Internet Technology (AS21)

A @SpringBootApplication annotation can be used to enable those three features, that is: 

• @EnableAutoConfiguration: enable Spring Boot’s autoconfiguration mechanism.
• @ComponentScan: enable @Component scan on the package where the application is located.
• @Configuration: allow to register extra beans in the context or import additional configuration classes.

• injection means tricking an application into including unintended commands in the data set to an interpreter
• interpreters take strings and interpret them as commands (SQL, os shell, ldap...etc)
• SQL injection is still quite common. many applications still susceptible even though it is usually very simple to avoid
• typical impac is usually severe. entire db can be read or modified. 
• How it works
  1. application presents a form to the attacker
  2. attacker sends an attack in the form data
  3. application forwards attack to the database in a SQL query
  4. database runs query containing attack and sends encrypted results back to application
  5. application decrypts data as normal and sends results to the user

an application is vulnerable to attack when user-supplied data is not validated, filtered, or sanitized by the application and dynamic queries or non-parameterized calls without context-aware escaping are used directly in the interpreter

how to prevent that is to require keeping data separate from commands and queries. the preferred option is to use a safe API /object-relational mapping tool such as jPA. and for any dynamic queries, escape special characters. 

• Http is a "stateless" protocol means credentials have to go with every request and you should use SSL for everything requiring authentication
• session management flaws are SESSION ID used to track state since hTTP doesn't and it is just as good as credentials to attackers. it is typically exposed on the network , browser, logs. 

verify your architecture: 

1. authentication should be simple, centralized, and standarized
2. use the standard session id provided by your container
3. be sure SSL protects both credentials and session id at all times

verify the implementation

1. forget automated analysis approaches
2. check your SSL certificate
3. examine all the authentication-related functions
4. verify that logoff actually destroys the session

XSS occurs any time raw data from attackers is sent to an innocent user's browser. 

Raw data stored in database, reflected from web input, sent directly into rich js client