SnapSave_App_984588367476638_1440p

May 15, 2026 20:40 · 5:29 · English · Whisper Turbo · 2 స్పీకర్లు

ఈ సరికొత్త కాలం అయిపొయినది. శాశ్వత నిల్వ కోసం ఉన్నతీకరించు →

లాగ్మెట్ సూచికComment

0:00

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

In this video, we're going to go through 10 real -world application security mistakes

0:04

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

developers commonly make.

0:05

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Let's start with the first one,

0:06

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

trusting the front end.

0:07

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

A lot of times,

0:08

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

we hide features in the UI,

0:10

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

like an admin button,

0:11

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and assume only admins can access it.

0:13

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

But here's the problem.

0:14

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Attackers don't use your UI.

0:16

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

They directly interact with your backend by sending requests on their own.

0:20

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So even if something is hidden in the front end,

0:22

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

if your back end is not validating properly,

0:24

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

any user can still access that functionality.

0:26

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So hiding something is not security.

0:28

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

The back end must always verify who the user is and what they're allowed to

0:33

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

do. That's why trusting the front end alone is never enough.

0:35

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is broken access control.

0:38

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This is one of the most common vulnerabilities.

0:40

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

It simply means users are able to do things they shouldn't be allowed to do.

0:44

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

For example, a normal user trying to perform an admin -level action like deleting

0:48

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

another user,

0:49

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and it actually works.

0:50

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

That means the system is not properly checking permissions.

0:53

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This can lead to serious issues like deleting data,

0:56

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

modifying other users,

0:57

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

accessing admin features.

0:58

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Another very common mistake is not enforcing proper access control.

1:02

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

There are three ways this usually breaks.

1:04

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Users performing actions they shouldn't like deleting data.

1:07

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Users accessing data they shouldn't like other users' info.

1:11

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

users modifying fields they shouldn't,

1:13

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

like roles or pricing.

1:14

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So always validate who is making the request,

1:17

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

what action they are trying to perform,

1:19

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and on which resource.

1:20

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

And if this validation is missing,

1:21

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

your entire system becomes exposed.

1:23

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

The third one is business logic abuse.

1:26

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This is a bit different.

1:26

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Here, the issue is not in a single API,

1:29

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

but in the overall flow of the application.

1:31

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Every app has a process.

1:33

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

1:33

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

think about a typical e -commerce website.

1:35

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

First, you add items to your cart,

1:37

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

then you make the payment,

1:38

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and only after that,

1:39

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you receive rewards.

1:40

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Now imagine someone skips the payment step and directly tries to claim the reward.

1:44

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

If your system allows that,

1:46

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

they get benefits without completing the process.

1:48

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So technically everything works,

1:50

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

but the flow is broken.

1:51

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you need to validate the entire user journey,

1:53

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

not just individual APIs.

1:55

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Because if the flow breaks,

1:56

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

the system can still be abused.

1:58

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is trusting external APIs.

2:01

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Modern applications depend heavily on external services like payments,

2:04

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

authentication,

2:05

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and data providers.

2:06

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

And because of that,

2:07

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

developers often start trusting these services completely.

2:10

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

But that's where the mistake happens.

2:11

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

2:12

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

imagine your app depends on an external authentication service.

2:15

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

If you simply trust its response without verifying it on your side,

2:19

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and that service gets compromised,

2:21

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

your system is also at risk.

2:22

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Because now,

2:23

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

attackers can send fake responses or tokens and your application might accept

2:27

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

them as valid.

2:27

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So even when using external services,

2:29

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you should never blindly trust them.

2:32

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Always validate responses and have your own security checks in place,

2:35

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

because your security should never fully depend on someone else.

2:38

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Now let's talk about SSRF,

2:40

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

server -side request forgery.

2:42

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This happens when your server makes requests based on user input.

2:45

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

2:46

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you build a feature where a user provides a link,

2:48

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and your server fetches data from it.

2:50

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

If you don't validate that input,

2:51

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

an attacker can provide internal server addresses,

2:54

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

admin endpoints,

2:55

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

or sensitive internal services.

2:56

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Instead of a normal website,

2:58

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

they might give something like your own internal admin system.

