{"id":84184,"date":"2020-06-05T19:42:31","date_gmt":"2020-06-05T17:42:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god"},"modified":"2020-06-05T19:42:31","modified_gmt":"2020-06-05T17:42:31","slug":"smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","title":{"rendered":"Smrte\u013en\u00e9 hriechy bezpe\u010dnosti webu: \u010do sme sa dozvedeli zo \u0161tatistiky skenera zranite\u013enost\u00ed za rok","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pribli\u017ene pred rokom sme v DataLine spustili slu\u017eba<\/a><\/noindex> slu\u017ebu na vyh\u013ead\u00e1vanie a anal\u00fdzu zranite\u013enost\u00ed v IT aplik\u00e1ci\u00e1ch. V z\u00e1klade slu\u017eby je cloudov\u00e9 rie\u0161enie Qualys, o ktorom sme u\u017e hovorili<\/a><\/noindex>. Po roku pou\u017e\u00edvania tohto rie\u0161enia sme vykonali 291 skenovan\u00ed pre r\u00f4zne webov\u00e9 str\u00e1nky a nas accumulovali \u0161tatistiky o roz\u0161\u00edren\u00fdch zranite\u013enostiach vo webov\u00fdch aplik\u00e1ci\u00e1ch.\u00a0<\/p>\n

V nasleduj\u00facom \u010dl\u00e1nku uk\u00e1\u017eem, ak\u00e9 presne bezpe\u010dnostn\u00e9 diery sa skr\u00fdvaj\u00fa za r\u00f4znymi \u00farov\u0148ami kriti\u010dnosti. Pozrime sa, ak\u00e9 zranite\u013enosti skener nach\u00e1dzal obzvl\u00e1\u0161\u0165 \u010dasto, pre\u010do m\u00f4\u017eu vznikn\u00fa\u0165 a ako sa chr\u00e1ni\u0165.\u00a0<\/p>\n

\"Smrte\u013en\u00e9
\n<\/a><\/noindex>
\nV\u0161etky zranite\u013enosti webov\u00fdch aplik\u00e1ci\u00ed Qualys del\u00ed na tri \u00farovne kriti\u010dnosti: n\u00edzku, stredn\u00fa a vysok\u00fa. Ke\u010f sa pozrieme na rozdelenie pod\u013ea \"z\u00e1va\u017enosti\", zd\u00e1 sa, \u017ee to nie je tak\u00e9 zl\u00e9. Zranite\u013enost\u00ed s vysokou \u00farov\u0148ou kriti\u010dnosti je m\u00e1lo, v\u00e4\u010d\u0161inou s\u00fa v\u0161etky nekritick\u00e9:\u00a0<\/p>\n

\"Smrte\u013en\u00e9
\n
\nAle nekritick\u00e9 neznamen\u00e1 bezv\u00fdznamn\u00e9. M\u00f4\u017eu tie\u017e sp\u00f4sobi\u0165 v\u00e1\u017ene \u0161kody.\u00a0<\/p>\n

Top \u201enekritick\u00fdch\u201c zranite\u013enost\u00ed<\/h2>\n

<\/p>\n

    \n
  1. Zranite\u013enosti s\u00favisiace so zmie\u0161an\u00fdm obsahom.<\/b>\n

    \u0160tandardom bezpe\u010dnosti webov\u00fdch str\u00e1nok je prenos d\u00e1t medzi klientom a serverom prostredn\u00edctvom protokolu HTTPS, ktor\u00fd podporuje \u0161ifrovanie a chr\u00e1ni inform\u00e1cie pred odposluchom.\u00a0<\/p>\n

    Niektor\u00e9 webov\u00e9 str\u00e1nky pou\u017e\u00edvaj\u00fa zmie\u0161an\u00fd obsah<\/i>: pren\u00e1\u0161aj\u00fa \u010das\u0165 d\u00e1t prostredn\u00edctvom nezabezpe\u010den\u00e9ho protokolu HTTP. \u010castej\u0161ie tak pren\u00e1\u0161aj\u00fa pas\u00edvny obsah<\/i> \u2013 inform\u00e1cie, ktor\u00e9 ovplyv\u0148uj\u00fa len zobrazenie str\u00e1nky: obr\u00e1zky, CSS \u0161t\u00fdly. Niekedy v\u0161ak tak pren\u00e1\u0161aj\u00fa aj akt\u00edvny obsah<\/i>: skripty, ktor\u00e9 riadia spr\u00e1vanie str\u00e1nky. V tomto pr\u00edpade je mo\u017en\u00e9 pomocou \u0161peci\u00e1lneho softv\u00e9ru analyzova\u0165 inform\u00e1cie prich\u00e1dzaj\u00face zo servera s akt\u00edvnym obsahom, modifikova\u0165 na mieste svoje odpovede a n\u00fati\u0165 stroj fungova\u0165 tak, ako to nebolo zam\u00fd\u0161\u013ean\u00e9 jeho tvorcami.\u00a0<\/p>\n

