So number three on the list is sensitive data exposure in similar to number two.
I kind of want to just talk about it the erotically from a attack and defense perspective and then we'll
dive into bourbon sweet and we'll talk about how we might hunt for these things and what are what are
some common scenarios.
So sensitive data exposure is exactly what it sounds like.
Imagine that you're testing against the hospital and the hospital is exposing PII personally identifiable
information or you like a social security number or a date of birth.
Patient Information whatever or you're testing against a client and they're exposing credit card or
financial information that violates PCI data.
Those are very bad situations.
There can be situations where you know you have passwords stored in a clear text file.
You've I've had situations in the past and I can tell you two of them.
So one situation is that recently I was testing against a bug bounty program and that bug bounty program
was a government program.
It's public so it's OK to talk about this but the the program had a javascript file that was wide open
right.
And this javascript file if you read into it guess what.
There were stored credentials in there to access their web site.
And this is I love testing against government because the government just kind of has weak protocols
and weak and weak Web sites and it helps to test against them you know make them better.
And it also is a good way to find a lot of interesting flaws out there in the wild.
So you know those store credentials that's a big no no.
That's a sensitive data exposure.
Here's another example.
About a month ago I was testing against a client of mine and they were a health care provider.
Now I went to their Web site navigated to a directory and that directory was a backup directory that
never should have been exposed.
Guess what that backup directory had an entire zip of their whole Web site.
Now the source code every single thing behind the Web site I downloaded that file it was available to
the entire public download that file and inside where again the source code credentials sequel database
credentials all kinds of stuff that's things you do not want out there.
So that's another example of sensitive data exposure.
So if we scroll down just a bit here and we look at the different preventions honestly you want to make
sure that your data is necessary to be on the application.
Right.
If you're a don't store data if you don't have to store it.
Right.
Don't store sensitive data unnecessarily as this says.
Make sure that your data is encrypted at rest wherever it lands.
Make sure that it is encrypted.
We don't want to just be able to access a file and everything's in clear text make sure that your files
are not just in a directory that's accessible by anybody.
Right.
Make sure that you are using strong passwords.
Make sure using good protocols.
And it says here it talks about HST yes we'll talk about that briefly in the next video just about headers
and why they're important.
And we'll talk about it as well and the testing aspect.
But there's also example attack scenarios right.
I think I think you probably get it by now right.
It's just it's sensitive data exposure.
There's so many different ways that this can happen and there's so many different things that this can
fall under but what it really boils down to is your enumeration ability.
What are you looking at.
And you know how well can you sift through everything that's on that application.
So the better investigator information gather a numerator that you are the better off you're going to
be I've been saying that this entire course but this holds true for a lot of web app testing because
it's not just cut and dry.
Here's the data.
You might have to dig deep for that directory.
You might have to read through 100 JavaScript files to find those stored credentials.
You know it's not always just plain as day right in front of you sometimes it is but not always.
So that's a good overview.
We're going to go into the next video where we actually do a little bit of testing for it.
I'm just going to walk you through one of the examples and we'll talk about some other things in terms
of security headers and why they're important and what we're looking for.
So that's it.
I'll meet you over in the next video.