Izindlela Zokugenca Zokusebenza Kwewebhu

Izinhlelo zokusebenza zewebhu yizinhlelo ezivumela abasebenzisi ukuthi basebenzisane namaseva wewebhu. Zisebenza kwiziphequluli zewebhu ngosizo lwamaskripthi- kanye nemibhalo eseceleni eseva.

Ukwakhiwa kohlelo lokusebenza lwewebhu kuqukethe:

  • Isendlalelo seklayenti / sephrezentheshini
  • Isendlalelo somqondo webhizinisi
  • Isendlalelo sedatha

Isendlalelo seklayenti / sesethulo siqukethe amadivayisi lapho uhlelo lokusebenza lusebenza khona. Amadivayisi anjalo afaka ama-laptops, amaphilisi, ama-smartphone, njll.


Isendlalelo somqondo webhizinisi sinezendlalelo ezimbili:


  • Isendlalelo se-log-server logic esinezinto eziphatha izicelo nezimpendulo, nokubhalwa kwekhodi okufundayo futhi kubuyisele idatha kusiphequluli



  • Isendlalelo somqondo webhizinisi oqukethe idatha yohlelo lokusebenza

Isendlalelo semininingwane siqukethe ungqimba lwe-B2B kanye neseva yedatha lapho kugcinwa khona imininingwane yenhlangano.



Izinsongo Zokusebenzisa iwebhu nokuhlaselwa

I-OWASP umphakathi ovulekile ozinikele ekwenzeni izinhlangano zikwazi ukukhulelwa, ukuthuthukisa, ukuthola, ukusebenza, kanye nokugcina izinhlelo zokusebenza ezingathenjwa.

Iphrojekthi ye-OWASP Top 10 ikhiqiza idokhumenti echaza izinsongo zokuphepha zohlelo lokusebenza eziyishumi eziphezulu.


Idokhumenti yakamuva ibala izinsongo zokuphepha eziyishumi eziphezulu ezilandelayo:

Ukujova

Ukuhlaselwa ngomjovo ukuhlasela lapho umhlaseli afaka khona idatha enonya emiyalweni nasemibuzweni ebese isetshenziswa kuhlelo.

Lokhu kuhlasela kuhlose izinkambu zokufaka noma amaphuzu wokufaka wohlelo bese kuvumela abahlaseli ukuthi bakhiphe imininingwane ebucayi.

Ukuhlaselwa komjovo okusetshenziswa kakhulu yile:


  • Ukujova kwe-SQL ukuhlasela lapho umhlaseli afaka khona imibuzo enonya ye-SQL kuhlelo lokusebenza
  • Umjovo Wokujova ukuhlasela lapho umhlaseli efaka khona imiyalo enonya kuhlelo lokusebenza
  • Ukujova kwe-LDAP ukuhlasela lapho umhlaseli efaka khona izitatimende ezinonya ze-LDAP kuhlelo lokusebenza

Ubuqiniso obuphukile

Ubuqiniso obuphukile busho izinsongo nobungozi ekuqinisekisweni nasekuphathweni kweseshini.

Abahlaseli basebenzisa lobu bucayi ukuzenza izisulu zabo.

Okunye ukukhubazeka okukhona kufaka:

  • Ama-ID wesikhathi kuma-URL
  • Amaphasiwedi angabhalwanga
  • Setha izikhathi ezingavumelekile

Ukuvezwa kwedatha ebucayi

Izinsongo zokuvezwa kwedatha ezibucayi zenzeka ezinhlelweni ezisebenzisa ikhodi yokubethela ebuthakathaka yokubethela kwedatha nokugcina.


Lokhu kuba sengozini kwenza abahlaseli bakwazi ukuqhekeka kalula ukubethela bese beba idatha.

Ibhizinisi Langaphandle le-XML

Ukuhlaselwa kwebhizinisi langaphandle leXML ukuhlasela lapho umhlaseli esebenzisa ithuba le-XML parser elungiswe kahle elibangela ukuthi uhlelo luhlolisise okokufaka kweXML okuvela kumthombo ongathembekile.

Ukulawulwa Kokufinyelela Okuphukile

Ukulawulwa kokufinyelela okuphukile kusho izinsongo nobungozi ekulawulweni kokufinyelela. Abahlaseli basebenzisa lobu bungozi ukuze bagweme ubuqiniso futhi bathole amalungelo wokuphatha.

Ukulungiswa okungalungile kokuvikela

Ukulungiswa okungalungile kokuphepha kubhekisa ebucayini obukhona ezinhlelweni ezinesitaki sohlelo olungalungiselelwe kahle.


Ezinye zezinkinga ezidala ukuba sengozini kokulungiswa kokungalungiswa kahle zifaka:

  • Izinkambu zokufaka ezingavumelekile
  • Ukukhohlisa kwefomu nepharamitha
  • Ukuphathwa kabi kwephutha

I-Cross-Site Scripting (XSS)

Ukuhlaselwa kwe-Cross-Site Scripting ukuhlasela lapho umhlaseli efaka khona imibhalo emakhasini ewebhu asetshenziswa ohlelweni lwenhloso.

Ukwehliswa kwesithunzi okungavikelekile

Ukwehliswa kwesithunzi okungavikelekile kubhekisa ekubeni sengozini abahlaseli abakusebenzisayo ngokujova ikhodi enonya kudatha eyenziwe nge-serial ethunyelwa kulitshe.

Ngenxa yokuba sengozini kokungabi namandla kwempahla, imininingwane enziwe nge-serial yenziwe yaba yicingo ngaphandle kokuthi kutholakale ikhodi enonya, evumela umhlaseli ukuthi athole ukufinyelela okungagunyaziwe kohlelo.

Kusetshenziswa Izakhi ezinokukhubazeka Okwaziwayo

Ukusebenzisa izinto ezinobungozi obaziwayo kuvumela abahlaseli ukuthi babaxhaphaze futhi benze ukuhlasela.

Ukungena nokuqapha okunganele

Ukungena nokuqapha okunganele kwenzeka lapho uhlelo lokusebenza luhluleka ukungena kwimicimbi enobungozi nemisebenzi. Lokhu kudala ubunzima ekutholeni ukuhlaselwa kohlelo.



Indlela Yokugenca

Indlela Yokugenca Isicelo seWebhu inikeza abahlaseli ngezinyathelo okufanele bazilandele ukuze bahlasele ngempumelelo.

Lezi zinyathelo yilezi:

Ukuqoshwa Kwengqalasizinda Yewebhu

Ingqalasizinda yewebhu yokunyathelisa ngezinyawo isiza umhlaseli ukuqoqa imininingwane mayelana nengqalasizinda yewebhu ekhonjiwe futhi abone ubungozi obungasetshenziswa.

Kule nqubo, umhlaseli wenza:

  • Ukutholakala kweseva ukuze ufunde ngamaseva aphethe uhlelo lokusebenza
  • Ukutholakala kwensizakalo ukuthola ukuthi iyiphi insizakalo engahlaselwa
  • Ukukhonjwa kweseva ukuze ufunde imininingwane ngeseva efana nohlobo nokwenziwa
  • Ukutholwa kokuqukethwe okufihliwe ukuthola okuqukethwe okufihliwe

Ukuhlaselwa kwe-Web server

Imininingwane eqoqwe esinyathelweni sezinyathelo ivumela abaduni ukuba bayihlaziye, bathole ubungozi bokusebenzisa kabi, futhi basebenzise amasu ahlukahlukene ukuqala ukuhlasela kuseva.

Ukuhlaziywa kwesicelo sewebhu

Abahlaseli bahlaziya uhlelo lokusebenza lwe-web lokukhomba ukukhomba ubungozi balo nokulusebenzisa.