    Nov\u00e9 verzie prehliada\u010dov varuj\u00fa pou\u017e\u00edvate\u013eov, \u017ee webov\u00e9 str\u00e1nky so zmie\u0161an\u00fdm obsahom nie s\u00fa bezpe\u010dn\u00e9, a blokuj\u00fa obsah. V\u00fdvoj\u00e1ri str\u00e1nok taktie\u017e dost\u00e1vaj\u00fa upozornenia od prehliada\u010da v konzole. Napr\u00edklad to vyzer\u00e1 takto v Firefox<\/a><\/noindex>:\u00a0<\/p>\n

    \"Smrte\u013en\u00e9
    \n
    \nAk\u00e9 je nebezpe\u010denstvo<\/b>: \u00dato\u010dn\u00edci pou\u017e\u00edvaj\u00fa nezabezpe\u010den\u00fd protokol na odposluch inform\u00e1ci\u00ed o pou\u017e\u00edvate\u013eovi, v\u00fdmenu skriptov a odosielanie po\u017eiadaviek na str\u00e1nku v jeho mene. Dokonca aj ke\u010f n\u00e1v\u0161tevn\u00edk str\u00e1nky nezad\u00e1va \u00fadaje, to ho neochr\u00e1ni pred phishingom <\/i>\u2013 z\u00edskavania d\u00f4vern\u00fdch inform\u00e1ci\u00ed podvodn\u00fdmi met\u00f3dami. Napr\u00edklad pomocou skriptu je mo\u017en\u00e9 presmerova\u0165 pou\u017e\u00edvate\u013ea na nezabezpe\u010den\u00fa str\u00e1nku, ktor\u00e1 sa maskuje ako zn\u00e1m\u00e1 str\u00e1nka. V niektor\u00fdch pr\u00edpadoch m\u00f4\u017ee zlov\u00f4\u013ena str\u00e1nka vyzera\u0165 dokonca lep\u0161ie ako origin\u00e1l a pou\u017e\u00edvate\u013e m\u00f4\u017ee s\u00e1m vyplni\u0165 formul\u00e1r a odovzda\u0165 d\u00f4vern\u00e9 \u00fadaje.\u00a0<\/p>\n

    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Aj ke\u010f administr\u00e1tor str\u00e1nky nain\u0161taloval a nastavil certifik\u00e1t SSL\/TLS, zranite\u013enos\u0165 sa m\u00f4\u017ee objavi\u0165 z d\u00f4vodu \u013eudskej chyby. Napr\u00edklad, ak je na niektorej zo str\u00e1nok pou\u017eit\u00e1 absol\u00fatna, nie relat\u00edvna, linka s http, a e\u0161te k tomu neboli nastaven\u00e9 presmerovania z http na https.\u00a0<\/p>\n

    Zmie\u0161an\u00fd obsah na str\u00e1nke m\u00f4\u017eete zisti\u0165 pomocou prehliada\u010da: preh\u013eadajte zdrojov\u00fd k\u00f3d str\u00e1nky, pre\u010d\u00edtajte si upozornenia v konzole pre v\u00fdvoj\u00e1rov. Av\u0161ak v\u00fdvoj\u00e1r sa bude musie\u0165 dlh\u00e9 hodiny prehrab\u00e1va\u0165 v k\u00f3de. Proces m\u00f4\u017eete ur\u00fdchli\u0165 pomocou automatizovan\u00fdch analytick\u00fdch n\u00e1strojov, napr\u00edklad: SSL Check<\/a><\/noindex>, vo\u013en\u00fd softv\u00e9r Lighthouse alebo platen\u00fd softv\u00e9r Screaming Frog SEO Spider.<\/p>\n

    Zranite\u013enos\u0165 sa m\u00f4\u017ee vyskytn\u00fa\u0165 aj z d\u00f4vodu probl\u00e9mov so star\u00fdm k\u00f3dom \u2013 k\u00f3dom, ktor\u00fd bol zdeden\u00fd. Napr\u00edklad, ak sa niektor\u00e9 str\u00e1nky generuj\u00fa pod\u013ea star\u00e9ho \u0161abl\u00f3nu, kde sa neberie do \u00favahy prechod str\u00e1nok na https.\u00a0\u00a0\u00a0\u00a0\n<\/li>\n

  2. Cookies bez flagov \u201eHTTPOnly\u201c a \u201esecure\u201c.<\/b>\n

    Atrib\u00fat \u201eHTTPOnly\u201c chr\u00e1ni s\u00fabory cookie pred spracovan\u00edm skriptmi, ktor\u00e9 \u00fato\u010dn\u00edci pou\u017e\u00edvaj\u00fa na kr\u00e1de\u017e pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov. Flag \u201esecure\u201c nezapne prenos cookies vo vo\u013enej forme. V\u00fdmena \u00fadajov bude povolen\u00e1 len v pr\u00edpade, \u017ee sa cookies odosielaj\u00fa prostredn\u00edctvom zabezpe\u010den\u00e9ho protokolu HTTPS.\u00a0<\/p>\n

