\u017en\u00e9 \u0161kody.\u00a0<\/p>\n

Top \"nekritick\u00fdch\" zranitelnost\u00ed<\/h2>\n

<\/p>\n

    \n
  1. Zranitelnosti spojen\u00e9 se sm\u00ed\u0161en\u00fdm obsahem.<\/b>\n

    Bezpe\u010dnostn\u00edm standardem webov\u00fdch str\u00e1nek je p\u0159enos dat mezi klientem a serverem prost\u0159ednictv\u00edm protokolu HTTPS, kter\u00fd podporuje \u0161ifrov\u00e1n\u00ed a chr\u00e1n\u00ed informace p\u0159ed odposlechem.\u00a0<\/p>\n

    N\u011bkter\u00e9 weby pou\u017e\u00edvaj\u00ed sm\u00ed\u0161en\u00fd obsah<\/i>: p\u0159en\u00e1\u0161ej\u00ed \u010d\u00e1st dat prost\u0159ednictv\u00edm nezabezpe\u010den\u00e9ho protokolu HTTP. \u010cast\u011bji se takto p\u0159en\u00e1\u0161\u00ed pasivn\u00ed obsah<\/i> : informace, kter\u00e9 ovliv\u0148uj\u00ed pouze zobrazen\u00ed webu: obr\u00e1zky, CSS styly. Ale n\u011bkdy se takto p\u0159en\u00e1\u0161\u00ed tak\u00e9 aktivn\u00ed obsah<\/i>: skripty, kter\u00e9 \u0159\u00edd\u00ed chov\u00e1n\u00ed webu. V tomto p\u0159\u00edpad\u011b je mo\u017en\u00e9 pomoc\u00ed speci\u00e1ln\u00edho softwaru analyzovat informace p\u0159ich\u00e1zej\u00edc\u00ed ze serveru s aktivn\u00edm obsahem, modifikovat sv\u00e9 odpov\u011bdi za b\u011bhu a donutit za\u0159\u00edzen\u00ed fungovat tak, jak jeho tv\u016frci nezam\u00fd\u0161leli.\u00a0<\/p>\n

    Nov\u00e9 verze prohl\u00ed\u017ee\u010d\u016f varuj\u00ed u\u017eivatele, \u017ee weby se sm\u00ed\u0161en\u00fdm obsahem jsou nebezpe\u010dn\u00e9, a blokuj\u00ed obsah. V\u00fdvoj\u00e1\u0159i web\u016f tak\u00e9 dost\u00e1vaj\u00ed varov\u00e1n\u00ed od prohl\u00ed\u017ee\u010de v konzoli. Nap\u0159\u00edklad takto to vypad\u00e1 v Firefox<\/a><\/noindex>:\u00a0<\/p>\n

    \"Smrteln\u00e9
    \n
    \nJak\u00e9 nebezpe\u010d\u00ed<\/b>: \u00dato\u010dn\u00edci vyu\u017e\u00edvaj\u00ed nezabezpe\u010den\u00fd protokol k odposlouch\u00e1v\u00e1n\u00ed informac\u00ed o u\u017eivateli, v\u00fdm\u011bn\u011b skript\u016f a odes\u00edl\u00e1n\u00ed po\u017eadavk\u016f na web jm\u00e9nem u\u017eivatele. I kdy\u017e n\u00e1v\u0161t\u011bvn\u00edk webu nezadal \u017e\u00e1dn\u00e1 data, to ho nechr\u00e1n\u00ed p\u0159ed phishingem <\/i>\u2013 z\u00edsk\u00e1v\u00e1n\u00ed d\u016fv\u011brn\u00fdch informac\u00ed podvodn\u00fdmi metodami. Nap\u0159\u00edklad pomoc\u00ed skriptu lze p\u0159esm\u011brovat u\u017eivatele na nebezpe\u010dnou str\u00e1nku, kter\u00e1 se maskuje jako zn\u00e1m\u00e1. V n\u011bkter\u00fdch p\u0159\u00edpadech m\u016f\u017ee zlovoln\u00e1 str\u00e1nka vypadat dokonce l\u00e9pe ne\u017e origin\u00e1l, a u\u017eivatel m\u016f\u017ee s\u00e1m vyplnit formul\u00e1\u0159 a p\u0159edat d\u016fv\u011brn\u00e9 \u00fadaje.\u00a0<\/p>\n

    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: I kdy\u017e spr\u00e1vce webov\u00e9 str\u00e1nky nainstaloval a nastavoval SSL\/TLS certifik\u00e1t, zranitelnost m\u016f\u017ee vzniknout v d\u016fsledku lidsk\u00e9ho faktoru. Nap\u0159\u00edklad pokud je na n\u011bkter\u00e9 ze str\u00e1nek pou\u017eito m\u00edsto relativn\u00edho odkazu absolutn\u00ed s http, a nav\u00edc nejsou nakonfigurov\u00e1ny p\u0159esm\u011brov\u00e1n\u00ed z http na https.\u00a0<\/p>\n

