← Protocols Index

🔒 Cybersecurity Fundamentals — OWASP Top 10, hardening, pen testing tools, secure coding

📋 Reference

💡 Example

# ── Secure Coding Patterns (Python) ──────────────────────────

# BAD: SQL injection vulnerable
import sqlite3
def get_user_bad(username):
    conn = sqlite3.connect('users.db')
    # NEVER DO THIS:
    query = f"SELECT * FROM users WHERE username = '{username}'"
    return conn.execute(query).fetchone()
# Attack: get_user_bad("admin' OR '1'='1")  -- returns ALL users!

# GOOD: Parameterized query
def get_user_good(username):
    conn = sqlite3.connect('users.db')
    return conn.execute(
        "SELECT * FROM users WHERE username = ?", (username,)
    ).fetchone()

# ── Password hashing (bcrypt) ─────────────────────────────────
# pip install bcrypt
import bcrypt

def hash_password(plain: str) -> bytes:
    return bcrypt.hashpw(plain.encode(), bcrypt.gensalt(rounds=12))

def verify_password(plain: str, hashed: bytes) -> bool:
    return bcrypt.checkpw(plain.encode(), hashed)

pw_hash = hash_password("MySecurePass123!")
print(f"Hash: {pw_hash[:30]}...")
print(f"Valid: {verify_password('MySecurePass123!', pw_hash)}")
print(f"Wrong: {verify_password('wrongpassword',    pw_hash)}")

# ── Input validation & sanitization ──────────────────────────
import re, html as html_lib

def validate_email(email: str) -> bool:
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email)) and len(email) <= 254

def sanitize_html(user_input: str) -> str:
    return html_lib.escape(user_input)  # converts < > & " ' to entities

def safe_path(base_dir: str, user_filename: str) -> str:
    import os
    safe = os.path.realpath(os.path.join(base_dir, user_filename))
    if not safe.startswith(os.path.realpath(base_dir)):
        raise ValueError("Path traversal attempt detected!")
    return safe

# BAD: subprocess with shell=True
import subprocess
def run_bad(filename):
    subprocess.run(f"cat {filename}", shell=True)  # command injection!
    
# GOOD: subprocess with list (no shell)
def run_good(filename):
    subprocess.run(["cat", filename], check=True)  # safe

# ── Security headers (Flask example) ─────────────────────────
from flask import Flask, make_response
app = Flask(__name__)

@app.after_request
def add_security_headers(resp):
    resp.headers['Strict-Transport-Security'] = 'max-age=63072000; includeSubDomains; preload'
    resp.headers['X-Content-Type-Options']    = 'nosniff'
    resp.headers['X-Frame-Options']           = 'DENY'
    resp.headers['Referrer-Policy']           = 'strict-origin-when-cross-origin'
    resp.headers['Content-Security-Policy']   = (
        "default-src 'self'; "
        "script-src 'self' https://cdnjs.cloudflare.com; "
        "style-src 'self' https://fonts.googleapis.com; "
        "img-src 'self' data: https:; "
        "object-src 'none'; "
        "base-uri 'self'"
    )
    resp.headers['Permissions-Policy'] = 'geolocation=(), microphone=(), camera=()'
    return resp

# ── Linux system hardening ────────────────────────────────────
# Disable root SSH login
sudo sed -i 's/^PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl reload sshd

# Enable automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Install and configure fail2ban
sudo apt install fail2ban
sudo tee /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
EOF
sudo systemctl enable fail2ban && sudo systemctl start fail2ban

# Firewall with ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp    # SSH
sudo ufw allow 80/tcp    # HTTP
sudo ufw allow 443/tcp   # HTTPS
sudo ufw enable
sudo ufw status verbose

# Run Lynis security audit
sudo apt install lynis
sudo lynis audit system

← Identity & Access Management  |  🏠 Index