Web Security - Unit II Final Notes
Simple notes with side headings, examples, and study diagrams
Outline
• Privacy and Security for Users
• The Web's War on Your Privacy
• Log Files and Web Tracking
• Understanding Cookies
• Cookie Security and Disabling Cookies
• Web Bugs / Tracking Pixels
• Privacy-Protecting Techniques
• Password Safety and Browser Privacy
• Avoiding Spam and Identity Theft
• Privacy-Protecting Technologies
• Anonymous Browsing and Secure Email
• Backups and Antitheft
• Web Server Security
• Physical Security for Servers
• Host Security for Servers
• Securing Web Applications
Web Security - Unit II Final Notes Page 1
1. Privacy and Security for Users
Privacy on the web means keeping personal information under your control. Security on the web means
protecting your data, device, and online activities from misuse.
The Web's War on Your Privacy
Logs
User Website Cookies
Ads
The web is not one-way. When users open websites, the websites also collect information about the users.
• Websites can record page visits, search terms, clicks, device details, and time spent.
• Registration forms often collect names, email addresses, phone numbers, and interests.
• Advertising systems and trackers build profiles based on browsing habits.
• This data can be used for marketing, analysis, personalization, or sometimes misuse.
Example: If a user visits shopping sites for shoes and mobiles, related ads may start appearing on many
other websites.
Types of Personal Data
Important privacy-related terms include:
• **Personal information** - information connected to a person
• **Private information** - information a person does not want to share freely
• **Personally identifiable information (PII)** - data that can directly identify a person, such as name, phone
number, email, or ID number
• **Anonymized information** - data with direct identity removed
• **Aggregate information** - grouped data about many users
Important point: Even anonymized or aggregate data can sometimes reveal identity when combined with
other details such as ZIP code, birthday, or location.
Log Files and Web Tracking
Web servers, proxies, and other network systems keep log files.
These logs may store:
• IP address and host name
• date and time of access
• requested page or URL
• browser type and operating system
• referring page
• errors and login details
Web Security - Unit II Final Notes Page 2
Logs are useful for maintenance and security, but they also create privacy risks because they show what a
person did online.
Example: A university website log may show when a student logged in, which page was opened, and what
browser was used.
Referer Information and Proxy Logs
When a browser opens a new page, it may send the address of the previous page through the **Referer**
header.
• This helps websites know where traffic came from.
• It can also leak sensitive information.
• Proxy servers may hide the real IP address from websites, but proxy logs can still be used to identify users.
DNS and Network Logs
DNS servers, ISP systems, and authentication services may record online activity.
• DNS logs show which domains a user tried to visit.
• Mail and authentication services may keep records of account access.
• These records may later be used for troubleshooting, audits, or legal investigation.
Understanding Cookies
Set-Cookie
Browser Server
Cookie sent back
Cookies are small text blocks stored by the browser.
They help websites remember information between visits.
Common uses of cookies:
• keeping a user logged in
• storing shopping cart items
• saving language preferences
• remembering settings
• tracking users for advertising or analytics
Example: An online store uses a cookie to remember the items added to the cart even when the user opens
another page.
Example Cookies
Typical cookie examples include:
• session ID cookie
• login preference cookie
• website language cookie
Web Security - Unit II Final Notes Page 3
• advertising tracker cookie
• analytics ID cookie
Cookies and Privacy
Cookies are useful, but they also affect privacy.
• A website can recognize a returning browser.
• Third-party cookies can track activity across multiple websites.
• Cookies may be connected to user accounts in a database.
• Long-term tracking can create detailed user profiles.
Cookie Security
Cookies should not be fully trusted because users and attackers may change them.
Important security ideas:
• sensitive data should not be stored directly in plain cookies
• cookies should be given limited lifetime
• secure cookies should be sent only over HTTPS
• `HttpOnly` and `Secure` attributes improve safety
Example: A shopping site should store only a session ID in a cookie, not the user's full password or card
number.
Disabling Cookies
Browsers allow users to:
• accept all cookies
• block some cookies
• block third-party cookies
• delete stored cookies
This improves privacy, but some websites may stop working correctly if cookies are completely blocked.
Web Bugs / Tracking Pixels
Web bugs are tiny invisible images, often 1x1 pixels, placed in web pages or emails.