    Oba atrib\u00faty s\u00fa definovan\u00e9 v vlastnostiach cookies:<\/p>\n

    Set-Cookie: Secure; HttpOnly<\/code><\/pre>\n
    \nAk\u00e9 je nebezpe\u010denstvo<\/b>: Ak v\u00fdvoj\u00e1r str\u00e1nky nepou\u017eil tieto atrib\u00faty, \u00fato\u010dn\u00edk m\u00f4\u017ee zachyti\u0165 inform\u00e1cie pou\u017e\u00edvate\u013ea z cookies a vyu\u017ei\u0165 ich. Ak s\u00fa cookies pou\u017eit\u00e9 na autentifik\u00e1ciu a autoriz\u00e1ciu, m\u00f4\u017ee ukradn\u00fa\u0165 rel\u00e1ciu pou\u017e\u00edvate\u013ea a vykon\u00e1va\u0165 akcie na str\u00e1nke jeho menom.\u00a0<\/p>\n
    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Zvy\u010dajne sa v popul\u00e1rnych r\u00e1mcoch tieto atrib\u00faty nastavuj\u00fa automaticky. Ale aj tak skontrolujte konfigur\u00e1ciu webov\u00e9ho servera a nastavte flag: Set-Cookie HttpOnly; Secure. <\/p>\n
    Pri tom atrib\u00fat \u201eHTTPOnly\u201c urob\u00ed cookies nevidite\u013en\u00fdmi aj pre v\u00e1\u0161 vlastn\u00fd JavaScript.\u00a0\u00a0\n<\/li>\n
  3. Path-Based Vulnerabilities (\u201ecestn\u00e9\u201c zranite\u013enosti).<\/b>\n
    Skener hl\u00e1s\u00ed takovou zranitelnost, pokud najde ve\u0159ejn\u011b p\u0159\u00edstupn\u00fd soubor nebo adres\u00e1\u0159 na webu s potenci\u00e1ln\u011b d\u016fv\u011brn\u00fdmi informacemi. Nap\u0159\u00edklad m\u016f\u017ee objevit jednotliv\u00e9 soubory s konfigurac\u00ed syst\u00e9mu nebo p\u0159\u00edstup k cel\u00e9 souborov\u00e9 struktu\u0159e. Tato situace m\u016f\u017ee nastat, pokud jsou na webu nespr\u00e1vn\u011b nastaveny p\u0159\u00edstupov\u00e9 pr\u00e1va.<\/p>\n
    Ak\u00e9 je nebezpe\u010denstvo<\/b>: Pokud je souborov\u00fd syst\u00e9m \"viditeln\u00fd\", \u00fato\u010dn\u00edk se m\u016f\u017ee dostat do rozhran\u00ed opera\u010dn\u00edho syst\u00e9mu a pokusit se naj\u00edt slo\u017eky s hesly, pokud jsou uchov\u00e1v\u00e1ny v nechr\u00e1n\u011bn\u00e9 podob\u011b (ned\u011blejte to!). Nebo m\u016f\u017ee ukr\u00e1st hashe hesel a pokusit se je uh\u00e1dnout, stejn\u011b jako se pokusit zv\u00fd\u0161it svoje opr\u00e1vn\u011bn\u00ed v syst\u00e9mu a postupovat hloub\u011bji do infrastruktury.\u00a0\u00a0<\/p>\n
    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Nezapom\u00ednejte na p\u0159\u00edstupov\u00e1 pr\u00e1va a konfigurovat platformu, webov\u00fd server, webovou aplikaci tak, aby nebylo mo\u017en\u00e9 \"ut\u00e9ct\" z webov\u00e9ho adres\u00e1\u0159e.\n<\/li>\n
  4. Formul\u00e1\u0159e pro vkl\u00e1d\u00e1n\u00ed d\u016fv\u011brn\u00fdch \u00fadaj\u016f s povolenou funkc\u00ed automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed.<\/b>\n
    Pokud u\u017eivatel \u010dasto vypl\u0148uje formul\u00e1\u0159e na webech, jeho prohl\u00ed\u017ee\u010d tuto informaci ukl\u00e1d\u00e1 pomoc\u00ed funkce automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed.\u00a0<\/p>\n
    Formul\u00e1\u0159e na webech mohou obsahovat pole s d\u016fv\u011brn\u00fdmi informacemi, nap\u0159\u00edklad hesla nebo \u010d\u00edsla kreditn\u00edch karet. Pro takov\u00e1 pole je vhodn\u00e9 na webu vypnout funkci automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed formul\u00e1\u0159\u016f.\u00a0<\/p>\n
    Ak\u00e9 je nebezpe\u010denstvo<\/b>: Pokud prohl\u00ed\u017ee\u010d u\u017eivatele ulo\u017e\u00ed d\u016fv\u011brn\u00e9 informace, \u00fato\u010dn\u00edk je m\u016f\u017ee pozd\u011bji zachytit, nap\u0159\u00edklad pomoc\u00ed phishingu. V podstat\u011b webov\u00fd v\u00fdvoj\u00e1\u0159, kter\u00fd na tento aspekt zapomene, vystavuje sv\u00e9 u\u017eivatele riziku.\u00a0<\/p>\n
