OWASP TOP 10: Information disclosure ~2023

Course details

Information disclosure, also known as information leakage, is when a website unintentionally reveals sensitive information to its users.  As Simple, Information disclosure is when a web application fails to properly protect confidential information, which causes revealing sensitive information or data of the users or anything related to users to any third party.

Exploits a web site that reveals sensitive data, such as developer comments or error messages. Path Traversal. Forces access to files, directories, and commands that are located outside the web document root directory.

CISA Coordinated Vulnerability Disclosure (CVD) Process. CISA's CVD program coordinates the remediation and public disclosure of newly identified cybersecurity vulnerabilities in products and services with the affected vendor(s).

The OWASP Top 10 provides rankings ofand remediation guidance forthe top 10 most critical web application security risks. Leveraging the extensive knowledge and experience of the OWASP's open community contributors, the report is based on a consensus among security experts from around the world and It is the most prevalent and impactful vulnerability as per the OWASP Top 10 list.

What is vulnerability disclosure in cyber security?

This Vulnerability Disclosure Policy (VDP) describes the activities that can be undertaken by security researchers to find and report vulnerabilities in internet-accessible systems and services in a legally authorized manner.

Why need to learn Information disclosure vulnerabilities?

Learning to find and exploit information disclosure is a vital skill for any tester. You are likely to encounter it on a regular basis and, once you know how to exploit it effectively, it can help you to improve your testing efficiency and enable you to find additional, high-severity bugs.

VDPs provide the framework and guidance that enables this. Once a security vulnerability has been disclosed, it can provide organisations with the information required to shape appropriate mitigation steps and decrease the chance of exploitation of the security vulnerability by adversaries.

Types of Information disclosure vulnerabilities

            >>Directory Indexing

            >>Information Leakage

            >>Path Traversal

            >>Predictable Resource Location

How to prevent Information disclosure

• Bad configuration

• using a poorly designed application

• Fails to remove sensitive content from public content