⚠️ OWASP, Bash & DevOps

Security Threats, Command Line & DevOps Principles

⚠️ 4.10 OWASP Top Threats

What is OWASP?

OWASP (Open Web Application Security Project) is a nonprofit foundation dedicated to improving software security. The OWASP Top 10 is a standard awareness document representing a broad consensus about the most critical security risks to web applications.

graph TD A["OWASP Top 10 Threats"] --> B["Injection Attacks"] A --> C["Authentication Issues"] A --> D["Data Exposure"] A --> E["XSS Attacks"] B --> B1["SQL Injection"] B --> B2["Command Injection"] E --> E1["Stored XSS"] E --> E2["Reflected XSS"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff style C fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff style D fill:#ab47bc,stroke:#6a1b9a,stroke-width:2px,color:#fff style E fill:#ff7043,stroke:#d84315,stroke-width:2px,color:#fff

1. SQL Injection

💉 Database Attack via Malicious SQL

SQL Injection occurs when an attacker inserts or manipulates SQL queries through application input. This can lead to unauthorized viewing of data, data modification, or even complete database compromise.

graph LR A["User Input"] --> B["Application"] B --> C["SQL Query"] C --> D["Database"] D --> E["Data Retrieved"] F["Malicious Input"] --> G["Vulnerable App"] G --> H["Malicious SQL"] H --> I["Database Compromised"] style F fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000 style H fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff style I fill:#b71c1c,stroke:#c62828,stroke-width:2px,color:#fff
❌ Vulnerable Code:
# VULNERABLE - String concatenation
username = request.form.get('username')
query = f"SELECT * FROM users WHERE username='{username}'"
cursor.execute(query)

# Attack: username = "admin' OR '1'='1"
# Result: SELECT * FROM users WHERE username='admin' OR '1'='1'
# Returns ALL users!
✅ Secure Code:
# SAFE - Parameterized query
username = request.form.get('username')
query = "SELECT * FROM users WHERE username=?"
cursor.execute(query, (username,))
# Input treated as literal string, not SQL code

2. Cross-Site Scripting (XSS)

🎭 Injecting Malicious Scripts

XSS allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can steal session cookies, redirect users, or deface websites.

❌ Vulnerable Code:
# VULNERABLE - Direct output
comment = request.form.get('comment')
return f"<div>{comment}</div>"

# Attack: comment = "<script>alert(document.cookie)</script>"
# Script executes and steals cookies!
✅ Secure Code:
# SAFE - Escape HTML
import html
comment = request.form.get('comment')
safe_comment = html.escape(comment)
return f"<div>{safe_comment}</div>"

3. CSRF (Cross-Site Request Forgery)

🎣 Tricking Authenticated Users

CSRF tricks authenticated users into performing unwanted actions. Attackers forge requests that appear to come from the legitimate user.

graph LR A["User Logged In"] --> B["Visits Malicious Site"] B --> C["Hidden Form Submits"] C --> D["Legitimate Site Receives Request"] D --> E["Action Performed"] style A fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000 style B fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000 style E fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff
✅ Prevention: Use CSRF Tokens
# Flask with CSRF protection
from flask_wtf.csrf import CSRFProtect

app = Flask(__name__)
csrf = CSRFProtect(app)

# CSRF token automatically validated on POST requests

OWASP Top 10 (2021) Summary

Rank Threat Impact
A01 Broken Access Control Unauthorized access to resources
A02 Cryptographic Failures Data exposure
A03 Injection Data breach, data loss
A04 Insecure Design Systemic vulnerabilities
A05 Security Misconfiguration Exploitation of defaults

💻 4.11 Bash Commands

What is Bash?

Bash (Bourne Again Shell) is a Unix shell and command language. It's the default shell for most Linux distributions and macOS. Bash is essential for system administration, automation, and DevOps tasks.

graph TD A["Bash Shell"] --> B["File Management"] A --> C["Directory Navigation"] A --> D["Environment Variables"] A --> E["Process Management"] B --> B1["Create/Delete"] B --> B2["Copy/Move"] B --> B3["Permissions"] C --> C1["cd, pwd"] C --> C2["ls commands"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style C fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff style D fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff

1. File Management

📁 Working with Files

File management is fundamental to system administration. Bash provides powerful commands for creating, viewing, copying, moving, and deleting files.