3:01

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Now your server is calling its own private services,

3:03

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

or even worse,

3:04

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

cloud metadata endpoints.

3:06

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So in simple terms,

3:07

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you're letting the user control what your server can access,

3:10

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

and that's dangerous.

3:11

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

And that's exactly why input to server -side requests must always be restricted.

3:15

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is security misconfiguration.

3:17

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This is not about coding mistakes,

3:19

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

but about setup issues.

3:20

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Some common examples.

3:21

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Default usernames and passwords not changed.

3:24

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Debug mode enabled in production.

3:26

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Old or outdated software.

3:27

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Unnecessary services left running.

3:29

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Individually,

3:30

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

these may look small,

3:31

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

but together they create serious vulnerabilities.

3:33

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This is like installing a security system and leaving the door open.

3:37

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So always make sure your environment is secure,

3:39

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

not just your code.

3:40

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Because even a secure application can fail in an insecure environment.

3:44

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is no API inventory.

3:47

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This means you don't have a clear record of all the APIs in your system.

3:50

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Over time,

3:51

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

new APIs get added,

3:52

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

old ones are not removed,

3:54

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

test APIs might go live.

3:56

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Now imagine one old API that has no rate limiting.

3:59

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

That's all attackers need.

4:00

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Or one old API that has no proper security.

4:03

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

That becomes an easy entry point.

4:05

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

If you don't know what APIs exist,

4:07

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

you can't secure them.

4:08

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So always maintain a proper inventory of your APIs,

4:11

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

because unknown APIs are often the easiest way in for attackers.

4:15

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is no rate limiting.

4:16

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This is about controlling how many requests a user can make.

4:19

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

PIs without limits are dangerous.

4:21

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

4:22

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

trying thousands or even millions of OTP combinations.

4:26

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Without rate limiting,

4:27

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

it might eventually work.

4:28

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Attackers can try multiple passwords,

4:30

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

brute force OTPs,

4:32

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

or send a huge number of requests.

4:34

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So always limit requests to prevent abuse and protect your system.

4:37

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

because without limits,

4:38

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

attackers only need time to succeed.

4:40

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Next is no input validation.

4:42

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

This happens when user input is accepted without proper checks.

4:46

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

4:46

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

a search field where a user is expected to type something normal.

4:50

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Instead, an attacker sends malicious commands.

4:52

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

If your backend executes it directly,

4:54

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

it can lead to data loss or system compromise.

4:57

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

So always validate and sanitize inputs before processing them.

5:00

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Treat all input as untrusted,

5:02

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

because trusting user input blindly can break your entire system.

5:06

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

The last one is exposing sensitive data.

5:08

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Sometimes the issue is not access,

5:10

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

but what your system returns.

5:12

S… Speaker 2 (SnapSave_App_984588367476638_1440p)

For example,

5:13

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

A PI response is containing passwords,

5:15

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

tokens,

5:16

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

personal data.

5:17

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Even if the request is valid,

5:18

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

this information should never be exposed.

5:20

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

Always return only the data that is necessary and protect sensitive information

5:25

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

properly, because once sensitive data is exposed,

5:27

S… Speaker 1 (SnapSave_App_984588367476638_1440p)

the damage is already done.

ఈ అపోహింగ్‌ను (స్వయంలేని పద గుర్తింపు) సంప్రదాయం (ఆఫ్యుటికల్ ప్రసంగ గుర్తింపు) రూపొందించారు. దోషములు వుండు. ఫార్మేట్‌ను సంక్లిష్టమైన ఆడియోకు వ్యతిరేకంగా నిర్ధారించండి. AI విధానము

❤️ ప్రేమ STT.ai? మీ స్నేహితులకు చెప్పండి!

సారాంశం

ఈ పిక్సెస్ యొక్క యాక్సెస్‌బిలిటి సంగ్రహం ఉద్భవించుటకు కాంక్వెరర్‌ను నొక్కుము.

ఈ రిపోర్టు గురించి AI ను అడుగుము

ఈ అస్థికల పేటిక గురించి ఏమైనా అడగండి —⁠ ఏ.

మరొకరు రాసుకోండి