    Sm\u00ed\u0161en\u00fd obsah na webu lze odhalit pomoc\u00ed prohl\u00ed\u017ee\u010de: prozkoumat zdrojov\u00fd k\u00f3d str\u00e1nky a p\u0159e\u010d\u00edst si upozorn\u011bn\u00ed v konzoli v\u00fdvoj\u00e1\u0159e. Nicm\u00e9n\u011b v\u00fdvoj\u00e1\u0159 bude muset dlouho a nu\u010dn\u011b proch\u00e1zet k\u00f3d. Proces lze urychlit pomoc\u00ed automatizovan\u00fdch analytick\u00fdch n\u00e1stroj\u016f, nap\u0159\u00edklad: SSL Check<\/a><\/noindex>, voln\u00e9 softwarov\u00e9 n\u00e1stroje Lighthouse nebo placen\u00fd software Screaming Frog SEO Spider.<\/p>\n

    Zranitelnost m\u016f\u017ee rovn\u011b\u017e vzniknout z probl\u00e9m\u016f se zd\u011bd\u011bn\u00fdm k\u00f3dem \u2013 k\u00f3dem, kter\u00fd byl p\u0159evzat. Nap\u0159\u00edklad pokud je \u010d\u00e1st str\u00e1nek generov\u00e1na podle star\u00e9ho \u0161ablony, kter\u00e1 nezohled\u0148uje p\u0159echod web\u016f na https.\u00a0\u00a0\u00a0\u00a0\n<\/li>\n

  2. Cookies bez vlajek \u201eHTTPOnly\u201c a \u201esecure\u201c.<\/b>\n

    Atribut \u201eHTTPOnly\u201c chr\u00e1n\u00ed soubory cookies p\u0159ed zpracov\u00e1n\u00edm skripty, kter\u00e9 \u00fato\u010dn\u00edci pou\u017e\u00edvaj\u00ed k kr\u00e1de\u017ei u\u017eivatelsk\u00fdch dat. Vlajka \u201esecure\u201c nedovoluje p\u0159enos cookies v otev\u0159en\u00e9 podob\u011b. V\u00fdmena dat bude povolena pouze v p\u0159\u00edpad\u011b, \u017ee k odesl\u00e1n\u00ed cookies se pou\u017e\u00edv\u00e1 chr\u00e1n\u011bn\u00fd protokol HTTPS.\u00a0<\/p>\n

    Oba atributy se zapisuj\u00ed do vlastnost\u00ed cookies:<\/p>\n

    Set-Cookie: Secure; HttpOnly<\/code><\/pre>\n
    \nJak\u00e9 nebezpe\u010d\u00ed<\/b>: Pokud v\u00fdvoj\u00e1\u0159 webu tyto atributy nenastavil, \u00fato\u010dn\u00edk m\u016f\u017ee zachytit informace u\u017eivatele z cookies a vyu\u017e\u00edt je. Pokud se cookies pou\u017e\u00edvaj\u00ed pro autentizaci a autorizaci, m\u016f\u017ee ukr\u00e1st relaci u\u017eivatele a prov\u00e1d\u011bt akce na webu jeho jm\u00e9nem.\u00a0<\/p>\n
    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Obecn\u011b se v popul\u00e1rn\u00edch r\u00e1mc\u00edch tyto atributy nastavuj\u00ed automaticky. Ale i tak zkontrolujte konfiguraci webov\u00e9ho serveru a nastavte vlajku: Set-Cookie HttpOnly; Secure. <\/p>\n
    P\u0159itom atribut \u201eHTTPOnly\u201c u\u010din\u00ed cookies neviditeln\u00fdmi i pro v\u00e1\u0161 vlastn\u00ed JavaScript.\u00a0\u00a0\n<\/li>\n
  3. Path-Based Vulnerabilities (\u201ecestovn\u00ed\u201c zranitelnosti).<\/b>\n
    Skenner hl\u00e1s\u00ed takovou zranitelnost, pokud najde ve\u0159ejn\u011b p\u0159\u00edstupn\u00fd soubor nebo adres\u00e1\u0159 webu s potenci\u00e1ln\u011b d\u016fv\u011brn\u00fdmi informacemi. Nap\u0159\u00edklad odhaluje jednotliv\u00e9 soubory s konfigurac\u00ed syst\u00e9mu nebo p\u0159\u00edstup k cel\u00e9mu souborov\u00e9mu syst\u00e9mu. Tato situace m\u016f\u017ee nastat, pokud jsou na webu nespr\u00e1vn\u011b nastavena opr\u00e1vn\u011bn\u00ed.<\/p>\n
    Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Pokud se souborov\u00fd syst\u00e9m \"vystavuje\", \u00fato\u010dn\u00edk m\u016f\u017ee proniknout do rozhran\u00ed opera\u010dn\u00edho syst\u00e9mu a pokusit se naj\u00edt slo\u017eky s hesly, pokud jsou ulo\u017eena v otev\u0159en\u00e9 podob\u011b (to ned\u011blejte!). Nebo si m\u016f\u017ee odcizit hash hesel a pokusit se je uh\u00e1dnout, stejn\u011b jako se pokusit zv\u00fd\u0161it privilegium v syst\u00e9mu a proniknout hloub\u011bji do infrastruktury.\u00a0\u00a0<\/p>\n
