🪴 Daily gardening

Search

Search IconIcon to open search

서버 개발하며 쉽게 놓치는 취약점 5가지

Last updated Mar 25, 2023

# 1. Injection Attacks

1
2
3
app.get("/user", (req, res) => {
  const id = req.query.id;
  const query = `SELECT * FROM users WHERE id = ${id}`;
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
app.get("/user", (req, res) => {
  const id = req.query.id;
  const query = "SELECT * FROM users WHERE id = ?";
  connection.query(query, [id], (error, results) => {
    if (error) {
      throw error;
    }
    res.send(results);
  });
});

# 2. Cross-Site Scripting (XSS)

1
2
3
4
app.get("/", (req, res) => {
	const name = req.query.name; 
	res.send(`<h1>Hello, ${name}</h1>`); 
});

# 3. Denial-of-Service (DoS)

# 4. Improper Authentication and Authorization

# 5. Insecure Direct Object References

# References