    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: V tomto p\u0159\u00edpad\u011b m\u00e1me klasick\u00fd konflikt: pohodl\u00ed vs. bezpe\u010dnost. Pokud webov\u00fd v\u00fdvoj\u00e1\u0159 mysl\u00ed na pohodl\u00ed u\u017eivatele, m\u016f\u017ee se rozhodnout pro povolen\u00ed automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed. Nap\u0159\u00edklad pokud je d\u016fle\u017eit\u00e9 dodr\u017eovat Sm\u011brnice pro p\u0159\u00edstupnost webov\u00e9ho obsahu<\/a><\/noindex> \u2013 doporu\u010den\u00ed pro p\u0159\u00edstupnost obsahu pro u\u017eivatele se zdravotn\u00edm posti\u017een\u00edm.\u00a0<\/p>\n
    Ve v\u011bt\u0161in\u011b prohl\u00ed\u017ee\u010d\u016f lze vypnout automatick\u00e9 vypl\u0148ov\u00e1n\u00ed pomoc\u00ed atributu autocompete=\"off\", nap\u0159\u00edklad:<\/p>\n
    \u00a0<body>\n    <form action="\/sk\/form\/submit\/" method="get" autocomplete="off" data-trp-original-action="\/form\/submit">\n      <div>\n        <input type="text" placeholder="First Name">\n      <\/div>\n      <div>\n        <input type="text" id="lname" placeholder="Last Name" autocomplete="on">\n      <\/div>\n      <div>\n        <input type="number" placeholder="\u010císlo kreditnej karty">\n      <\/div>\n      <input type="submit">\n    <input type="hidden" name="trp-form-language" value="sk"\/><\/form>\n  <\/body><\/code><\/pre>\n
    \nAle pro Chrome to nebude fungovat. To se obch\u00e1z\u00ed pomoc\u00ed JavaScriptu, variantu receptu lze naj\u00edt tu<\/a><\/noindex>.\u00a0\n<\/li>\n
  5. V k\u00f3du webu nen\u00ed nastaven hlavi\u010dka X-Frame-Options.\u00a0<\/b>\n
    Tento nadpis ovplyv\u0148uje zna\u010dky frame, iframe, embed alebo object. Pomocou neho m\u00f4\u017eete \u00faplne zak\u00e1za\u0165 vkladanie va\u0161ej str\u00e1nky do r\u00e1m\u010deku. Na to sa nastav\u00ed hodnota X-Frame-Options: deny. Alebo m\u00f4\u017eete nastavi\u0165 X-Frame-Options: sameorigin, vtedy bude vkladanie do iframe pr\u00edstupn\u00e9 iba na va\u0161ej dom\u00e9ne.<\/p>\n
    Ak\u00e9 je nebezpe\u010denstvo<\/b>: Nepresnos\u0165 tohto nadpisu m\u00f4\u017eu zneu\u017e\u00edva\u0165 \u0161kodliv\u00e9 str\u00e1nky na clickjacking.<\/i>Pri tomto \u00fatoku \u00fato\u010dn\u00edk vytvor\u00ed prieh\u013eadn\u00fd r\u00e1m\u010dek nad tla\u010didlami a podv\u00e1dza pou\u017e\u00edvate\u013ea. Napr\u00edklad: podvodn\u00edci vlo\u017eia do r\u00e1m\u010deka na str\u00e1nke soci\u00e1lnych siet\u00ed. Pou\u017e\u00edvate\u013e si mysl\u00ed, \u017ee klik\u00e1 na tla\u010didlo na tejto str\u00e1nke. Namiesto toho kliknutie sa zachyt\u00ed a odo\u0161le po\u017eiadavku pou\u017e\u00edvate\u013ea na soci\u00e1lnu sie\u0165, kde je akt\u00edvna rel\u00e1cia. Takto \u00fato\u010dn\u00edci rozosielaj\u00fa spam v mene pou\u017e\u00edvate\u013ea alebo z\u00edskavaj\u00fa falo\u0161n\u00fdch sledovate\u013eov a lajky.\u00a0<\/p>\n
    Ak sa tak\u00e1to mo\u017enos\u0165 nezak\u00e1\u017ee, \u00fato\u010dn\u00edk m\u00f4\u017ee umiestni\u0165 tla\u010didlo va\u0161ej aplik\u00e1cie na \u0161kodliv\u00fa str\u00e1nku. M\u00e1 z\u00e1ujem o va\u0161u partnersk\u00fa program alebo o va\u0161ich pou\u017e\u00edvate\u013eov.\u00a0\u00a0<\/p>\n
    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Zranite\u013enos\u0165 m\u00f4\u017ee vznikn\u00fa\u0165, ak je X-Frame-Options s konfliktuj\u00facou hodnotou nastaven\u00e1 na webovom serveri alebo vyrovn\u00e1va\u010di z\u00e1\u0165a\u017ee. V tomto pr\u00edpade server a vyrovn\u00e1va\u010d jednoducho prep\u00ed\u0161u nadpis, preto\u017ee maj\u00fa vy\u0161\u0161iu prioritu v porovnan\u00ed s backendov\u00fdm k\u00f3dom.\u00a0\u00a0<\/p>\n