    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Nezapom\u00ednejte na opr\u00e1vn\u011bn\u00ed a konfigurovejte platformu, webov\u00fd server a webovou aplikaci tak, aby se nemohlo \"ute\u010dt\" z webov\u00e9ho adres\u00e1\u0159e.\n<\/li>\n
  4. Formul\u00e1\u0159e pro zad\u00e1n\u00ed d\u016fv\u011brn\u00fdch dat se zapnutou funkc\u00ed automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed.<\/b>\n
    Pokud u\u017eivatel \u010dasto vypl\u0148uje formul\u00e1\u0159e na webov\u00fdch str\u00e1nk\u00e1ch, jeho prohl\u00ed\u017ee\u010d tuto informaci ukl\u00e1d\u00e1 pomoc\u00ed funkce automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed.\u00a0<\/p>\n
    Formul\u00e1\u0159e na webov\u00fdch str\u00e1nk\u00e1ch mohou obsahovat pole s d\u016fv\u011brn\u00fdmi informacemi, nap\u0159\u00edklad hesla nebo \u010d\u00edsla kreditn\u00edch karet. Pro takov\u00e1 pole je vhodn\u00e9 na samotn\u00e9 str\u00e1nce vypnout funkci automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed.\u00a0<\/p>\n
    Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Pokud prohl\u00ed\u017ee\u010d u\u017eivatele ulo\u017e\u00ed d\u016fv\u011brn\u00e9 informace, \u00fato\u010dn\u00edk je m\u016f\u017ee pozd\u011bji zachytit, nap\u0159\u00edklad pomoc\u00ed phishingu. V podstat\u011b webov\u00fd v\u00fdvoj\u00e1\u0159, kter\u00fd na tento detail zapomene, ohro\u017euje sv\u00e9 u\u017eivatele.\u00a0<\/p>\n
    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: V tomto p\u0159\u00edpad\u011b m\u00e1me klasick\u00fd konflikt: pohodl\u00ed vs bezpe\u010dnost. Pokud webov\u00fd v\u00fdvoj\u00e1\u0159 mysl\u00ed na pohodl\u00ed u\u017eivatele, m\u016f\u017ee se rozhodnout pro automatick\u00e9 vypl\u0148ov\u00e1n\u00ed. Nap\u0159\u00edklad pokud je d\u016fle\u017eit\u00e9 dodr\u017eovat Sm\u011brnice pro p\u0159\u00edstupnost webov\u00e9ho obsahu<\/a><\/noindex> \u2013 doporu\u010den\u00ed pro p\u0159\u00edstupnost obsahu pro u\u017eivatele se zdravotn\u00edm posti\u017een\u00edm.\u00a0<\/p>\n
    Pro v\u011bt\u0161inu prohl\u00ed\u017ee\u010d\u016f je mo\u017en\u00e9 vypnout automatick\u00e9 vypl\u0148ov\u00e1n\u00ed pomoc\u00ed atributu autocompete=\"off\", nap\u0159\u00edklad:<\/p>\n
    \u00a0<body>\n    <form action="\/cs\/form\/submit\/" method="get" autocomplete="off" data-trp-original-action="\/form\/submit">\n      <div>\n        <input type="text" placeholder="Jméno">\n      <\/div>\n      <div>\n        <input type="text" id="lname" placeholder="P\u0159íjmení" autocomplete="on">\n      <\/div>\n      <div>\n        <input type="number" placeholder="\u010císlo kreditní karty">\n      <\/div>\n      <input type="submit">\n    <input type="hidden" name="trp-form-language" value="cs"\/><\/form>\n  <\/body><\/code><\/pre>\n
    \nAle pro Chrome to nefunguje. To se obch\u00e1z\u00ed pomoc\u00ed JavaScriptu, alternativu receptu lze naj\u00edt zde<\/a><\/noindex>.\u00a0\n<\/li>\n
