CodeSnips

typescript

import express from 'express';
import cookieParser from 'cookie-parser';
import { issueCsrfToken, csrfProtection } from './csrf';
import { transfersRouter } from './routes/transfers';

const app = express();

CSRF protection with double-submit cookie

security express csrf

by codesnips 3 tabs

ruby

require 'sinatra/base'
require 'rack/protection'

class TransferApp < Sinatra::Base
  enable :sessions
  set :session_secret, ENV.fetch('SESSION_SECRET', 'a' * 64)

CSRF Protection for Sinatra Forms with Rack::Protection AuthenticityToken

sinatra rack csrf

by codesnips 3 tabs

plaintext

SecRuleEngine On
SecRequestBodyAccess On
SecResponseBodyAccess Off

SecRule ARGS|REQUEST_HEADERS|XML:/* "@detectSQLi" \
  "id:1001,phase:2,deny,status:403,log,msg:'Potential SQLi detected'"

ModSecurity WAF rules for common web attack patterns

waf modsecurity web-security

by Kai Nakamura 1 tab

bash

#!/usr/bin/env bash
sqlmap \
  -r login-request.txt \
  --risk=2 \
  --level=3 \
  --batch \

sqlmap workflow for approved injection testing

sqlmap pentesting sql-injection

by Kai Nakamura 1 tab

javascript

// 1. DANGEROUS: Never use innerHTML with user input
const userInput = '<img src=x onerror="alert('XSS')">';

// WRONG - vulnerable to XSS
document.getElementById('output').innerHTML = userInput;

Front-end security - XSS and CSRF prevention

security xss csrf

by Alex Chang 1 tab

bash

#!/usr/bin/env bash
docker run --rm -t owasp/zap2docker-stable zap-baseline.py \
  -t https://preview.example.com \
  -r zap-report.html \
  -I

Web application DAST automation with OWASP ZAP baseline scans

dast zap ci

by Kai Nakamura 1 tab