Amal Mammadov

1. EXERCISE BACKGROUND The vulnerable application pane loads the online shopping application LotsOfGoods.me. It aggregates data from multiple off-line shops and presents it on a single platform. To offer each customer a personalized offer from the shops that are located near them, LotsOfGoods.me prompts its users to specify their location.Alice is a legitimate user of this application. She wants to find a place nearby where she can buy a new laptop. She specifies the city where she rents her apartment….

Read More Read More

There are headers (like Referer and Host) that developers tend to use in the security mechanisms they develop, but it is considered bad practice: data that is passed in those headers is derived from user inputs and shouldn’t, therefore, be trusted.Also, there are headers that are not actually security headers by definition (like Content-Type and X-Content-Type-Options headers), but nevertheless, they play an important role in application security. You should NEVER use the following headers in implementations of security mechanisms: Host…

Read More Read More

1. CSP INTRODUCTION Content-Security-Policy (CSP) is a special HTTP response header that tells the browser what are the safe sources of the content for the page it is going to load.When those safe sources are specified, it prevents the hacker from tricking the browser into loading and running malicious scripts in the user’s browser, injecting iframes with some malicious or unauthorized content, displaying fake images or basically injecting anything from a remote untrusted domain.CSP can also be used to ensure…

Read More Read More

An HTTP cookie is a small piece of data that a server sends to a client. The server sends the cookie using the Set-Cookie header in the response. It looks like that:Set-Cookie: trackingCookie=user1357272User-agent saves a cookie from the response and sends it back in the Cookie request header like that:Cookie: trackingCookie=user1357272Cookies are used for the following purposes:1. Session managementHTTP is a stateless protocol meaning that two requests cannot be correlated to the same source or to each other even if…

Read More Read More

There is a number of HTTP response headers that you should use to increase the security of your web application. They are referred to as HTTP security headers.Once implemented, HTTP security headers restrict modern browsers from running into easily preventable vulnerabilities. They also provide yet another, additional layer of security by helping to mitigate security vulnerabilities and prevent attacks (like XSS, Clickjacking, information leakage, etc.). But it is important to mention that HTTP security headers are not intended to replace…

Read More Read More

Performance Tiers When creating a storage account, you must choose between the Standard and Premium performance tiers. This setting cannot be changed later. Standard This tier supports all storage services: blobs, tables, files, queues, and unmanaged Azure virtual machine disks. It uses magnetic disks to provide cost-efficient and reliable storage. Premium This tier is designed to support workloads with greater demands on I/O and is backed by high performance SSD disks. They only support page blobs, and do not support…

Read More Read More