  5. Na str\u00e1nk\u00e1ch nen\u00ed nastaven\u00e1 hlavi\u010dka X-Frame-Options.\u00a0<\/b>\n
    Tento nadpis ovliv\u0148uje zna\u010dky frame, iframe, embed nebo object. Pomoc\u00ed n\u011bj m\u016f\u017eete zcela zak\u00e1zat vkl\u00e1d\u00e1n\u00ed sv\u00e9ho webu do r\u00e1mce. K tomu je t\u0159eba nastavit hodnotu X-Frame-Options: deny. Nebo m\u016f\u017eete uv\u00e9st X-Frame-Options: sameorigin, pak bude vkl\u00e1d\u00e1n\u00ed do iframe dostupn\u00e9 pouze na va\u0161\u00ed dom\u00e9n\u011b.<\/p>\n
    Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Nep\u0159\u00edtomnost takov\u00e9ho z\u00e1hlav\u00ed lze vyu\u017e\u00edt na \u0161kodliv\u00fdch str\u00e1nk\u00e1ch pro clickjacking<\/i>. Pro takov\u00fd \u00fatok \u00fato\u010dn\u00edk vytvo\u0159\u00ed pr\u016fhledn\u00fd r\u00e1mec nad tla\u010d\u00edtky a oklame u\u017eivatele. Nap\u0159\u00edklad: podvodn\u00edci umis\u0165uj\u00ed do r\u00e1mce na webov\u00e9 str\u00e1nce str\u00e1nky soci\u00e1ln\u00edch s\u00edt\u00ed. U\u017eivatel si mysl\u00ed, \u017ee klik\u00e1 na tla\u010d\u00edtko na t\u00e9to str\u00e1nce. M\u00edsto toho je kliknut\u00ed zachyceno a odes\u00edl\u00e1 po\u017eadavek u\u017eivatele na soci\u00e1ln\u00ed s\u00ed\u0165, kde m\u00e1 aktivn\u00ed relaci. Takto \u00fato\u010dn\u00edci rozes\u00edlaj\u00ed spam jm\u00e9nem u\u017eivatele nebo zvy\u0161uj\u00ed sleduj\u00edc\u00ed a lajky.\u00a0<\/p>\n
    Pokud tuto mo\u017enost nezak\u00e1\u017eete, \u00fato\u010dn\u00edk m\u016f\u017ee um\u00edstit tla\u010d\u00edtko va\u0161\u00ed aplikace na \u0161kodlivou str\u00e1nku. M\u016f\u017ee m\u00edt z\u00e1jem o v\u00e1\u0161 referral program nebo o va\u0161e u\u017eivatele.\u00a0\u00a0<\/p>\n
    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Zranitelnost m\u016f\u017ee vzniknout, pokud je na webov\u00e9m serveru nebo vyrovn\u00e1vac\u00edm za\u0159\u00edzen\u00ed na\u010dten konfliktuj\u00edc\u00ed X-Frame-Options. V takov\u00e9m p\u0159\u00edpad\u011b server a vyrovn\u00e1vac\u00ed za\u0159\u00edzen\u00ed jednodu\u0161e p\u0159ep\u00ed\u0161ou z\u00e1hlav\u00ed, proto\u017ee maj\u00ed vy\u0161\u0161\u00ed prioritu ne\u017e k\u00f3d backendov\u00e9 \u010d\u00e1sti.\u00a0\u00a0<\/p>\n
    Hodnoty deny a sameorigin pro z\u00e1hlav\u00ed X-Frame-Options budou naru\u0161ovat funkci webvizoru Yandexu. Aby bylo umo\u017en\u011bno pou\u017e\u00edvat iframe pro webvizor, je t\u0159eba v nastaven\u00ed napsat zvl\u00e1\u0161tn\u00ed pravidlo. Nap\u0159\u00edklad pro nginx lze nastavit takto:<\/p>\n
    http{\n...\n\u00a0map $http_referer $frame_options {\n\u00a0\"~webvisor.com\" \"ALLOW-FROM http:\/\/webvisor.com\";\n\u00a0default \"SAMEORIGIN\";\n\u00a0}\n\u00a0add_header X-Frame-Options $frame_options;\n...\n}\n\n<\/code><\/pre>\n
    \n<\/li>\n
  6. Zranitelnosti PRSSI (Path-relative stylesheet import).\u00a0\u00a0<\/b>\n
    Toto je zranitelnost ve stylech webu. Vznik\u00e1, pokud se k soubor\u016fm styl\u016f pou\u017e\u00edvaj\u00ed relativn\u00ed odkazy typu href=\"\/somefolder\/styles.css\/\". \u00dato\u010dn\u00edk toho vyu\u017eije, pokud najde zp\u016fsob, jak p\u0159esm\u011brovat u\u017eivatele na \u0161kodlivou str\u00e1nku. Str\u00e1nka vlo\u017e\u00ed relativn\u00ed odkaz do sv\u00e9 URL a napodob\u00ed dotaz na styly. Vznikne tak dotaz jako badsite.ru\/...\/somefolder\/styles.css\/, kter\u00fd pod z\u00e1minkou stylu m\u016f\u017ee prov\u00e1d\u011bt \u0161kodliv\u00e9 akce.\u00a0<\/p>\n
    Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Podvodn\u00edk m\u016f\u017ee vyu\u017e\u00edt tuto zranitelnost, pokud najde dal\u0161\u00ed bezpe\u010dnostn\u00ed d\u00edru. V d\u016fsledku toho lze ukr\u00e1st u\u017eivatelsk\u00e1 data z cookies nebo token\u016f.<\/p>\n
    Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Nastavte z\u00e1hlav\u00ed X-Content-Type-Options: nosniff. V tomto p\u0159\u00edpad\u011b prohl\u00ed\u017ee\u010d zkontroluje typ obsahu pro styly. Pokud se typ li\u0161\u00ed od text\/css, prohl\u00ed\u017ee\u010d po\u017eadavek zablokuje.\n<\/li>\n<\/ol>\n
    <\/p>\n
    Kritick\u00e9 zranitelnosti<\/h2>\n
    <\/p>\n
      \n
    1. Str\u00e1nka s polem pro heslo je p\u0159en\u00e1\u0161ena ze serveru p\u0159es nezabezpe\u010den\u00fd kan\u00e1l (HTML form containing password field(s) is served over HTTP).<\/b>\n
      Odpov\u011b\u010f od serveru p\u0159es ne\u0161ifrovan\u00fd kan\u00e1l je zraniteln\u00e1 v\u016f\u010di \u00fatok\u016fm typu \u201eMan in the middle\u201c. \u00dato\u010dn\u00edk m\u016f\u017ee zachytit provoz a vlo\u017eit se mezi klienta a server, kdy\u017e str\u00e1nka jde od serveru ke klientovi.\u00a0<\/p>\n
      Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Podvodn\u00edk m\u016f\u017ee pozm\u011bnit str\u00e1nku a poslat u\u017eivateli formul\u00e1\u0159 pro d\u016fv\u011brn\u00e9 \u00fadaje, kter\u00e9 odejdou na server \u00fato\u010dn\u00edka.\u00a0<\/p>\n
      Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: N\u011bkter\u00e9 str\u00e1nky m\u00edsto hesla zas\u00edlaj\u00ed u\u017eivatel\u016fm jednor\u00e1zov\u00fd k\u00f3d na e-mail\/telefon. V tomto p\u0159\u00edpad\u011b nen\u00ed zranitelnost tak kritick\u00e1, ale mechanismus zkomplikuje \u017eivot u\u017eivatel\u016fm.\n<\/li>\n
    2. Odesl\u00e1n\u00ed formul\u00e1\u0159e s p\u0159ihla\u0161ovac\u00edm jm\u00e9nem a heslem p\u0159es nezabezpe\u010den\u00fd kan\u00e1l (Login Form Is Not Submitted Via HTTPS).<\/b>\n
      V tomto p\u0159\u00edpad\u011b se od u\u017eivatele na server odes\u00edl\u00e1 formul\u00e1\u0159 s p\u0159ihla\u0161ovac\u00edm jm\u00e9nem a heslem p\u0159es ne\u0161ifrovan\u00fd kan\u00e1l.<\/p>\n
      Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Na rozd\u00edl od p\u0159edchoz\u00edho p\u0159\u00edpadu se ji\u017e jedn\u00e1 o kritickou zranitelnost. Zachytit d\u016fv\u011brn\u00e9 \u00fadaje je snaz\u0161\u00ed, proto\u017ee nen\u00ed pot\u0159eba ps\u00e1t pro to k\u00f3d.\u00a0\n<\/li>\n
    3. Pou\u017e\u00edv\u00e1n\u00ed knihoven JavaScript se zn\u00e1m\u00fdmi zranitelnostmi.<\/b>\n
      B\u011bhem skenov\u00e1n\u00ed se nejpou\u017e\u00edvan\u011bj\u0161\u00ed knihovnou stal jQuery s \u0161irok\u00fdm rozsahem verz\u00ed. V ka\u017ed\u00e9 verzi je alespo\u0148 jedna, a to i v\u00edce zn\u00e1m\u00fdch zranitelnost\u00ed. Dopad m\u016f\u017ee b\u00fdt r\u016fzn\u00fd \u2013 z\u00e1vis\u00ed na povaze zranitelnosti.<\/p>\n
      Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Pro zn\u00e1m\u00e9 zranitelnosti existuj\u00ed exploity, nap\u0159\u00edklad takov\u00e9:<\/p>\n
      \"Smrteln\u00e9
      \n
      \nCo si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Pravideln\u011b se vracejte k cyklu: vyhled\u00e1n\u00ed zn\u00e1m\u00fdch zranitelnost\u00ed \u2013 odstran\u011bn\u00ed \u2013 ov\u011b\u0159en\u00ed. Pokud v\u011bdom\u011b pou\u017e\u00edv\u00e1te zastaral\u00e9 knihovny, nap\u0159\u00edklad pro podporu star\u00fdch prohl\u00ed\u017ee\u010d\u016f nebo pro \u00fasporu rozpo\u010dtu, hledejte mo\u017enosti odstran\u011bn\u00ed zn\u00e1m\u00e9 zranitelnosti.\u00a0\n<\/li>\n
    4. Mezisiteov\u00e9 skripty (XSS).\u00a0<\/b>
      \nCross-Site Scripting (XSS), nebo mezisiteov\u00e9 skripty, jsou \u00fatoky na webovou aplikaci, kdy se v datab\u00e1zi objev\u00ed \u0161kodliv\u00fd k\u00f3d. Pokud Qualys zjist\u00ed tuto zranitelnost, pak potenci\u00e1ln\u00ed \u00fato\u010dn\u00edk m\u016f\u017ee vlo\u017eit nebo ji\u017e vlo\u017eil sv\u016fj js skript do k\u00f3du webu pro prov\u00e1d\u011bn\u00ed \u0161kodliv\u00fdch \u010dinnost\u00ed.<\/p>\n
      Ulo\u017een\u00e9 XSS (Stored XSS)<\/b> jsou nebezpe\u010dn\u011bj\u0161\u00ed, proto\u017ee skript se vkl\u00e1d\u00e1 na serveru a spou\u0161t\u00ed se poka\u017ed\u00e9, kdy\u017e je napaden\u00e1 str\u00e1nka otev\u0159ena v prohl\u00ed\u017ee\u010di.<\/p>\n
      Odr\u017een\u00e9 XSS (Reflected XSS)<\/b> se snadn\u011bji prov\u00e1d\u011bj\u00ed, proto\u017ee zlovoln\u00fd skript lze vlo\u017eit do HTTP po\u017eadavku. Aplikace obdr\u017e\u00ed HTTP po\u017eadavek, neov\u011b\u0159\u00ed data, zabal\u00ed je a okam\u017eit\u011b ode\u0161le. Pokud \u00fato\u010dn\u00edk zachyt\u00ed provoz a vlo\u017e\u00ed skript typu <\/p>\n
      <script>\/*+\u0447\u0442\u043e+\u0442\u043e+\u043f\u043b\u043e\u0445\u043e\u0435+*\/<\/script> <\/code><\/pre>\n
      \n, odejde ze strany klienta \u0161kodliv\u00fd po\u017eadavek.<\/p>\n
      Jasn\u00fd p\u0159\u00edklad XSS: js sniffery, kter\u00e9 napodobuj\u00ed str\u00e1nky pro zad\u00e1n\u00ed CVC, platnosti karty a tak d\u00e1le.\u00a0<\/p>\n
      Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: V hlavi\u010dce Content-Security-Policy pou\u017eijte atribut script-src, aby prohl\u00ed\u017ee\u010d klienta na\u010d\u00edtal a vykon\u00e1val pouze k\u00f3d z d\u016fv\u011bryhodn\u00e9ho zdroje. Nap\u0159\u00edklad script-src 'self' za\u0159ad\u00ed do whitelistu v\u0161echny skripty pouze z na\u0161\u00ed str\u00e1nky.\u00a0
      \nNejlep\u0161\u00ed prax\u00ed je Inline code: povolte pouze inline javascript pomoc\u00ed hodnoty unsafe-inline. Tato hodnota povoluje pou\u017eit\u00ed inline js\/css, ale nezakazuje p\u0159ipojov\u00e1n\u00ed js soubor\u016f. V kombinaci se script-src 'self' zakazujeme vykon\u00e1v\u00e1n\u00ed extern\u00edch skript\u016f.<\/p>\n
      Jasn\u011b logujte v\u0161echny pomoc\u00ed report-uri a sledujte pokusy o vkl\u00e1d\u00e1n\u00ed do webu.\n<\/li>\n
    5. SQL injekce.<\/b>