    Hodnoty deny a sameorigin nadpisu X-Frame-Options bud\u00fa prek\u00e1\u017ea\u0165 fungovaniu webov\u00e9ho vizora Yandexu. Aby ste umo\u017enili pou\u017e\u00edvanie iframe pre webov\u00fd vizor, mus\u00edte nap\u00edsa\u0165 v nastaveniach samostatn\u00e9 pravidlo. Napr\u00edklad pre nginx m\u00f4\u017eete nastavi\u0165 nasledovne:<\/p>\n
    http{\n...\n map $http_referer $frame_options {\n \"~webvisor.com\" \"ALLOW-FROM http:\/\/webvisor.com\";\n default \"SAMEORIGIN\";\n }\n add_header X-Frame-Options $frame_options;\n...\n}\n\n<\/code><\/pre>\n
    \n<\/li>\n
  6. Zranite\u013enosti PRSSI (Path-relative stylesheet import).\u00a0\u00a0<\/b>\n
    Toto je zranite\u013enos\u0165 v \u0161t\u00fdloch str\u00e1nky. Vznik\u00e1, ke\u010f sa na pr\u00edstup k s\u00faborom \u0161t\u00fdlov pou\u017e\u00edvaj\u00fa relat\u00edvne odkazy vo forme href=\"\/somefolder\/styles.css\/\". \u00dato\u010dn\u00edk to vyu\u017eije, ak n\u00e1jde sp\u00f4sob, ako previes\u0165 pou\u017e\u00edvate\u013ea na \u0161kodliv\u00fa str\u00e1nku. Str\u00e1nka vlo\u017e\u00ed relat\u00edvny odkaz do svojho URL a imituje pr\u00edstup k \u0161t\u00fdlom. Vznikne po\u017eiadavka akoby badsite.ru\/...\/somefolder\/styles.css\/, ktor\u00e1 pod z\u00e1mienkou \u0161t\u00fdlu m\u00f4\u017ee vykon\u00e1va\u0165 \u0161kodliv\u00e9 akcie.\u00a0<\/p>\n
    Ak\u00e9 je nebezpe\u010denstvo<\/b>: Podvodn\u00edk m\u00f4\u017ee vyu\u017ei\u0165 t\u00fato zranite\u013enos\u0165, ak n\u00e1jde \u010fal\u0161iu dieru v zabezpe\u010den\u00ed. V d\u00f4sledku toho m\u00f4\u017ee ukradn\u00fa\u0165 pou\u017e\u00edvate\u013esk\u00e9 \u00fadaje z cookies alebo tokeny.<\/p>\n
    Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Nastavte hlavi\u010dku X-Content-Type-Options: nosniff. V takom pr\u00edpade prehliada\u010d skontroluje typ obsahu pre \u0161t\u00fdly. Ak sa typ l\u00ed\u0161i od text\/css, prehliada\u010d zablokuje po\u017eiadavku.\n<\/li>\n<\/ol>\n
    <\/p>\n
    Kritick\u00e9 zranite\u013enosti<\/h2>\n
    <\/p>\n
      \n
    1. Str\u00e1nka s po\u013eom pre heslo je doru\u010den\u00e1 zo servera cez nezabezpe\u010den\u00fd kan\u00e1l (HTML form containing password field(s) is served over HTTP).<\/b>\n
      Odpove\u010f od servera cez ne\u0161ifrovan\u00fd kan\u00e1l je zranite\u013en\u00e1 vo\u010di \u00fatokom typu \u00abMan in the middle\u00bb. \u00dato\u010dn\u00edk m\u00f4\u017ee zachyti\u0165 prev\u00e1dzku a vklini\u0165 sa medzi klienta a server, ke\u010f str\u00e1nka ide od servera k klientovi.\u00a0<\/p>\n
      Ak\u00e9 je nebezpe\u010denstvo<\/b>: Podvodn\u00edk m\u00f4\u017ee zameni\u0165 str\u00e1nku a posla\u0165 pou\u017e\u00edvate\u013eovi formul\u00e1r na d\u00f4vern\u00e9 \u00fadaje, ktor\u00e9 od\u00eddu na server \u00fato\u010dn\u00edka.\u00a0<\/p>\n
      Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Niektor\u00e9 str\u00e1nky namiesto hesla posielaj\u00fa pou\u017e\u00edvate\u013eom jednorazov\u00fd k\u00f3d na e-mail\/telef\u00f3n. V tomto pr\u00edpade nie je zranite\u013enos\u0165 tak\u00e1 kritick\u00e1, ale mechanizmus zkomplikuje \u017eivot pou\u017e\u00edvate\u013eom.\n<\/li>\n
    2. Odosielanie formul\u00e1ra s prihlasovac\u00edm menom a heslom cez nezabezpe\u010den\u00fd kan\u00e1l (Login Form Is Not Submitted Via HTTPS).<\/b>\n
      V tomto pr\u00edpade sa od pou\u017e\u00edvate\u013ea na server cez ne\u0161ifrovan\u00fd kan\u00e1l odosiela formul\u00e1r s prihlasovac\u00edm menom a heslom.<\/p>\n