They are also called:
• tracking pixels
• web beacons
• clear GIFs
They help trackers know:
• whether a page or email was opened
• what browser or IP address was used
• whether a user returned later
Example: A marketing email may contain an invisible image so the sender can know when the email is
opened.
Web Security - Unit II Final Notes Page 4
2. Privacy-Protecting Techniques
Privacy can be improved by careful behavior and safe technology choices.
Choose a Trustworthy ISP
The Internet Service Provider (ISP) can often observe large parts of a user's activity.
• Some ISPs keep clear privacy policies.
• Others may collect or share more data.
• A good ISP should have clear rules on access to customer information.
Passwords
Passwords are the simplest form of authentication.
• They protect email, websites, devices, and accounts.
• A strong password is the first line of defense for privacy and security.
Weak passwords are dangerous because they are easy to guess or crack.
Examples of weak passwords:
• `123456`
• name + birth year
• phone number
• username itself
Writing Down Passwords
Writing down passwords is risky if they are left in plain view.
However, a strong password written safely may still be better than a weak password that is easy to
remember.
Good practice:
• do not label a note as "passwords"
• keep it in a safe place
• prefer a password manager for better protection
Strategies for Managing Multiple Usernames and Passwords
Different websites use different rules, so managing passwords is difficult.
Safer strategies include:
• do not reuse the same password everywhere
• use different passwords for important accounts
• group accounts by importance
• use a password manager
Password Classes
Passwords can be divided by importance.
For example:
• low-risk accounts: news or forum sites
Web Security - Unit II Final Notes Page 5
• medium-risk accounts: social media or shopping
• high-risk accounts: banking, email, official portals
Password Bases
Some users start with a strong base password and modify it for each service.
This is better than reusing the exact same password, but the pattern should not be obvious.
Password Rotation
Changing passwords regularly reduces long-term risk.
• Rotate passwords after a data leak or suspicious login.
• Do not change to a small variation that is easy to guess.
Password Keepers
Password keepers or password managers store passwords in encrypted form.
Benefits:
• strong unique passwords for each site
• easy account management
• reduced memory burden
Sharing Passwords
Sharing passwords is risky.
• It gives another person access to your personal information.
• It increases the chance of misuse.
• If a password is shared temporarily, it should be changed afterwards.
Beware of Password Sniffers and Stealers
Attackers may steal passwords in several ways:
• **sniffers** capture unencrypted traffic
• **keyloggers** record typed keys
• **spyware** secretly monitors the user
• **phishing** tricks users into giving away passwords
Example: A fake email claiming to be from a bank may ask the user to reset the password through a
dangerous link.
Browser Cache
Browsers save copies of web pages in cache to load them faster.
• This improves speed.
• But cached pages may reveal private information later.
• Clearing cache is useful on shared systems.
Browser Cookies and Stored Data
Browsers may store cookies, downloaded files, and other local traces.
These traces can reveal online activity and should be cleaned when privacy is important.
Web Security - Unit II Final Notes Page 6
Browser History
Browser history stores visited URLs.
• It may show what pages the user opened.
• Sensitive browsing history should be cleared on public or shared computers.
Passwords, Form-Filling, and AutoComplete Settings
Browsers may save:
• form entries
• search terms
• addresses
• usernames and passwords
This is convenient, but risky if the computer is shared or stolen.
Avoiding Spam and Junk Email
Spam is unwanted email that wastes time and may carry fraud or malware.
Good practice:
• do not reply to spam
• do not click suspicious links
• use filters and anti-spam services
• keep email addresses less public
Protect Your Email Address
To reduce spam:
• avoid posting full email addresses publicly
• use different emails for important and unimportant services
• use temporary or single-purpose email accounts when needed
• be careful with online forms
Identity Theft
Identity theft happens when personal data is used by someone else for fraud.
It may involve:
• opening accounts using stolen details
• abusing credit cards
• misusing passwords or identity documents
Protection steps:
• shred personal papers
• check financial statements regularly
• avoid sharing unnecessary personal details
• use strong passwords and multi-factor authentication
Example: If an attacker gets a person's email, phone number, and bank OTP, they may try to take over the
account.
Web Security - Unit II Final Notes Page 7
Web Security - Unit II Final Notes Page 8
3. Privacy-Protecting Technologies
This section covers tools that help users protect privacy while browsing and communicating online.
