OWASP TOP 10
ﻩدﺁﯼﺮﻳﺬﭘ
ﺐﻴﺳﻢﻬﻣﯽﺘﻴﻨﻣامﺮﻧبو
ﺖﺤﺗ
ﯼﺎهراﺰﻓا
ﻦﻴﻤﺟﺮﺘﻣ
:
يﻮﺳﻮﻣ
اﺮﺘﻴﻣ
ﺎﺘﻴﻫﺎﻧآ يﺮﻫﺎﻃ
سﺎﭙﺳ
ﺎﺑزا
:
يدﻻﻮﻓ
،
CISSP
ﮓﻧﺮﻬﺑ
2007 UPDATE
© 2002-2007 OWASP Foundation
This document is licensed under the Creative Commons Attribution-ShareAlike 2.5license
ﺐﻟﺎﻄﻣ
ﺖﺳﺮﻬﻓ
ﺐﻟﺎﻄﻣ
ﺖﺳﺮﻬﻓ
..................................................................................................................................................................2
ﻪﻣﺪﻘﻣ
.................................................................................................................................................................................3
ﻪﺻﻼﺧ
...............................................................................................................................................................................5
ﻲﺳﺎﻨﺷ
شور
.....................................................................................................................................................................6
ياﺮﺟا ﺘﻳﺎﺳ
ﻦﻴﺑ
ﺖﭙﻳﺮﻜﺳاﻲ
-
A
1
- Cross Site Scripting (Xss)
..............................................................................10
ﻲﻘﻳرﺰﺗ
يﺎﻫ
ﻒﻌﺿ
-
A
2
- Injection Flows
...............................................................................................................14
بﺮﺨﻣ
ﻞﻳﺎﻓ
ياﺮﺟا
-
A
3
- Malicious File Execution
.............................................................................................18
عﺎﺟراﻦﻣاﺎﻧﻪﺑ
ﻢﻴﻘﺘﺴﻣ
ﻲﺷ
–
A
4
- Insecure Direct Object Reference
.................................................................22
ﻲﺘﻳﺎﺳ
ﻦﻴﺑ
ﺖﺳاﻮﺧرد
ﻞﻌﺟ
-
A
5
- Cross Site Request Forgery (CSRF)
............................................................26
ﺖﺳردﺎﻧ
يﺎﻄﺧ
ﺖﻳﺮﻳﺪﻣ
و
تﺎﻋﻼﻃا
ﺖﺸﻧ
-
A
6
- Information Leakage and Improper Error Handling
......30
ﺺﻗﺎﻧ
ﺖﺴﺸﻧ
ﺖﻳﺮﻳﺪﻣ
و
ﺖﻳﻮﻫ
زاﺮﺣا
-
A
7
- Broken Authentication and Session Management
.................32
يرﺎﮕﻧﺰﻣر
هﺪﺸﻧ
ﺖﻈﻓﺎﺤﻣ
هرﺎﺒﻧا
-
A
8
– Insecure Cryptographic Storage
.............................................................37
ﻃﺎﺒﺗراتﺎ ﻦﻣاﺎﻧ
–
A
9
– Insecure Communication
..................................................................................................40
ﻪﺑ
ﻲﺳﺮﺘﺳد
ندﺮﻛ
دوﺪﺤﻣ
رد
ﻲﻫﺎﺗﻮﻛ
URL
-
A
10
– Failure to Restrict URL Access
........................................43
ﻲﻳﺎﻬﻧ
ﺪﺼﻘﻣ
......................................................................................................................................................................46
ﻊﺑﺎﻨﻣ
.................................................................................................................................................................................49
ﻪﻣﺪﻘﻣ
ﻪﺑ
OWASP Top 10
ﺪﻳﺪﻣآ
شﻮﺧ
!
