⚠️ 4.10 OWASP Top Threats
What is OWASP?
OWASP (Open Web Application Security Project) is a nonprofit foundation dedicated to improving software security. The OWASP Top 10 is a standard awareness document representing a broad consensus about the most critical security risks to web applications.
1. SQL Injection
💉 Database Attack via Malicious SQL
SQL Injection occurs when an attacker inserts or manipulates SQL queries through application input. This can lead to unauthorized viewing of data, data modification, or even complete database compromise.
# VULNERABLE - String concatenation
username = request.form.get('username')
query = f"SELECT * FROM users WHERE username='{username}'"
cursor.execute(query)
# Attack: username = "admin' OR '1'='1"
# Result: SELECT * FROM users WHERE username='admin' OR '1'='1'
# Returns ALL users!# SAFE - Parameterized query
username = request.form.get('username')
query = "SELECT * FROM users WHERE username=?"
cursor.execute(query, (username,))
# Input treated as literal string, not SQL code2. Cross-Site Scripting (XSS)
🎭 Injecting Malicious Scripts
XSS allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can steal session cookies, redirect users, or deface websites.
# VULNERABLE - Direct output
comment = request.form.get('comment')
return f"<div>{comment}</div>"
# Attack: comment = "<script>alert(document.cookie)</script>"
# Script executes and steals cookies!# SAFE - Escape HTML
import html
comment = request.form.get('comment')
safe_comment = html.escape(comment)
return f"<div>{safe_comment}</div>"3. CSRF (Cross-Site Request Forgery)
🎣 Tricking Authenticated Users
CSRF tricks authenticated users into performing unwanted actions. Attackers forge requests that appear to come from the legitimate user.
# Flask with CSRF protection from flask_wtf.csrf import CSRFProtect app = Flask(__name__) csrf = CSRFProtect(app) # CSRF token automatically validated on POST requests
OWASP Top 10 (2021) Summary
| Rank | Threat | Impact |
|---|---|---|
| A01 | Broken Access Control | Unauthorized access to resources |
| A02 | Cryptographic Failures | Data exposure |
| A03 | Injection | Data breach, data loss |
| A04 | Insecure Design | Systemic vulnerabilities |
| A05 | Security Misconfiguration | Exploitation of defaults |
💻 4.11 Bash Commands
What is Bash?
Bash (Bourne Again Shell) is a Unix shell and command language. It's the default shell for most Linux distributions and macOS. Bash is essential for system administration, automation, and DevOps tasks.
1. File Management
📁 Working with Files
File management is fundamental to system administration. Bash provides powerful commands for creating, viewing, copying, moving, and deleting files.
# Create files touch file.txt # Create empty file echo "Hello" > file.txt # Create with content cat > file.txt # Create and type (Ctrl+D to save) # View file contents cat file.txt # Display entire file less file.txt # View with paging head -n 20 file.txt # First 20 lines tail -f /var/log/syslog # Follow log in real-time # Copy files cp source.txt dest.txt # Copy file cp -r /source/dir /dest/dir # Copy directory recursively # Move/Rename mv old.txt new.txt # Rename mv file.txt /new/location/ # Move # Delete rm file.txt # Delete file rm -rf directory/ # Delete directory (dangerous!) # Permissions chmod 755 script.sh # rwxr-xr-x chmod +x script.sh # Add execute chown user:group file.txt # Change owner
2. Directory Navigation
🗂️ Navigating the File System
Efficient navigation is key to productivity in the command line. Understanding directory structures and navigation commands is essential.
# Navigate pwd # Print working directory cd /path/to/directory # Change directory cd ~ # Go to home directory cd - # Go to previous directory cd .. # Go up one level cd ../.. # Go up two levels # List contents ls # List files ls -l # Long format ls -la # Include hidden files ls -lh # Human-readable sizes ls -lt # Sort by time # Create/Remove directories mkdir new_directory # Create directory mkdir -p path/to/nested/dir # Create nested rmdir empty_directory # Remove empty rm -r directory/ # Remove with contents
3. Environment Variables
🌍 Managing System Variables
Environment variables store configuration settings and system information. They're crucial for application configuration, especially for storing secrets securely.
# Set environment variables (temporary) export API_KEY="your-key-here" export DB_HOST="localhost" export FLASK_ENV="development" # View variables echo $API_KEY # Display specific variable echo $HOME # Home directory echo $PATH # Executable search path env # List all variables printenv # Same as env # Unset variable unset API_KEY # Set permanently (add to ~/.bashrc) echo 'export API_KEY="your-key"' >> ~/.bashrc source ~/.bashrc # Reload configuration # Common environment variables $HOME # User home directory $USER # Current username $PATH # Executable search paths $PWD # Present working directory $SHELL # Current shell
🔄 4.12 DevOps Principles
What is DevOps?
DevOps is a set of practices that combines software development (Dev) and IT operations (Ops) to shorten the systems development life cycle and provide continuous delivery with high software quality.
Core DevOps Principles
1. Collaboration & Communication
Breaking down silos between development and operations teams to create a culture of shared responsibility.
- Cross-functional teams
- Shared tools and processes
- Open communication channels
- Collective ownership of outcomes
2. Continuous Integration & Deployment (CI/CD)
Automating the build, test, and deployment processes to deliver software faster and more reliably.
# GitLab CI/CD Example
stages:
- build
- test
- deploy
build:
stage: build
script:
- pip install -r requirements.txt
- python setup.py build
test:
stage: test
script:
- pytest tests/
- coverage report
deploy:
stage: deploy
script:
- docker build -t myapp .
- docker push myapp3. Infrastructure as Code (IaC)
Managing and provisioning infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools.
# Terraform Example
resource "aws_instance" "web" {
ami = "ami-0c55b159cbfafe1f0"
instance_type = "t2.micro"
tags = {
Name = "WebServer"
Environment = "Production"
}
}4. Monitoring & Feedback
Continuous monitoring provides real-time visibility into application and infrastructure performance.
- Application performance monitoring (APM)
- Infrastructure monitoring (Prometheus, Grafana)
- Centralized logging (ELK stack)
- Real-time alerts and notifications
DevOps Culture
Deployment Strategies
🚀 Modern Deployment Approaches
- Blue/Green: Two identical environments, switch traffic instantly
- Canary: Gradual rollout to subset of users
- Rolling: Update servers one by one
DevOps Benefits
- Faster Time to Market: Rapid release cycles
- Better Quality: Automated testing catches bugs early
- Higher Reliability: Consistent, repeatable deployments
- Improved Collaboration: Unified teams
- Faster Recovery: Quick rollback capabilities
DevOps vs Traditional
DevOps Tools
| Category | Tools |
|---|---|
| Version Control | Git, GitHub, GitLab |
| CI/CD | Jenkins, GitLab CI, GitHub Actions |
| Containers | Docker, Kubernetes |
| IaC | Terraform, Ansible |
| Monitoring | Prometheus, Grafana, Datadog |
🐍 Interactive Python Interpreter
- Write Python code in the editor
- Click "▶ Run Code" to execute