Ayo Secu

HTTP GETThe HTTP GET method is used to retrieve resources from a server. It is the most common HTTP method and is primarily used for sending queries in the form of URL parameters to the server.1. Characteristics of GETPurposeFetch data (read-only operation).Data TransmissionData is appended to the URL as query parameters.Format: ?key1=value1&key2=value2.Visible in URLAll query parameters are vis..

HTTP POSTThe HTTP POST method is used to send data to the server to create or update a resource. It is commonly used in web applications for submitting form data or transmitting large amounts of information securely.1. Characteristics of the POST MethodPurposeTransmits data to the server for processing.Request BodyData is included in the HTTP request body, not in the URL.Not IdempotentMultiple P..

SQL Injection (SQLi)SQL Injection (SQLi) is a web security vulnerability that allows attackers to manipulate an application’s SQL queries by injecting malicious input. This can result in unauthorized access, data leaks, and even complete compromise of the database.1. How SQL Injection Worksa. Vulnerable QueryWhen user input is directly incorporated into an SQL query without proper validation or ..

Cross-Site Scripting (XSS)Cross-Site Scripting (XSS) is a web application vulnerability where attackers inject malicious scripts into web pages viewed by other users. These scripts execute in the victim’s browser, enabling attackers to steal sensitive data, hijack sessions, or perform other malicious actions.1. Types of XSS Attacksa. Reflected XSSDefinition: Malicious scripts are injected into a..

Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) is a web security vulnerability that allows an attacker to trick a user into performing unwanted actions on a trusted website where the user is authenticated. CSRF exploits the trust that a website has in a user’s browser, primarily through the misuse of cookies for authentication.1. How CSRF WorksVictim AuthenticationThe victim ..

CookiesCookies are small pieces of data stored by a web browser on behalf of a website, typically used for session management, user preferences, and tracking. To enhance security, cookies come with attributes that control their behavior and access.1. Key Cookie AttributesAttributePurposeHttpOnlyPrevents client-side JavaScript from accessing the cookie.SecureEnsures the cookie is sent only over H..

HTTP Public Key Pinning (HPKP)HTTP Public Key Pinning (HPKP) was a web security mechanism that allowed website administrators to specify which public keys should be trusted for their domain. It aimed to protect against attacks such as man-in-the-middle (MITM) or rogue certificate issuance by certificate authorities (CAs). However, HPKP has since been deprecated due to implementation challenges a..

Certificate Transparency (CT)Certificate Transparency (CT) is an open framework and security standard designed to detect and prevent the issuance of rogue or misused SSL/TLS certificates by maintaining publicly auditable logs of certificates. It helps ensure the integrity and trustworthiness of the public key infrastructure (PKI).1. Purpose of Certificate TransparencyDetect Misissued Certificate..

HSTS (HTTP Strict Transport Security)HSTS (HTTP Strict Transport Security) is a web security policy mechanism that enforces the use of HTTPS (HTTP Secure) for communication between a browser and a web server. It helps prevent certain attacks, such as man-in-the-middle (MITM) attacks and protocol downgrade attacks, by ensuring that browsers only interact with the website over secure connections.1..

CORS (Cross-Origin Resource Sharing)CORS (Cross-Origin Resource Sharing) is a security mechanism that allows servers to specify which origins are permitted to access their resources. It is implemented through HTTP headers and ensures that only authorized clients from allowed origins can interact with the server.1. Why Is CORS Needed?By default, the Same-Origin Policy (SOP) prevents web browsers ..