to Web Applications: Key Takeaways from Hack The Box Academy

By /

Listen to this Post

Just finished the ” to Web Applications” on Hack The Box Academy.

Key Takeaways:

  • Front-End Security: Learned about HTML Injection, XSS, CSRF. Prevention: input sanitization, CSP, CSRF tokens.
  • Back-End Architecture: Analyzed web servers (Apache, Nginx), databases (SQL/NoSQL), APIs. Found out about command/SQL injection, file upload flaws.
  • OWASP & Public Vulnerabilities: Reviewed CVSS scores (e.g., CVE-2017-0144) and OWASP Top 10.

Earned the “Developer” badge (top 2.16% of 38,806 learners).

You Should Know:

1. Front-End Security:

  • HTML Injection Prevention: 
    <input type="text" name="username" value="<?php echo htmlspecialchars($user_input); ?>">
  • XSS Prevention: 
    function sanitizeInput(input) {
return input.replace(/</g, "<").replace(/>/g, ">");
}
  • CSRF Prevention: 
    session_start();
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

2. Back-End Architecture:

  • Apache Security: 
    sudo nano /etc/apache2/apache2.conf

Add:

<Directory /var/www/html>
Options -Indexes
</Directory>

– Nginx Security:

sudo nano /etc/nginx/nginx.conf

Add:

server {
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
}

– SQL Injection Prevention:

$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $email]);

3. OWASP & Public Vulnerabilities:

  • CVSS Score Calculation: 
    cvss-calculator --vector "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  • OWASP Top 10: 
    owasp-zap -cmd -quickurl http://example.com -quickout report.html

What Undercode Say:

Web application security is a critical aspect of modern IT infrastructure. Understanding both front-end and back-end vulnerabilities is essential for developers and security professionals. Tools like OWASP ZAP and CVSS calculators can help in identifying and mitigating risks. Always ensure to sanitize inputs, use secure headers, and regularly update your systems to protect against emerging threats.

For more detailed guides, visit:

Keep practicing and stay secure!

References:

Reported By: Lixinlovestudy Websecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 TelegramFeatured Image

Related Posts: