This thesis examines selected vulnerabilities in web application security. For
each vulnerability we provide a theoretical background, a practical demon
stration implemented in the Python Flask framework, and a proposed fix.
The vulnerabilities covered include misuse of the AES-CTR encryption al
gorithm, a hash length extension attack, two vulnerabilities in the JWT
standard, stored cross-site scripting, insecure password storage and a multi
layered man-in-the-middle attack. We find that in most cases the vulnerabil
ities do not stem from weaknesses in cryptographic algorithms themselves,
but from their incorrect implementation. The human factor remains one of
the most difficult security challenges to address.
|