ﻪﺨﺴﻧ
ﻦﻳا
ﻲﻠﻛ
رﻮﻃ
ﻪﺑ،هﺪﺷ
ﻲﺴﻳﻮﻧزﺎﺑ
ﻦﻳﺮﺗ
ﻢﻬﻣيﺎﻫ
يﺮﻳﺬﭘ
ﺐﻴﺳآ راﺰﻓا
مﺮﻧﺖـﺤﺗ
يﺎﻫ
ر
بواﺖﺳﺮﻬﻓ
هدﺮﻛ
ﺖﻇﺎﻔﺣ
ﻲﮕﻧﻮﮕﭼ
هرﺎﺑرد
وزاﻲﻌﺑﺎﻨﻣ
و
ﺪﻨﻛ
ﻲﻣ
ﺚﺤﺑ
ﺎﻫ
نآ
ﺪﻫد
ﻲﻣ
ﻪﺋارا
ﺮﺘﺸﻴﺑ
تﺎﻋﻼﻃا
ياﺮﺑ
ار
.
فﺪﻫ
ﻪﻴﻟوا
فﺪﻫ
OWASP Top 10
ﻴﭘ
شزﻮﻣآ ﺎ ﺪﻣيﺎﻫﺞﻳار
ﻪـﻣﺎﻧﺮﺑ
ﻪـﺑ
بو
ﺖـﺤﺗ
يﺎـﻫراﺰﻓا
مﺮـﻧ
ﻲـﺘﻴﻨﻣا
يﺎـﻫ
يﺮﻳﺬﭘ
ﺐﻴﺳآ
ﻦﻳﺮﺗﻲﻣ
ﺎﻫ
نﺎﻣزﺎﺳ
و
نارﺎﻤﻌﻣ
،نﺎﺣاﺮﻃ
،نﺎﺴﻳﻮﻧﺪﺷﺎﺑ
.
Top 10
ار
ﻲﺳﺎﺳا
يﺎﻬﺷور
ياﺮﺑ ﻣ ﺤ ﺎ ﻞﺑﺎﻘﻣ
رد
ﺖﻈﻓﺎﻫ
يﺮﻳﺬﭘ
ﺐﻴﺳآ
ﻦﻳاﻪﺋارا
ﺪﻫد
ﻲﻣ
-
ﻲﻋوﺮﺷﻦﻣا
ﻲﺴﻳﻮﻧ
ﻪﻣﺎﻧﺮﺑ
ياﺮﺑ
.
ﺪﺘﻔﻴﺑ
قﺎﻔﺗا
هرﺎﺒﻜﻳ
ﻪﻛ
ﺖﺴﻴﻧ
يداﺪﻳور
ﺖﻴﻨﻣا
.
ﺎﻓﺮﺻﺖﺳا
ﻲﻓﺎﻛﺎﻧ
ﺎﻫﺪﻛ
ندﺮﻛ
ﻦﻣا
رﺎﺒﻜﻳ
.
Top 10
و
ﺪـﻨﻛ
ﻲـﻣ
اﺪـﻴﭘ
ﺮﻴﻴﻐﺗ
لﺎﺳ
ﺮﻫ
راﺰﻓا
مﺮﻧ
،ﺎﻫﺪﻛ
ﺮﻴﻴﻐﺗ
نوﺪﺑ ﻫيﺎ اﻮﺗ
ﻲﻣ
بو
ﺖﺤﺗ ﻧ ﺷﺎﺑ
ﺮﻳﺬﭘ
ﺐﻴﺳآ
ﺪﻨ ﻨ ﺪ
.
دﺮﻴﮕﺑ
راﺮﻗ
ﺮﻈﻧ
ﺪﻣ
ﻪﻣﺎﻧﺮﺑ
تﺎﻴﺣ
ﻪﺧﺮﭼ
ﻞﺣاﺮﻣ
ﻲﻣﺎﻤﺗ
رد
ﺪﻳﺎﺑ
ﻦﻣا
ﻲﺴﻳﻮﻧ
ﻪﻣﺎﻧﺮﺑ
.
راﺰﻓا
مﺮﻧيﺎـﻫﺖـﺤﺗ
ورد
ﺎـﻬﻨﺗ
ﻦـﻣا
بترﻮـﺻ
مﺰﻴﻧﺎﻜﻣ
زا
يﺮﻴﮔرﺎﻜﺑ
SDLC
ﻦﻣا
و
ﻪﻌﺳﻮﺗ
،ﻲﺣاﺮﻃ
زا
ﻢﻋا
ﻞﺣاﺮﻣ
ﻲﻣﺎﻤﺗ
رد
و
...
ددﺮﮔ
ﻲﻣ
ﻞﺻﺎﺣ
.