      Ak\u00e9 je nebezpe\u010denstvo<\/b>: Na rozdiel od predch\u00e1dzaj\u00faceho pr\u00edpadu, toto u\u017e je kritick\u00e1 zranite\u013enos\u0165. Z\u00edska\u0165 citliv\u00e9 \u00fadaje je jednoduch\u0161ie, preto\u017ee ani nie je potrebn\u00e9 na to p\u00edsa\u0165 k\u00f3d.\u00a0\n<\/li>\n
    3. Pou\u017e\u00edvanie kni\u017en\u00edc JavaScript s zn\u00e1mymi zranite\u013enos\u0165ami.<\/b>\n
      Po\u010das skenovania sa najpou\u017e\u00edvanej\u0161ou kni\u017enicou stal jQuery s rozsiahlym spektrom verzi\u00ed. V ka\u017edej z verzi\u00ed existuje aspo\u0148 jedna, ak nie viac zn\u00e1mych zranite\u013enost\u00ed. Dopad m\u00f4\u017ee by\u0165 r\u00f4zny \u2013 z\u00e1vis\u00ed od povahy zranite\u013enosti.<\/p>\n
      Ak\u00e9 je nebezpe\u010denstvo<\/b>: Pre zn\u00e1me zranite\u013enosti existuj\u00fa exploit-y, napr\u00edklad tak\u00e9to:<\/p>\n
      \"Smrte\u013en\u00e9
      \n
      \nNa \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Pravidelne sa vracajte k cyklu: h\u013eadanie zn\u00e1mych zranite\u013enost\u00ed \u2013 odstra\u0148ovanie \u2013 kontrola. Ak vedome pou\u017e\u00edvate zastaran\u00e9 kni\u017enice, napr\u00edklad na podporu star\u00fdch prehliada\u010dov alebo na \u0161etrenie rozpo\u010dtu, h\u013eadajte mo\u017enosti, ako odstr\u00e1ni\u0165 zn\u00e1mu zranite\u013enos\u0165.\u00a0\n<\/li>\n
    4. Medzistr\u00e1nkov\u00e9 skripty (XSS).\u00a0<\/b>
      \nCross-Site Scripting (XSS), alebo medziwebov\u00e9 skripty, s\u00fa \u00fatoky na webov\u00fa aplik\u00e1ciu, pri ktor\u00fdch sa do datab\u00e1zy dost\u00e1vaj\u00fa \u0161kodliv\u00e9 k\u00f3dy. Ak n\u00e1jde Qualys tak\u00fa zranite\u013enos\u0165, znamen\u00e1 to, \u017ee potenci\u00e1lny \u00fato\u010dn\u00edk m\u00f4\u017ee do k\u00f3du webu nasadi\u0165 svoj js skript a vykon\u00e1va\u0165 \u0161kodliv\u00e9 akcie.<\/p>\n
      Ulo\u017een\u00e9 XSS (Stored XSS)<\/b> s\u00fa nebezpe\u010dnej\u0161ie, preto\u017ee skript sa nasadzuje na serveri a vykon\u00e1va sa v\u017edy pri otvoren\u00ed napadnutej str\u00e1nky v prehliada\u010di.<\/p>\n
      Odrazen\u00e9 XSS (Reflected XSS)<\/b> sa jednoduch\u0161ie vykon\u00e1vaj\u00fa, preto\u017ee zlovestn\u00fd skript mo\u017eno nasadi\u0165 do HTTP po\u017eiadavky. Aplik\u00e1cia dostane HTTP po\u017eiadavku, neover\u00ed \u00fadaje, zabal\u00ed ich a okam\u017eite odo\u0161le. Ak \u00fato\u010dn\u00edk zachyt\u00ed prenos a vlo\u017e\u00ed skript vo forme <\/p>\n
      <script>\/*+\u0447\u0442\u043e+\u0442\u043e+\u043f\u043b\u043e\u0445\u043e\u0435+*\/<\/script> <\/code><\/pre>\n
      \n, potom od klienta p\u00f4jde \u0161kodliv\u00e1 po\u017eiadavka.<\/p>\n
      Jasn\u00fd pr\u00edklad XSS: js sniffery, ktor\u00e9 imituj\u00fa str\u00e1nky na zad\u00e1vanie CVC, d\u00e1tumu expir\u00e1cie karty a podobne.\u00a0<\/p>\n
      Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: V hlavi\u010dke Content-Security-Policy pou\u017e\u00edvajte atrib\u00fat script-src, aby prehliada\u010d klienta na\u010d\u00edtal a vykon\u00e1val iba k\u00f3d z d\u00f4veryhodn\u00e9ho zdroja. Napr\u00edklad, script-src 'self' prid\u00e1va do bieleho zoznamu v\u0161etky skripty iba z na\u0161ej str\u00e1nky.\u00a0
      \nNajlep\u0161ou praxou je Inline k\u00f3d: povolte iba inline javascript s hodnotou unsafe-inline. Tak\u00e1to hodnota povo\u013euje pou\u017e\u00edvanie inline js\/css, ale nezakazuje pripojenie js s\u00faborov. V kombin\u00e1cii so script-src 'self' zakazujeme vykon\u00e1va\u0165 extern\u00e9 skripty.<\/p>\n
      Ur\u010dite logujte v\u0161etko pomocou report-uri a sledujte pokusy o nasadenie na str\u00e1nku.\n<\/li>\n
    5. SQL injekcie.<\/b>
