Lecture 2: How Software Breaks (Web)

This lecture discusses how software weaknesses on the Web manifest, the vulnerabilities that lead to these weaknesses being exploited, and how they can be mitigated. The topics examined include the concept of weird machines, how privilege escalation works on the web via injection attacks such as Cross-Site Scripting, and defensive principles and programming techniques that can be used to guard against these injection attacks. Cross Site Request Forgery is given as an example of another type of attack, that is, a web session attack. Finally, two attack proxy tools are introduced; Burp Suite and Zaproxy. These tools are useful in performing web security testing of applications.