# Create files
touch file.txt                    # Create empty file
echo "Hello" > file.txt           # Create with content
cat > file.txt                    # Create and type (Ctrl+D to save)

# View file contents
cat file.txt                      # Display entire file
less file.txt                     # View with paging
head -n 20 file.txt              # First 20 lines
tail -f /var/log/syslog          # Follow log in real-time

# Copy files
cp source.txt dest.txt            # Copy file
cp -r /source/dir /dest/dir       # Copy directory recursively

# Move/Rename
mv old.txt new.txt                # Rename
mv file.txt /new/location/        # Move

# Delete
rm file.txt                       # Delete file
rm -rf directory/                 # Delete directory (dangerous!)

# Permissions
chmod 755 script.sh               # rwxr-xr-x
chmod +x script.sh                # Add execute
chown user:group file.txt         # Change owner

2. Directory Navigation

🗂️ Navigating the File System

Efficient navigation is key to productivity in the command line. Understanding directory structures and navigation commands is essential.

# Navigate
pwd                               # Print working directory
cd /path/to/directory             # Change directory
cd ~                              # Go to home directory
cd -                              # Go to previous directory
cd ..                             # Go up one level
cd ../..                          # Go up two levels

# List contents
ls                                # List files
ls -l                             # Long format
ls -la                            # Include hidden files
ls -lh                            # Human-readable sizes
ls -lt                            # Sort by time

# Create/Remove directories
mkdir new_directory               # Create directory
mkdir -p path/to/nested/dir       # Create nested
rmdir empty_directory             # Remove empty
rm -r directory/                  # Remove with contents

3. Environment Variables

🌍 Managing System Variables

Environment variables store configuration settings and system information. They're crucial for application configuration, especially for storing secrets securely.

graph LR A["Environment Variable"] --> B["Set with export"] B --> C["Available to Process"] C --> D["Child Processes Inherit"] E["Permanent Storage"] --> F["bashrc file"] F --> G["Loaded at Login"] style A fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#000 style C fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style F fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff
# Set environment variables (temporary)
export API_KEY="your-key-here"
export DB_HOST="localhost"
export FLASK_ENV="development"

# View variables
echo $API_KEY                     # Display specific variable
echo $HOME                        # Home directory
echo $PATH                        # Executable search path
env                               # List all variables
printenv                          # Same as env

# Unset variable
unset API_KEY

# Set permanently (add to ~/.bashrc)
echo 'export API_KEY="your-key"' >> ~/.bashrc
source ~/.bashrc                  # Reload configuration

# Common environment variables
$HOME                             # User home directory
$USER                             # Current username
$PATH                             # Executable search paths
$PWD                              # Present working directory
$SHELL                            # Current shell

🔄 4.12 DevOps Principles

What is DevOps?

DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the systems development life cycle and provide continuous delivery with high software quality.

graph LR A["Plan"] --> B["Code"] B --> C["Build"] C --> D["Test"] D --> E["Release"] E --> F["Deploy"] F --> G["Operate"] G --> H["Monitor"] H --> A style A fill:#667eea,stroke:#764ba2,stroke-width:2px,color:#fff style C fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style E fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff style H fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff

Core DevOps Principles

1. Collaboration & Communication

Breaking down silos between development and operations teams to create a culture of shared responsibility.

  • Cross-functional teams
  • Shared tools and processes
  • Open communication channels
  • Collective ownership of outcomes

2. Continuous Integration & Deployment (CI/CD)

Automating the build, test, and deployment processes to deliver software faster and more reliably.

graph TD A["Developer Commits Code"] --> B["Automated Build"] B --> C["Automated Tests"] C --> D["Quality Checks"] D --> E["Deploy to Staging"] E --> F["Deploy to Production"] style A fill:#e3f2fd,stroke:#1976d2,stroke-width:2px,color:#000 style C fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style F fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000
# GitLab CI/CD Example
stages:
  - build
  - test
  - deploy

build:
  stage: build
  script:
    - pip install -r requirements.txt
    - python setup.py build

test:
  stage: test
  script:
    - pytest tests/
    - coverage report

deploy:
  stage: deploy
  script:
    - docker build -t myapp .
    - docker push myapp