      \nZranite\u013enos\u0165 ozna\u010duje mo\u017enos\u0165 nasadenia SQL k\u00f3du na str\u00e1nku, ktor\u00fd priamo pristupuje k datab\u00e1ze str\u00e1nky. SQL injekcia je mo\u017en\u00e1, ak \u00fadaje od pou\u017e\u00edvate\u013ea nie s\u00fa escapovan\u00e9: nie s\u00fa overen\u00e9 na spr\u00e1vnos\u0165 a s\u00fa okam\u017eite pou\u017eit\u00e9 v po\u017eiadavke. Napr\u00edklad sa to stane, ak forma na str\u00e1nke neoveruje zhodu vstupu s typom \u00fadajov.\u00a0<\/p>\n
      Ak\u00e9 je nebezpe\u010denstvo<\/b>: Ak \u00fato\u010dn\u00edk zad\u00e1 do takejto formy SQL po\u017eiadavku, m\u00f4\u017ee zni\u010di\u0165 datab\u00e1zu alebo z\u00edska\u0165 d\u00f4vern\u00e9 inform\u00e1cie.\u00a0<\/p>\n
      Na \u010do si m\u00e1 pam\u00e4ta\u0165 webov\u00fd v\u00fdvoj\u00e1r<\/b>: Ned\u00f4verujte tomu, \u010do prich\u00e1dza z prehliada\u010da. Ochrana je potrebn\u00e1 ako na strane klienta, tak aj na strane servera.\u00a0<\/p>\n
      Na strane klienta nap\u00ed\u0161te kontrolu pol\u00ed pomocou JavaScriptu.\u00a0<\/p>\n
      Integrovan\u00e9 funkcie v popul\u00e1rnych r\u00e1mcoch tie\u017e pom\u00e1haj\u00fa escapova\u0165 podozriv\u00e9 znaky na serveri. Na serveri sa tie\u017e odpor\u00fa\u010da pou\u017e\u00edva\u0165 parametrizovan\u00e9 dotazy k datab\u00e1zam.<\/p>\n
      Ur\u010dte, kde presne prebieha interakcia s datab\u00e1zou vo webovej aplik\u00e1cii.\u00a0<\/p>\n
      Interakcia nast\u00e1va, ke\u010f z\u00edskavame nejak\u00e9 inform\u00e1cie: dotaz s id (zmene id), vytvorenie nov\u00e9ho pou\u017e\u00edvate\u013ea, nov\u00fd koment\u00e1r, \u2013 nov\u00e9 z\u00e1znamy v datab\u00e1ze. Tu m\u00f4\u017eu vznikn\u00fa\u0165 sql injekcie. Aj ke\u010f z datab\u00e1zy odstra\u0148ujeme z\u00e1znam, je mo\u017en\u00e1 sql injekcia.\n<\/li>\n<\/ol>\n
      <\/p>\n
      V\u0161eobecn\u00e9 odpor\u00fa\u010dania<\/h2>\n
      \nNevym\u00fd\u0161\u013eajte kolo \u2013 pou\u017e\u00edvajte overen\u00e9 r\u00e1mce.<\/b>. Zvy\u010dajne s\u00fa popul\u00e1rne r\u00e1mce bezpe\u010dnej\u0161ie. Pre .NET je to ASP.NET MVC a ASP.NET Core, pre Python \u2013 Django alebo Flask, pre Ruby \u2013 Ruby on Rails, pre PHP \u2013 Symfony, Laravel, Yii, pre JavaScript \u2013 Node.JS - Express.js, pre Java \u2013 Spring MVC.<\/p>\n
      Sledujte aktualiz\u00e1cie od dod\u00e1vate\u013ea a pravidelne ich aktualizujte.<\/b>. Zranite\u013enos\u0165 objavia, potom nap\u00ed\u0161u exploit, zverejnia ho verejne a v\u0161etko sa op\u00e4\u0165 opakuje. Prihl\u00e1ste sa na odber aktualiz\u00e1ci\u00ed stabiln\u00fdch verzi\u00ed od dod\u00e1vate\u013ea softv\u00e9ru.<\/p>\n
      Kontrolujte pr\u00edstupov\u00e9 pr\u00e1va.<\/b>. Z poh\u013eadu servera sa v\u017edy pozerajte na v\u00e1\u0161 k\u00f3d tak, akoby ho cel\u00fd, od prvej po posledn\u00fa p\u00edsmeno, nap\u00edsal v\u00e1\u0161 najnen\u00e1videnej\u0161\u00ed nepriate\u013e, ktor\u00fd chce zlomi\u0165 va\u0161u str\u00e1nku a naru\u0161i\u0165 integritu va\u0161ich d\u00e1t. O to viac, \u017ee niekedy je to naozaj tak.<\/p>\n
      Pou\u017e\u00edvajte k\u00f3pie, testovacie prostredia, a potom u\u017e nasadzujte na produkciu.<\/b>. To pom\u00f4\u017ee, po prv\u00e9, vyhn\u00fa\u0165 sa chyb\u00e1m a nedostatkom v produkt\u00edvnom prostred\u00ed: produkt\u00edvne prostredie prin\u00e1\u0161a peniaze, prestoje produkt\u00edvneho prostredia s\u00fa kritick\u00e9. Pri prid\u00e1van\u00ed, oprav\u00e1ch alebo uzatv\u00e1ran\u00ed ak\u00fdchko\u013evek probl\u00e9mov je vhodn\u00e9 vykon\u00e1va\u0165 pr\u00e1ce v testovacom prostred\u00ed, potom skontrolova\u0165 funk\u010dnos\u0165 a n\u00e1jden\u00e9 zranite\u013enosti, a a\u017e potom pl\u00e1nova\u0165 pr\u00e1ce s produkt\u00edvnym prostred\u00edm.\u00a0<\/p>\n
