<p>Watching SO come online has been quite an education for me.  I'd like to make a checklist of various vunerabilities and exploits used against web sites, and what programming techniques can be used to defend against them.</p>

<ul>
<li>What categories of  vunerabilities?

<ul>
<li>crashing site</li>
<li>breaking into server</li>
<li>breaking into other people's logins</li>
<li>spam</li>
<li><a href="http://en.wikipedia.org/wiki/Internet_sock_puppet" rel="nofollow noreferrer">sockpuppeting</a>, <a href="http://en.wikipedia.org/wiki/Internet_sock_puppet#Meatpuppet" rel="nofollow noreferrer">meatpuppeting</a></li>
<li>etc...</li>
</ul></li>
<li>What kind of defensive programming techniques?</li>
<li>etc...</li>
</ul>

[{'answer_id': 28967, 'author': 'coder1', 'author_id': 3018, 'author_profile': 'https://Stackoverflow.com/users/3018', 'pm_score': 1, 'selected': False, 'text': '<p>SQL injection</p>\n'}, {'answer_id': 28972, 'author': 'Bernie Perez', 'author_id': 1992, 'author_profile': 'https://Stackoverflow.com/users/1992', 'pm_score': 1, 'selected': False, 'text': '<p><a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="nofollow noreferrer">XSS</a> (Cross Site Scripting) Attacks</p>\n'}, {'answer_id': 28978, 'author': 'Ross', 'author_id': 2025, 'author_profile': 'https://Stackoverflow.com/users/2025', 'pm_score': 2, 'selected': False, 'text': '<p>Obviously test every field for vulnerabilities:</p>\n\n<ul>\n<li>SQL - escape strings (e.g. <code>mysql_real_escape_string</code>)</li>\n<li>XSS</li>\n<li>HTML being printed from input fields (a good sign of XSS usually)</li>\n<li>Anything else thatis not the specific purpose that field was created for</li>\n</ul>\n\n<p>Search for infinite loops (the only indirect thing (if a lot of people found it accidentally) that could kill a server really).</p>\n'}, {'answer_id': 29084, 'author': 'Charles Miller', 'author_id': 3052, 'author_profile': 'https://Stackoverflow.com/users/3052', 'pm_score': 5, 'selected': True, 'text': '<p>From the <a href="http://www.owasp.org/" rel="nofollow noreferrer">Open Web Application Security Project</a>:</p>\n\n<ol>\n<li>The <a href="http://www.owasp.org/images/e/e8/OWASP_Top_10_2007.pdf" rel="nofollow noreferrer">OWASP Top Ten</a> vulnerabilities (pdf)</li>\n<li>For a more painfully exhaustive list: <a href="http://www.owasp.org/index.php/Category:Vulnerability" rel="nofollow noreferrer">Category:Vulnerability</a></li>\n</ol>\n\n<p>The top ten are:</p>\n\n<ol>\n<li>Cross-site scripting (XSS)</li>\n<li>Injection flaws (SQL injection, script injection)</li>\n<li>Malicious file execution</li>\n<li>Insecure direct object reference</li>\n<li>Cross-site request forgery (XSRF)</li>\n<li>Information leakage and improper error handling</li>\n<li>Broken authentication and session management</li>\n<li>Insecure cryptographic storage</li>\n<li>Insecure communications</li>\n<li>Failure to restrict URL access</li>\n</ol>\n'}, {'answer_id': 29102, 'author': 'jwarzech', 'author_id': 3111, 'author_profile': 'https://Stackoverflow.com/users/3111', 'pm_score': 1, 'selected': False, 'text': "<p>Easy to oversee and easy to fix: the sanitizing of data received from the client side.  Checking for things such as ';' can help in preventing malicious code being injected into your application.