One line basics
Short description of some basic topics on security

  • SSL
    A mechanism by which an encrypted link is established between the client and server
    Uses both symmetric and asymmetric encryption

  • HTTP
    A protocol responsible for communication on the internet
    Used by many webpages to transmit the web content and display HyperText
    Stateless protocol - server forgets the client once the transaction is over

    HTTP running on top of SSL
    It secures the communication between client and server with the help of cryptography
    It provides authentication of websites

  • Symmetric encryption
    A single key is used to encrypt and decrypt a message
    User A encrypts a message with key K and sends it to user B
    User B decrypts the message with Key K

  • Asymmetric encryption
    Two keys - public and private key - are used to encrypt and decrypt a message
    User A encrypts the message with Public key KB1 of User B
    User B decrypts the message with Private key KB2
    Private and Public keys are mathematically related
    Any key Public or Private can be used to encrypt or decrypt a message

  • SSL - How does it work
    Server creates a SSL certificate - makes it a 'secure server'
    Server -> Client -- Sends SSL certificate + servers public key (asymmetric)
    Client - Checks if server's SSL certificate is authentic + Creates a session key (symmetric)
    Client -> Server -- Encrypts the session key with server's public key
    Server - Decrypts this with its own private key - so it gets the session key
    This decrypted session key is used to create a secure means of communication

  • Salt in encryption
    Random data that is used as additional input to the one-way hash function applied on clear text password
    Ex: WesEf12iJ thief
    Instead of just hashing the clear-text passwords, hash salted passwords Use different salt for every user - users with same password will have different hash

  • Hash table
    Precompiled list of hash for commonly used passwords passwords

  • Buffer Overflow
    This occurs when a process attempts to write more data to a memory block - buffer - that its allocated capacity.
    Malicious actors attempt to store input in a buffer that is not large enough for that buffer. Excess data is thereby written to adjacent buffers thereby overwriting existing data. If the original data contained the exploited function's return pointer - where the process should go next - the attacker can set new values to point to the location of his malicious payload.

  • ASLR - Address Space Layout Randomization
    This is a memory protection process that guards agains Buffer Overflow attacks - it randomizes the locations where system executables are loaded in memory
    Success of a number of exploit/attacks depend on the ability of the attacker to guess/know the locations of a process in memory

  • KASLR - Kernel Address Space Layout Randomization
    Changing the location of kernel code that is loaded in memory after every boot

  • DEP - Data Execution Precention
    This is a security feature that prevents an application from executing code from a non-executable region of memory
    This prevents Buffer Overflow attacks that store code in memory for later execution. DEP - Hardware enforced, Software enforced