      \nZranitelnost \u0159\u00edk\u00e1, \u017ee existuje mo\u017enost vlo\u017een\u00ed SQL k\u00f3du na web, kter\u00fd se p\u0159\u00edmo obrac\u00ed na datab\u00e1zi webu. SQL injekce je mo\u017en\u00e1, pokud data od u\u017eivatele nejsou escapov\u00e1na: neov\u011b\u0159uj\u00ed se na spr\u00e1vnost a okam\u017eit\u011b se pou\u017e\u00edvaj\u00ed v dotazu. Nap\u0159\u00edklad se to stane, pokud formul\u00e1\u0159 na webu nezkoum\u00e1 shodu vstupu s typem dat.\u00a0<\/p>\n
      Jak\u00e9 nebezpe\u010d\u00ed<\/b>: Pokud \u00fato\u010dn\u00edk tento dotaz zad\u00e1 do takov\u00e9ho formul\u00e1\u0159e, m\u016f\u017ee zni\u010dit datab\u00e1zi nebo vyzradit d\u016fv\u011brn\u00e9 informace.\u00a0<\/p>\n
      Co si pamatuje webov\u00fd v\u00fdvoj\u00e1\u0159<\/b>: Ned\u016fv\u011b\u0159ujte tomu, co p\u0159ich\u00e1z\u00ed z prohl\u00ed\u017ee\u010de. Ochrana je nutn\u00e1 na stran\u011b klienta i serveru.\u00a0<\/p>\n
      Na stran\u011b klienta napi\u0161te kontrolu pol\u00ed pomoc\u00ed JavaScript.\u00a0<\/p>\n
      Vestav\u011bn\u00e9 funkce v popul\u00e1rn\u00edch r\u00e1mc\u00edch tak\u00e9 pom\u00e1haj\u00ed escapovat podez\u0159el\u00e9 znaky na serveru. Na serveru se tak\u00e9 doporu\u010duje pou\u017e\u00edvat parametrizovan\u00e9 dotazy k datab\u00e1z\u00edm.<\/p>\n
      Ur\u010dete, kde p\u0159esn\u011b doch\u00e1z\u00ed k interakci s datab\u00e1z\u00ed na webov\u00e9 aplikaci.\u00a0<\/p>\n
      Interakce nast\u00e1v\u00e1, kdy\u017e z\u00edsk\u00e1v\u00e1me n\u011bjak\u00e9 informace: dotaz s id (zm\u011bna id), vytvo\u0159en\u00ed nov\u00e9ho u\u017eivatele, nov\u00fd koment\u00e1\u0159 \u2013 nov\u00e9 z\u00e1znamy v datab\u00e1zi. Zde mohou vznikat sql-injekce. I kdy\u017e odstran\u00edme z\u00e1znam z datab\u00e1ze, m\u016f\u017ee nastat sql-injekce.\n<\/li>\n<\/ol>\n
      <\/p>\n
      Obecn\u00e1 doporu\u010den\u00ed<\/h2>\n
      \nNevynal\u00e9zejte kolo \u2013 pou\u017e\u00edvejte ov\u011b\u0159en\u00e9 r\u00e1mce<\/b>. Obecn\u011b jsou popul\u00e1rn\u00ed r\u00e1mce bezpe\u010dn\u011bj\u0161\u00ed. Pro .NET to jsou ASP.NET MVC a ASP.NET Core, pro Python \u2013 Django nebo Flask, pro Ruby \u2013 Ruby on Rails, pro PHP \u2013 Symfony, Laravel, Yii, pro JavaScript \u2013 Node.JS- Express.js, pro Java \u2013 Spring MVC.<\/p>\n
      Sledujte aktualizace dodavatele a pravideln\u011b aktualizujte<\/b>. Zranitelnost najdou, pot\u00e9 nap\u00ed\u0161ou exploit, zve\u0159ejn\u00ed ho a v\u0161e se opakuje znovu. P\u0159ihlaste se k odb\u011bru aktualizac\u00ed stabiln\u00edch verz\u00ed od dodavatele softwaru.<\/p>\n
      Kontrolujte p\u0159\u00edstupov\u00e1 pr\u00e1va<\/b>. Z pohledu serveru v\u017edy nahl\u00ed\u017eejte na sv\u016fj k\u00f3d tak, jako by byl cel\u00fd, od prvn\u00edho do posledn\u00edho p\u00edsmene, naps\u00e1n va\u0161\u00edm nejnen\u00e1vid\u011bn\u011bj\u0161\u00edm nep\u0159\u00edtelem, kter\u00fd se sna\u017e\u00ed zni\u010dit v\u00e1\u0161 web a naru\u0161it integritu va\u0161ich dat. T\u00edm sp\u00ed\u0161e, \u017ee n\u011bkdy tomu tak skute\u010dn\u011b je.<\/p>\n
      Pou\u017e\u00edvejte klony, testovac\u00ed prost\u0159ed\u00ed a teprve potom p\u0159en\u00e1\u0161ejte na produkci<\/b>. To pom\u016f\u017ee, jednak se vyhnout chyb\u00e1m a nedostatk\u016fm v produktivn\u00edm prost\u0159ed\u00ed: produktivn\u00ed prost\u0159ed\u00ed p\u0159in\u00e1\u0161\u00ed pen\u00edze, prostoje produk\u010dn\u00edho prost\u0159ed\u00ed jsou kritick\u00e9. P\u0159i p\u0159id\u00e1v\u00e1n\u00ed, opravov\u00e1n\u00ed nebo uzav\u00edr\u00e1n\u00ed n\u011bjak\u00e9ho probl\u00e9mu je vhodn\u00e9 prov\u00e1d\u011bt pr\u00e1ce v testovac\u00edm prost\u0159ed\u00ed, pot\u00e9 zkontrolovat funk\u010dnost a nalezen\u00e9 zranitelnosti, a teprve potom pl\u00e1novat pr\u00e1ce s produktivn\u00edm prost\u0159ed\u00edm.\u00a0<\/p>\n