Ad Blocking and Local HTTP Proxies
A local HTTP proxy sits between the browser and the web server.
It can:
• block advertisements
• remove or edit cookies
• filter page content
• stop some trackers and pop-ups
Ad blockers help by:
• reducing distractions
• saving bandwidth
• reducing tracking
Anonymous Browsing
Hide original IP
User Anonymous Proxy Website
Anonymous browsing tries to reduce the amount of identity information revealed to websites.
It helps hide or reduce exposure of:
• IP address
• location details
• browsing habits
Simple methods include:
• using trusted proxy services
• using privacy-focused browsers
• avoiding account login while browsing anonymously
Anonymous Web Browsing Services
Some services route traffic through one or more proxy servers.
Benefits:
• websites do not directly see the user's original IP address
• tracking becomes harder
• some services support multiple anonymous identities
Web Security - Unit II Final Notes Page 9
Example: A multi-hop anonymous service forwards traffic through several servers so that tracing the original
user becomes more difficult.
Secure Email
Normal email is often not private by default.
Risks include:
• reading by the provider or attacker
• interception in transit
• long-term storage in many places
Secure email solutions use:
• encryption
• digital signatures
• safer login methods
Hotmail, Yahoo Mail, and Other Web-Based Email Services
Web-based email is convenient and often free, but the provider may have access to stored messages.
These services are useful, but sensitive communication should use additional protection.
Hushmail and Encrypted Web Mail
Secure web mail systems such as Hushmail are designed to improve privacy.
• messages are encrypted
• public key cryptography may be used
• a passphrase protects the private key
Example: A lawyer sending private documents to a client may use encrypted web mail instead of normal
email.
Self-Destructing Email
Some services allow email access to expire after a chosen time.
Benefits:
• reduces long-term exposure
• gives more control over how long the message can be viewed
Important point: This helps privacy, but it cannot fully stop screenshots or copying by the receiver.
Web Security - Unit II Final Notes Page 10
4. Backups and Antitheft
Data can be lost by user mistakes, hardware failure, malware, theft, or disasters. Backups and antitheft
measures help reduce this risk.
Using Backups to Protect Your Data
Simple Backup Plan
Original Data Local Backup Off-site Backup
A backup is a copy of important data stored separately from the main system.
Backups help restore files after:
• accidental deletion
• hardware failure
• ransomware or malware
• theft of the device
• natural disaster
Example: If a laptop crashes before exams, a recent backup can restore notes and assignments.
Why Make Backups?
Backups are important because:
• hardware can fail at any time
• users can delete files by mistake
• software may become corrupted
• disasters may damage the original system
• insurance can replace hardware, but not personal data
Types of Backups
Common types include:
• **full backup** - copies everything
• **incremental backup** - copies only changed files since the last backup
• **differential backup** - copies files changed since the last full backup
A common method is to keep more than one backup set and rotate them.
Security for Backups
Backups also need protection.
• backup media should not be left in drives
• copies should be stored off-site when possible
• backups should be encrypted
Web Security - Unit II Final Notes Page 11
• the keys used for encryption must also be protected
Verify Your Backups
A backup is useful only if it can be restored.
Good practice:
• test recovery regularly
• verify old and new backups
• keep more than one copy
Protect Your Backups
• store backups in a different physical location
• keep them away from fire, dust, and water
• sanitize old backup media before disposal
• do not leave printed confidential documents or storage media unsecured
Antitheft Measures
Simple theft prevention steps include:
• cable locks for laptops
• equipment tags
• tracking software
• not leaving devices unattended
• full disk encryption for sensitive systems
Example: A laptop protected with full-disk encryption is less useful to a thief because the data remains
unreadable.
Web Security - Unit II Final Notes Page 12
5. Web Server Security
Web server security includes physical protection, host security, and application security.
Physical Security for Servers
Locks Power
Server Room
Fire Safety Monitoring
Physical security means protecting equipment before anyone even starts typing commands.
If an attacker gets direct physical access, many other defenses can fail.
Examples of physical risks:
• theft of hardware
• damage from fire or water
• unauthorized entry into server rooms
• tampering with cables or backup media
The Physical Security Plan
Every organization should have a written physical security plan.