      Chr\u00e1\u0148te webov\u00fa aplik\u00e1ciu pomocou Web Application Firewall<\/a><\/noindex> a integrujte s n\u00edm spr\u00e1vy od skenera zranite\u013enost\u00ed<\/b>. Napr\u00edklad v DataLine sa ako spojenie slu\u017eieb pou\u017e\u00edvaj\u00fa Qualys a FortiWeb.
      \n
      Zdroj:       habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
      \u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0432 DataLine \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0422-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u0430 \u2013 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 Qualys, \u043f\u0440\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043c\u044b \u0443\u0436\u0435 \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438. \u0417\u0430 \u0433\u043e\u0434 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0440\u0435\u0448\u0435\u043d\u0438\u0435\u043c \u043c\u044b \u043f\u0440\u043e\u0432\u0435\u043b\u0438 291 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0438 \u043d\u0430\u043a\u043e\u043f\u0438\u043b\u0438 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0443 \u043f\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0432 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445.\u00a0 \u0412 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0438\u0436\u0435 \u044f \u043f\u043e\u043a\u0430\u0436\u0443, \u043a\u0430\u043a\u0438\u0435 \u0438\u043c\u0435\u043d\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":84185,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-84184","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Smrte\u013en\u00e9 hriechy bezpe\u010dnosti webu: \u010do sme sa nau\u010dili zo \u0161tatistiky skenera zranite\u013enost\u00ed za rok | ProHoster","description":"Pribli\u017ene pred rokom sme v DataLine spustili slu\u017ebu pre vyh\u013ead\u00e1vanie a anal\u00fdzu zranite\u013enost\u00ed v IT aplik\u00e1ci\u00e1ch.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043c\u0435\u0440\u0442\u043d\u044b\u0435 \u0433\u0440\u0435\u0445\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0430\u0439\u0442\u0430: \u0447\u0442\u043e \u043c\u044b \u0443\u0437\u043d\u0430\u043b\u0438 \u0438\u0437 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0441\u043a\u0430\u043d\u0435\u0440\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u0433\u043e\u0434 | ProHoster","og:description":"\u041f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434 \u043c\u044b \u0432 DataLine \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0441\u0435\u0440\u0432\u0438\u0441 \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0422-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/smertnye-grehi-bezopasnosti-sajta-chto-my-uznali-iz-statistiki-skanera-uyazvimostej-za-god","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-05T17:42:31+00:00","article:modified_time":"2020-06-05T17:42:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84184","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:03:50","updated":"2022-09-30 12:56:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84184","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=84184"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/84184\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/84185"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=84184"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=84184"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=84184"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}