Ukugenca uhlelo lokusebenza, abahlaseli kudingeka:

  • Khomba amaphuzu wokufaka wokufaka komsebenzisi
  • Khomba ubuchwepheshe obuseceleni kweseva obusetshenziselwa ukudala amakhasi ewebhu ashukumisayo
  • Khomba ukusebenza kohlangothi lweseva
  • Khomba izindawo zokuhlasela nobungozi obuhambisana nabo

Ukulawulwa Kokulawula Ukulawulwa Kwamakhasimende

Abahlaseli bazama ukudlula ukulawulwa kohlangothi lwamakhasimende kokufaka nokuxhumana komsebenzisi.

Ukudlula izilawuli eziseceleni kwamakhasimende, abahlaseli bazama uku:

  • Ukuhlasela izinkambu zefomu ezifihliwe
  • Hlanganisa izandiso zesiphequluli
  • Buyekeza ikhodi yomthombo

Ukuhlaselwa kobuqiniso

Abahlaseli bazama ukuxhaphaza ubuthakathaka obukhona ezindleleni zokufakazela ubuqiniso.

Ngokusebenzisa ubungozi obunjalo, abahlaseli bayakwazi ukwenza:

  • Ukuqagela kwegama lomsebenzisi
  • Ukuhlaselwa kwephasiwedi
  • Ukuhlaselwa kweseshini
  • Ikhukhi elisebenzayo

Ukuhlaselwa Kokugunyazwa

Ukuhlaselwa kokugunyazwa kungukuhlasela lapho umhlaseli efinyelela khona uhlelo lokusebenza nge-akhawunti esemthethweni enamalungelo alinganiselwe abese esebenzisa leyo akhawunti ukukhulisa amalungelo.

Ukwenza ukuhlaselwa kokugunyazwa, umhlaseli usebenzisa le mithombo elandelayo:

  • INZONDO
  • Ukuphazamiseka kwepharamitha
  • Thumela idatha
  • Izihloko ze-HTTP
  • Amakhukhi
  • Amathegi afihliwe

Ukufinyelela Ukulawulwa Kokuhlasela

Abahlaseli bahlaziya iwebhusayithi eqondiwe ngomzamo wokufunda imininingwane ngokulawulwa kokufinyelela okusetshenzisiwe.

Phakathi nale nqubo, abahlaseli bazama ukufunda ngokuthi ngubani okwazi ukufinyelela kumaphi amasethi wedatha, ukuthi ubani onamazinga okufinyelela, nokuthi angakhuphula kanjani amalungelo.

Ukuhlaselwa Kweseshini

Abahlaseli basebenzisa ukuba sengozini ekuqinisekisweni nasekuphathweni kweseshini ukuzenza izisulu zabo.

Inqubo yokukhiqiza ithokheni evumelekile yeseshini inezinyathelo ezimbili:

  • Ukubikezela kwamathokheni esikhathi
  • Ukuphazamisa amathokheni esikhathi

Ngethokheni evumelekile, abahlaseli bayakwazi ukwenza ukuhlasela okufana neMITM, ukudunwa kweseshini, nokuphindwa kweseshini.

Ukuhlaselwa Komjovo

Abahlaseli basebenzisa okokufaka kwamafomu okungagunyaziwe ukufaka imijovo nemiyalo enonya.

Ukuxhashazwa Kwe-Logic Vulnerability

Amakhono amabi wokufaka amakhodi angenza uhlelo lokusebenza lube sengozini ngenxa yamaphutha alo. Uma umhlaseli ephumelela ekuboneni amaphutha anjalo, bayakwazi ukuwaxhaphaza bese beqala ukuhlasela.

Ukuhlaselwa Kwedathabheyisi

Abahlaseli benza ukuhlaselwa kokuxhumeka kwe-database ukuthola ukulawula i-database futhi ngaleyo ndlela bathole ukufinyelela kulwazi olubucayi.

Ukuhlaselwa Kwemisebenzi Yewebhu

Abahlaseli bakhomba izinsiza zewebhu ezihlanganiswe kuhlelo lokusebenza lewebhu ukuthola nokusebenzisa ubungozi bengqondo yohlelo lokusebenza.

Bese basebenzisa amasu ahlukahlukene ukwenza ukuhlaselwa kwesicelo.