3. Infrastructure as Code (IaC)

Managing and provisioning infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.

graph TD A["Infrastructure Code"] --> B["Version Control"] B --> C["Code Review"] C --> D["Automated Testing"] D --> E["Apply to Environment"] E --> F["Infrastructure Created"] style A fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style B fill:#e3f2fd,stroke:#1976d2,stroke-width:2px,color:#000 style E fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000 style F fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff
# Terraform Example
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  
  tags = {
    Name = "WebServer"
    Environment = "Production"
  }
}

4. Monitoring & Feedback

Continuous monitoring provides real-time visibility into application and infrastructure performance.

graph LR A["Application"] --> B["Metrics Collection"] B --> C["Prometheus"] C --> D["Grafana Dashboard"] D --> E["Alerts"] F["Logs"] --> G["ELK Stack"] G --> D style A fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000 style C fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff style D fill:#667eea,stroke:#764ba2,stroke-width:2px,color:#fff style E fill:#ef5350,stroke:#c62828,stroke-width:2px,color:#fff
  • Application performance monitoring (APM)
  • Infrastructure monitoring (Prometheus, Grafana)
  • Centralized logging (ELK stack)
  • Real-time alerts and notifications

DevOps Culture

graph TD A["DevOps Culture"] --> B["Collaboration"] A --> C["Automation"] A --> D["Measurement"] A --> E["Sharing"] B --> B1["Break Silos"] C --> C1["CI/CD Pipelines"] D --> D1["Metrics & KPIs"] E --> E1["Knowledge Transfer"] style A fill:#667eea,stroke:#764ba2,stroke-width:3px,color:#fff style B fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style C fill:#42a5f5,stroke:#1976d2,stroke-width:2px,color:#fff style D fill:#ffa726,stroke:#e65100,stroke-width:2px,color:#fff style E fill:#ab47bc,stroke:#6a1b9a,stroke-width:2px,color:#fff

Deployment Strategies

🚀 Modern Deployment Approaches

graph LR A["Blue/Green"] --> B["Zero Downtime"] C["Canary"] --> D["Gradual Rollout"] E["Rolling"] --> F["Sequential Update"] style A fill:#e3f2fd,stroke:#1976d2,stroke-width:2px,color:#000 style C fill:#fff3e0,stroke:#e65100,stroke-width:2px,color:#000 style E fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000
  • Blue/Green: Two identical environments, switch traffic instantly
  • Canary: Gradual rollout to subset of users
  • Rolling: Update servers one by one

DevOps Benefits

✅ Key Benefits:
  • Faster Time to Market: Rapid release cycles
  • Better Quality: Automated testing catches bugs early
  • Higher Reliability: Consistent, repeatable deployments
  • Improved Collaboration: Unified teams
  • Faster Recovery: Quick rollback capabilities

DevOps vs Traditional

graph TD A["Traditional"] --> B["Manual Processes"] A --> C["Siloed Teams"] A --> D["Slow Releases"] E["DevOps"] --> F["Automation"] E --> G["Collaboration"] E --> H["Continuous Delivery"] style A fill:#ffebee,stroke:#c62828,stroke-width:2px,color:#000 style E fill:#e8f5e9,stroke:#2e7d32,stroke-width:2px,color:#000 style F fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style G fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff style H fill:#66bb6a,stroke:#2e7d32,stroke-width:2px,color:#fff

DevOps Tools

Category Tools
Version Control Git, GitHub, GitLab
CI/CD Jenkins, GitLab CI, GitHub Actions
Containers Docker, Kubernetes
IaC Terraform, Ansible
Monitoring Prometheus, Grafana, Datadog

🐍 Interactive Python Interpreter

💡 How to use:
  • Write Python code in the editor
  • Click "▶ Run Code" to execute
📝 Python Code Editor
⚡ Console Output
Ready to execute Python code...