Lesson 8 — Intermediate

Web Security (SQL Injection, XSS, OWASP Top 10)

Har website ka attack surface hai — login, search box, payment, API. Is lesson mein hum OWASP Top 10 dekhenge, phir do sabse famous flaws (SQL injection aur XSS) ka mechanism aur unka defense samjhenge. Focus hai DEVELOPER par — kaunsa code safe banata hai.

⏱ 16 min• Intermediate• Network Security

Web security kya hai

WHAT

Web security = web applications (site, login, payment) ko vulnerabilities se bachana. OWASP iska standard guide deta hai — Top 10 sabse important flaw ki list hai.

WHEN

Jab bhi app banate ho, deploy karte ho, ya koi third-party app use karte ho — input validation, auth, encryption sab applicable hain.

WHERE

Yaad rakho: Web flaws application layer ke hain. Firewall/antivirus network pe kaam karta hai — isliye app ka apna defense (code level) zaroori hai.

Client side: browser aur JavaScript — user ke device pe chalta hai (XSS yahin ghusta hai).
Server side: backend + database — jahan asli data rehta hai (SQLi ka target).
APIs: app-to-app calls — aaj ka sabse bada aur tez badhta attack surface.
Access layer: kaun user kis data tak pahunch sakta hai (OWASP A01 isi liye top par).

OWASP Top 10 (2021) — industry standard

OWASP Top 10 (2021):
A01 Broken Access Control : doosra user tumhara data dekh le (IDOR)
A02 Cryptographic Failures : data bina encryption / weak crypto
A03 Injection              : input jo query/command ban jaaye
A04 Insecure Design        : design mein hi security gap
A05 Security Misconfig     : default password, open cloud bucket
A06 Vulnerable Components  : purana library/framework (patch pending)
A07 Identification Failures: kamzor auth, brute force, no MFA
A08 Software Integrity      : unsigned update, CI/CD tamper
A09 Logging & Monitoring    : attack ka koi record hi nahi
A10 SSRF                   : server se internal system ko force karwaana

Interview tip : A01 ka naam yaad rakho — poochha jaata hai
                "OWASP ka #1 kaunsa?" -> Broken Access Control

Pehle versions mein "Injection" #1 tha — 2021 mein A01 Broken Access Control upar aaya. Matlab duniya mein sabse zyada galtiyan ab access control ki hain: koi aur user ka data dekh leta hai.

SQL Injection — mechanism aur defense

Mechanism samjho: jab app user input ko query ka hissa bana ke seedha database ko bhejti hai, toh user input query ka structure badal sakta hai. Database ko laga ki ye toh command hai — aur galat kaam ho gaya:

Mechanism (concept — padhne ke liye):
  App ne input ko query mein directly joda
  Agar input query ke structure ko badal de
  -> database wo bhi execute kar leta hai
  Result : data leak, login bypass, deletion tak

DEFENSE (developer ke liye — asli kaam yahi hai):
  1. Parameterized queries / Prepared statements
     -> input hamesha DATA rahega, code kabhi nahi
  2. Input validation (allow-list — sirf jo chahiye wahi)
  3. Output encoding (context ke hisaab se)
  4. DB account = least privilege (sirf zaruri access)
  5. Generic error messages (detail error mat dikhao)
  6. WAF (Web Application Firewall) extra layer

Exam line: SQL injection ka sabse best defense = parameterized queries (prepared statements). Captcha/WAF extra hain — asli fix code mein hai, input ko query se alag rakhna hai.

XSS (Cross-Site Scripting) — mechanism aur defense

XSS concept:
  Attacker app ke page pe apna SCRIPT inject karwa deta hai
  Jab doosra user page dekhta hai -> script USKE browser mein chalta hai
  -> session/cookie, page content, actions chura sakta hai

Types:
  Reflected : script URL/response mein turant reflect hota hai
  Stored    : script database mein save (har viewer ko dikhta hai)
  DOM-based : client-side JS ka logic bigadta hai

DEFENSE:
  Output encoding (HTML/JS context ke hisaab se)
  Input sanitize (allow-list, sahi chars)
  Content Security Policy (CSP) headers
  HttpOnly + Secure cookies (JS na chhu sake)
  Modern frameworks (React/Vue) default escaping karte hain

Desi example: ek chhote e-commerce ke product review box mein agar har likha hua text page pe seedha render ho jaaye (bina encode), toh koi bhi review-wala visitor ka session chori ho sakta tha. Output encoding lagate hi flaw khatam.

Common confusion: Firewall/antivirus XSS nahi rokte — ye app-layer ka kaam hai (encoding, CSP). Aur "HTTPS hai isliye safe" bhi galat hai — XSS aur access control flaws HTTPS ke baad bhi rehte hain.

Exercise

Question: OWASP 2021 list mein Injection ka kaunsa number hai? (a03/01/02)

Question: SQL injection se bachne ka sabse best tareeka kya hai — parameterized queries ya captcha? (sirf ek)

Question: XSS ka full form kya hai? (do words)

Common mistakes

Sirf input validation ko kaafi samajhna: Validation zaroori hai par har jagah kaafi nahi — output encoding bhi chahiye. Dono saath mein layer banate hain.
Firewall/antivirus se XSS ruk jaayega sochna: XSS web app ke andar ka issue hai. Firewall network pe rokta hai, app ka apna encoding/CSP chahiye.
HTTPS = poora safe samajhna: HTTPS transport encrypt karta hai — par SQLi, XSS, IDOR jaise app flaws phir bhi rehte hain. Layer samjho.

Desi example: Kirana store ka order portal

Chhote store ke portal mein order search box seedha query banata tha. Developer ne parameterized queries + output encoding lagayi — ab input kabhi query ka hissa nahi banta:

Pehle : input -> query mein direct joda (risk)
Baad  : input -> parameterized query (data hi rahega)
+      : output pe encoding + CSP header
Result : OWASP A03 se direct protection

Exam mapping (TCS / CEH / Placement)

TCS/Infosys interview: "SQL injection kya hai aur defense?" — sabse poochha gaya sawaal.
CEH/Web security rounds: OWASP Top 10 naam ratne padte hain.
CUET: XSS ka full form + injection concept.
Trap: "WAF is the fix for SQLi" — WAF layer hai, asli fix parameterized queries hain.

Lesson complete?

Web security clear. Agla lesson — Authentication & Access Control — mein dekhenge MFA, passwords aur permissions ka sahi design.