Is worrying about XSS,CSRF,sql injection, cookie stealing enough to cover web-security?

Question

Web applications on uncompromised computers are vulnerable to XSS,CRSF,sql injection attacks and cookie stealing in unsecure wifi environments.

To prevent those security

Answer 1

It definitely is not enough! There are several other security issues you have to keep in mind when developing a web-app. To get an overview you can use the OWASP Top-Ten

I think this is an very interesting post to read when thinking about web-security: What should a developer know before building a public web site? There is a section about security that contains good links for most of the threats you are facing when developing web-apps.

The most important thing to keep in mind when thinking about security is: Never trust user input!

[I am answering to this "old" question because I think it is always an actual topic.]

Answer 2

The easy answer is "No you're not invulnerable - nobody is!"

This is a good start, but there are a few other things you could do. The main one you haven't mentioned is validation of untrusted data against a white-list and this is important as it spans multiple exploits such as both SQLi and XSS. Take a look at OWASP Top 10 for .NET developers part 1: Injection and in particular, the section about "All input must be validated against a whitelist of acceptable value ranges".

Next up, you should apply the principle of least privilege to the accounts connecting to your SQL Server. See the heading under this name in the previous link.

Given you're working with ASP.NET, make sure Request Validation remains on and if you absolutely, positively need to disable it, just do it at a page level. More on this in Request Validation, DotNetNuke and design utopia.

For your output encoding, the main thing is to ensure that you're encoding for the right context. HTML encoding != JavaScript encoding != CSS encoding. More on this in OWASP Top 10 for .NET developers part 2: Cross-Site Scripting (XSS).

For the cookies, make them HTTP only and if possible, only allow them to be served securely (if you're happy to only run over HTTPS). Try putting your web.config through the web.config security analyser which will help point you in the right direction.

Another CSRF defense - albeit one with a usability impact - is CAPTCHA. Obviously you want to use this sparingly but if you've got any really critical functions you want to protect, this puts a pretty swift stop to it. More in OWASP Top 10 for .NET developers part 5: Cross-Site Request Forgery (CSRF).

Other than that, it sounds like you're aware of many of the important principles. It won't make you invulnerable, but it's a good start.

Answer 3

This is the definitive guide to web attacks. Also, I would recommend you use Metasploit against your web app.

Answer 4

Am I now invulnerable to web-based hacking attempts?

Because, no matter how good you are, everyone makes mistakes, the answer is no. You almost certainly forgot to sanitize some input, or use some anti-forgery token. If you haven't now, you or another developer will as your application grows larger.

This is one of the reason we use frameworks - MVC, for example, will automatically generate anti-CSRF tokens, while LINQ-to-SQL (as you mentioned) will sanitize input for the database. So, if you are not already using a framework which makes anti-XSS and anti-CSRF measures the default, you should begin now.

---

Of course, these will protect you against these specific threats, but it's never possible to be secure against all threats. For instance, if you have an insecure SQL-connection password, it's possible that someone will brute-force your DB password and gain access. If you don't keep your versions of .Net/SQL-Server/everything up to date, you could be the victim of online worm (and even if you do, it's still possible to be zero-dayed).

There are even problems you can't solve in software: A script kiddie could DDOS your site. Your server-company could go bankrupt. A shady competitor could simply take a hedge-clippers to your internet line. Your warehouse could burn down. A developer could sell the source-code to a company in Russia.

---

The point is, again, you can't ever be secure against everything - you can only be secure against specific threats.

Answer 5

About what you didn't mention:

You missed a dangerous attack in MVC frameworks: Over Posting Attack

You also missed the most annoying threats: Denial of Service

You also should pay enough attention to file uploads (if any...) and many more...

About what you mentioned:

XSS is really really really waster and more annoying to mitigate. There are several types of encoding including Html Encoding, Javascript Encoding, CSS Encoding, Html Attribute Encoding, Url Encoding, ...

Each of them should be performed to the proper content, in the proper place - i.e. Just doing Html Encoding the content is not enough in all situations.

And the most annoying about XSS, is that there are some situations that you should perform Combinational Encoding(i.e. first JavascriptEncode and then HtmlEncode...!!!)

Take a look at the following link to become more familiar with a nightmare called XSS...!!!

XSS Filter Evasion Cheat Sheet - OWASP