JSONP - opens up a lot of risks. Recommend not using.
DOM based cross site scripting
Cross domain messaging
Stealing data from web storage
Risks introduced by HTML5 elements and attributes (Video, Auduo, Canvas, Geolocation)
Architectural Flaws, Implementation Bugs
Can run into buffer overflow with unmanaged code in C#.
XSS - JavaScript can be injected by many different tags: video, script, etc. Insert JavaScript into form, URL or submit malformed request straight to server to direct response data to an alternate site to steal data. If can get a user to login to a malicious page can steal credentials and session IDs.
Input encoding - attempts to block certain characters with white lists, black lists, exact match, semantic rules.
Output Encoding - may be preferable to input validation. This tactic allows entering any character but encoding problematic characters so they won't be interpreted as executable code. There are common encoding libraries but some are not suitable for production.
Output encoding should be done for any user or 3rd party input in HTML, CSS, JavaScript, URL, etc.
SQL injection: insert SQL into web inputs to run arbitrary SQL code against web database. First step is to insert a single quote. Is site is vulnerable will throw an error. Check version, etc. To get database type. Then query system tables, columns. Then execute random SQL. Not always that simple but that's the gist of it.
Session Vulnerabilities:
Session Fixation: change session ID after login
Session Prediction
Brute-Forcing
XSS
Eavesdropping: Fireshoot plugin - keep session URLs on SSL.
Cross Site Request Forgery - making a request to another site, which is different than XSS which injects code into a request. Example - loading an image from another site would include information in cookies from the image site which could be used be the site including the image link. So for example, if someone is logged into a site and an email is sent including an image but the image includes a malicious command, the cookies are included when the user views the image and will allow the malicious action to occur. To prevent: #1 have to prevent XSS. #2. Tokens per session, page, form. Not in a cookie, tied to session.
When using an iFrame can set sandbox properties so no code in the iFrame can affect the page embedding the iFrame.
Client side validation can help reduce load on the server but should never be used for validation because client side validation can be bypassed by web site visitors.
TamperData Firefox plug in alters web request submissions.
Set autocomplete = off in input fields.
For Web Storage introduced in HTML5 store sensitive data in session instead of local so is not persisted.
http://www.w3schools.com/html/html5_webstorage.asp
Indirect Reference Map - map fake data to real data and only send fake data to the browser and map it back to the real data for server processing.
LSASS system service runs on Windows. .Net apps can use it to encrypt values and only use the encrypted values in memory.
