Denial of service is when attackers prevent other users from connecting to a web server, usually by overwhelming the server with more requests than the server can handle.
- File upload abuse is when an attacker abuses … public file upload features of a website. … It's common for web applications … to allow users to upload files. … These are a few common examples … when a web application might encourage users … to send in images, video or other files. … There are many ways that file upload features … can be abused. … The most common types of abuse … are uploading files which are too numerous, … too large or too frequent. … Too many files or files which are too large … can use up all of a server's storage space. … Files sent too frequently … can slow down server processing … or monopolize server connections … potentially even leading to a denial of service. … Another potential abuse … is users uploading the wrong content type, … for example, the application expects an image, … but the user uploads a movie instead. … Malware represents the most serious form … of file upload abuse. … Malware may pretend to be a different file type … in order to avoid raising suspicion. …
Author
Kevin Skoglund
Released
5/3/2019- Threat models
- Least privilege
- Defense in depth
- Validating and sanitizing input
- Credential attacks
- SQL injection
- Cross-site scripting
Skill Level Beginner
Duration
Views
-
Introduction
-
1. Security Overview
-
What is security?3m 12s
-
Why security matters2m 14s
-
What is a hacker?4m 10s
-
Threat models3m 14s
-
-
2. General Security Principles
-
Least privilege3m 55s
-
Simple is more secure2m 49s
-
Never trust users3m 15s
-
Expect the unexpected2m 20s
-
Defense in depth3m 58s
-
Security through obscurity4m 30s
-
Deny lists and allow lists3m 14s
-
-
3. Filter Input, Control Output
-
Regulate requests3m 46s
-
Validate input3m 54s
-
Sanitize data6m 29s
-
Label variables1m 22s
-
Keep code private2m 27s
-
Keep credentials private4m 36s
-
Keep error messages vague2m 17s
-
Smart logging3m 18s
-
-
4. The Most Common Attacks
-
Types of credential attacks5m 18s
-
Strong passwords4m 24s
-
SQL injection7m 31s
-
Cross-site scripting (XSS)6m 34s
-
Cookie visibility and theft4m 52s
-
Session hijacking5m 32s
-
Session fixation3m 25s
-
Remote code execution2m 19s
-
File upload abuse3m 13s
-
Denial of service5m 19s
-
-
Conclusion
-
Next steps2m 26s
-
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.
Share this video
Embed this video
Video: File upload abuse