      Chra\u0148te webovou aplikaci pomoc\u00ed Web Application Firewall<\/a><\/noindex> a integrujte s n\u00edm zpr\u00e1vy od skeneru zranitelnost\u00ed<\/b>. Nap\u0159\u00edklad v DataLine se jako spojen\u00ed slu\u017eeb pou\u017e\u00edvaj\u00ed Qualys a FortiWeb.
      \n
      Zdroj:       habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
      \u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0432 DataLine \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0422-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u2013 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 Qualys, \u043f\u0440\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u044b \u0443\u0436\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438. \u0417\u0430 \u0433\u043e\u0434 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u044b \u043f\u0440\u043e\u0432\u0435\u043b\u0438 291 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u0438 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445.\u00a0 \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0438\u0436\u0435 \u044f \u043f\u043e\u043a\u0430\u0436\u0443, \u043a\u0430\u043a\u0438\u0435 \u0438\u043c\u0435\u043d\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84185,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-84184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sm\u011b\u0161n\u00e9 h\u0159\u00edchy bezpe\u010dnosti webu: co jsme se nau\u010dili ze statistik skeneru zranitelnost\u00ed za rok | ProHoster","description":"P\u0159ibli\u017en\u011b p\u0159ed rokem jsme v DataLine spustili slu\u017ebu pro vyhled\u00e1v\u00e1n\u00ed a anal\u00fdzu zranitelnost\u00ed v IT aplikac\u00edch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043c\u0435\u0440\u0442\u043d\u044b\u0435 \u0433\u0440\u0435\u0445\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0430\u0439\u0442\u0430: \u0447\u0442\u043e \u043c\u044b \u0443\u0437\u043d\u0430\u043b\u0438 \u0438\u0437 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u0433\u043e\u0434 | ProHoster","og:description":"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0432 DataLine \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0422-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-05T17:42:31+00:00","article:modified_time":"2020-06-05T17:42:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84184","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:03:50","updated":"2022-09-30 12:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=84184"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/84184\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/84185"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=84184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=84184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=84184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}