ﻲـﺘﻴﻨﻣا
ﺪﻣﺎﻴﭘ
ﺪﺼﻴﺳ
ﻞﻗاﺪﺣ
راﺰﻓا
مﺮﻧيﺎﻫ ﻫﺪﻴﻣ
راﺮﻗ
ﺮﻴﺛﺎﺗ
ﺖﺤﺗ
ار
بو
ﺖﺤﺗ
ﻨ رد
ﻞﻴﺼﻔﺗ
ﻪﺑ
ﻪﻛ
ﺪ
ﺖﺳا
هﺪﺷ
هرﺎﺷا
نآ
ﻪﺑونا
نﺪﻧاﻮﺧ
ار
نﺎﺴﻳﻮﻧ
ﻪﻣﺎﻧﺮﺑ
ﻪﺑبو
ﺖﺤﺗ
يﺎﻫراﺰﻓا
مﺮﻧﻪﻴﺻﻮﺗﻢﻴﻨﻛ
ﻲﻣ
.
ﻧ
ﻦﻳﺮﺘﻬﺑ
و
ﻦﻴﻟوا
ﺪﻨﺘﺴﻣ
ﻦﻳاﻲﺷزﻮﻣآ
ﻪﻧﻮﻤ ﺖﺳاﻪﻧ
ﻂﻘﻓدراﺪﻧﺎﺘﺳا
ﻚﻳ
.
ناﻮﻨﻋ
ﻪﺑ
ار
ﺪﻨﺘﺴﻣ
ﻦﻳا
ﺎﻔﻄﻟﻚﻳنوﺪـﺑ
دراﺪﻧﺎﺘﺳا
ﺎﻳ
ﺖﺳﺎﻴﺳ
ﻪﻴﻟوا
ﺖﺒﺤﺻﺎﻣ
ﺎﺑﺪﻴﻨﻜﻧ
لﻮﺒﻗ
ﻲﻤﺳر
رﻮﻃ
ﻪﺑ
.
يدراﺪﻧﺎﺘﺳا
ﺎﻳ
ﺖﺳﺎﻴﺳ
ﻪﺑ
ﺮﮔااﺮﺑ
،ﺪـﻳراد
جﺎـﻴﺘﺣا
ﻦـﻣا
ﻲﺴـﻳﻮﻧ
ﻪﻣﺎﻧﺮﺑ
ي
OWASP
ﻳﺎﻫ
هژوﺮﭘ ﻣ
رد
ﻲ درﻮ راﺪﻧﺎﺘﺳادﺖﺳد
رد
ار
ﻦﻣا
ﻲﺴﻳﻮﻧ
ﻪﻣﺎﻧﺮﺑ
يﺎﻬﺘﺳﺎﻴﺳ
و
ﺎﻫماﺪﻗادراد
.
ﻲﻧادرﺪﻗ
زا
MITRE
رد
ﺎـﻫ
يﺮﻳﺬـﭘ
ﺐﻴﺳآ
سﺮﺘﺳد
ﻞﺑﺎﻗ
و
نﺎﮕﻳار
ﻪﺋارا
ياﺮﺑ
CVE
ﻢﻴـﻨﻛ
ﻲـﻣ
ﺮﻜﺸـﺗ
.
هژوﺮﭘ
10OWASP TOP
ﻂﺳﻮﺗ
ﻤﺣ
و
يﺮﺒﻫر
ﻲﻣ
ﺖﻳﺎ دﻮﺷ
.
هژوﺮﭘ
ﺮﻳﺪﻣ
:
Andrew van der Stock
)
دﺎﻴﻨﺑ
ﻲﻳاﺮﺟا
ﺮﻳﺪﻣ
OWASP
(
نﺎﮔﺪﻨﺴﻳﻮﻧ
ﺮﻳﺎﺳ
:
Jeff Wiliams
)
دﺎﻴﻨﺑ
ﺲﻴﺋر
OWASP
(
و
Dave Wichers
)
ﺲﻧاﺮﻔﻨﻛ
ﺲﻴﺋر
OWASP
(
زا
ﻢﻴﻨﻛ
ﻲﻣ
ﺮﻜﺸﺗ
ﻦﻴﻨﭽﻤﻫ
و
:
٢
Search History:
Result 00 of 00
00 results for result for
p.
Notes
Load more
