[Owasp-boston] Interesting post - 13 Things a Web Application Attacker Won't Tell You

Paul Schofield Paul.Schofield at imperva.com
Thu Oct 8 11:14:44 EDT 2009

A very fun post came across my desk this morning:

From: http://denimgroup.posterous.com/13-things-a-web-application-attacker-wont-tel

13 Things a Web Application Attacker Won't Tell You

1.    Just because you moved something from being a GET parameter to a POST parameter so I couldn't see it in the URL bar doesn't mean
	 that I don't know it is there.  And it also doesn't mean I can't change it.  (Download WebScarab if you disagree)
2.    Just because you put something in a hidden FORM parameter doesn't mean I can't find it.  Or change it.  See #1.
3.    Ditto for cookies.  See #1.
4.    Validating things on the client side with JavaScript doesn't prevent me from submitting whatever the heck I want.
5.    I love it when you say "That would never happen in production."
6.    I really love it when you say "An attacker would never do that."
7.    I really hate strong server side input validation.
8.    That page with the detailed error message - my job would be way harder without it.
9.    Most of those "Guaranteed Secure!" banners you put on your site only serve to tell me you don't understand the first thing about security.
10.  That web application scanner you ran - it didn't find everything.  Not even close.
11.  That network scanner you ran - it didn't even start testing the security of your application.
12.  I understand AJAX (or fancy, new technology "XYZ") better than you do.
13.  The more clever you think you are - the better I feel.


Paul Schofield
Senior Security Engineer
Imperva, Inc.
Office 603-489-1024
Mobile 603-553-5200
paul.schofield at imperva.com

More information about the Owasp-boston mailing list