</p>\n"}, {'answer_id': 29163, 'author': 'David Schlosnagle', 'author_id': 1750, 'author_profile': 'https://Stackoverflow.com/users/1750', 'pm_score': 3, 'selected': False, 'text': '<p>I second the OWASP info as being a valuable resource. The following may be of interest as well, notably the attack patterns:</p>\n\n<ul>\n<li><a href="https://www.securecoding.cert.org/confluence/display/seccode/Top+10+Secure+Coding+Practices" rel="nofollow noreferrer">CERT Top 10 Secure Coding Practices</a></li>\n<li><a href="http://capec.mitre.org/about/documents.html" rel="nofollow noreferrer">Common Attack Pattern Enumeration and Classification</a></li>\n<li><a href="http://en.wikipedia.org/wiki/Attack_patterns" rel="nofollow noreferrer">Attack Patterns</a></li>\n<li><a href="http://www.dwheeler.com/secure-programs/" rel="nofollow noreferrer">Secure Programming for Linux and Unix</a></li>\n<li><a href="http://www.fortify.com/vulncat/en/vulncat/index.html" rel="nofollow noreferrer">A Taxonomy of Coding Errors that Affect Security</a></li>\n<li><a href="http://www.infoq.com/presentations/secure-programming-static-analysis" rel="nofollow noreferrer">Secure Programming with Static Analysis Presentation</a></li>\n</ul>\n'}, {'answer_id': 30214, 'author': 'Rob Wells', 'author_id': 2974, 'author_profile': 'https://Stackoverflow.com/users/2974', 'pm_score': 1, 'selected': False, 'text': '<p>G\'day,</p>\n\n<p>A good static analysis tool for security is <a href="http://www.dwheeler.com/flawfinder/" rel="nofollow noreferrer">FlawFinder</a> written by David Wheeler. It does a good job looking for various security exploits,</p>\n\n<p>However, it doesn\'t replace having a knowledgable someone read through your code. As David says on his web page, "A fool with a tool is still a fool!"</p>\n\n<p>HTH.</p>\n\n<p>cheers,\nRob</p>\n'}, {'answer_id': 70390, 'author': 'Zach', 'author_id': 9128, 'author_profile': 'https://Stackoverflow.com/users/9128', 'pm_score': 2, 'selected': False, 'text': "<p>Some prevention techniques:</p>\n\n<p>XSS</p>\n\n<ul>\n<li><p>If you take any parameters/input from the user and ever plan on outputting it, whether in a log or a web page, sanitize it (strip/escape anything resembling HTML, quotes, javascript...) If you print the current URI of a page within itself, sanitize! Even printing PHP_SELF, for example, is unsafe. Sanitize! Reflective XSS comes mostly from unsanitized page parameters.</p></li>\n<li><p>If you take any input from the user and save it or print it, warn them if anything dangerous/invalid is detected and have them re-input. an IDS is good for detection (such as PHPIDS.) Then sanitize before storage/printing. Then when you print something from storage/database, sanitize again!\nInput -> IDS/sanitize -> store -> sanitize -> output</p></li>\n<li><p>use a code scanner during development to help spot potentially vulnerable code.</p></li>\n</ul>\n\n<p>XSRF</p>\n\n<ul>\n<li>Never use GET request for\ndestructive functionality, i.e.\ndeleting a post. Instead, only\naccept POST requests. GET makes it extra easy for hackery.</li>\n<li>Checking the\nreferrer to make sure the request\ncame from your site <strong>does not\nwork</strong>. It's not hard to spoof the\nreferrer.</li>\n<li>Use a random hash as a token that must be present and valid in every request, and that will expire after a while. Print the token in a hidden form field and check it on the server side when the form is posted. Bad guys would have to supply the correct token in order to forge a request, and if they managed to get the real token, it would need to be before it expired.</li>\n</ul>\n\n<p>SQL injection</p>\n\n<ul>\n<li>your ORM  or db abstraction class should have sanitizing methods - use them, always. If you're not using an ORM or db abstraction class... you should be.</li>\n</ul>\n"}, {'answer_id': 70433, 'author': 'Vertigo', 'author_id': 5468, 'author_profile': 'https://Stackoverflow.com/users/5468', 'pm_score': 1, 'selected': False, 'text': '<p>You can get good firefox addons to test multiple flaws and vulnerabilities like xss and sql injections from <a href="http://securitycompass.com/exploitme.shtml" rel="nofollow noreferrer">Security Compass</a>. Too bad they doesn\'t work on firefox 3.0. I hope that those will be updated soon.</p>\n'}]
['https://Stackoverflow.com/questions/28965', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/116/']