It should include:
• what assets are being protected
• where they are located
• what threats exist
• what defenses are already in place
• what improvements are needed
• cost and recovery plans
The Disaster Recovery Plan
A disaster recovery plan explains how to restore systems after theft, failure, or disaster.
It should cover:
• replacement hardware
• backup restoration
• alternate work locations
• contact details of responsible staff
• testing of recovery steps
Environmental Security
Servers are affected by their surroundings.
Web Security - Unit II Final Notes Page 13
Important environmental issues include:
• fire and smoke
• dust
• earthquake and vibration
• temperature extremes
• humidity and water
• electrical noise and lightning
• insects and accidental spills
Good practice:
• keep the server room clean
• use power protection and monitoring
• avoid food and drink near equipment
• monitor temperature and humidity
Physical Access
Physical access must be controlled.
• limit who can enter the server room
• use locks, access cards, and logs
• protect ducts, ceilings, windows, and wiring paths
• do not leave equipment unattended in open areas
Physically Secure Your Computer
Important steps include:
• use tie-downs or rack mounting
• protect removable drives
• inspect cables for tampering
• be careful with wireless connections
• encrypt stored data
Host Security for Servers
Host security means protecting the computer system on which the web server runs.
If the operating system is compromised, the web server cannot be considered secure.
Current Host Security Problems
Common server problems include:
• poor hardening
• unpatched software
• weak configuration
• too many open services
• weak monitoring
• misuse by authorized users
Web Security - Unit II Final Notes Page 14
Malicious Programs
Host systems can be attacked by:
• **back doors**
• **Trojan horses**
• **viruses**
• **worms**
• **spyware**
Attackers may use compromised servers for:
• launching further attacks
• hosting illegal content
• distributed denial-of-service attacks
• hiding their own identity
Security Policy
A written security policy helps define:
• who can access the server
• what content is allowed
• how updates are performed
• how incidents are handled
• who is allowed to communicate during a breach
Minimizing Network Services
One of the best ways to secure a server is to run only the services that are really needed.
• each extra service adds new risk
• even services that seem safe today may become vulnerable later
• unnecessary software should be disabled or removed
Example: A web server should not also run many unrelated network services unless there is a clear need.
Logging and Log Servers
Logs are essential for:
• incident detection
• troubleshooting
• auditing
• capacity planning
A separate log server is useful because attackers often try to erase local logs after breaking in.
Backups and Security Tools for Hosts
Security tools help administrators find problems early.
Examples:
• configuration audit tools
Web Security - Unit II Final Notes Page 15
• file integrity checkers such as Tripwire
• vulnerability scanners
• intrusion detection systems (IDS)
• antivirus tools
• packet capture and traffic analysis tools
Remote Updates and Secure File Transfer
Updating web content and software must be done securely.
Safer methods include:
• SSH
• SCP
• SFTP
• rsync over SSH
• VPN-based access
Plain FTP should be avoided because it sends usernames and passwords in readable form.
Protecting Web Servers with Firewalls
Allow only needed ports
Internet Firewall Web Server
A firewall helps limit network access to only the required services.
Good web server firewall practice:
• allow only needed ports such as 80 and 443
• isolate the server from the internal network
• use a DMZ or similar separated area
• monitor traffic for unusual activity
Important point: Firewalls reduce exposure, but they do not fix weak applications or bad passwords.
Web Security - Unit II Final Notes Page 16
6. Securing Web Applications
Modern web servers do much more than show static pages. They often run code that takes input from users
and connects to databases.
Why Web Applications Are Risky
Dynamic applications are powerful, but flaws in code may allow attackers to:
• steal data
• run unwanted commands
• change web pages
• break into the server
CGI
CGI (Common Gateway Interface) was one of the first ways to add programs to a website.
• the web server starts a separate program for each request
• the program processes input and returns output
• CGI made early search tools and forms possible
Risk: If the CGI program is poorly written, an attacker may misuse it.
Plug-ins, Loadable Modules, and APIs
These extensions are often faster than CGI because they run inside the server process.
Advantages:
• better speed
• powerful features
Disadvantage:
• a bug may crash or compromise the whole server
Server-Side Scripts
Scripts can be embedded in web pages or server frameworks.
Examples:
• PHP
• server-side JavaScript
• ASP-like systems
These are popular for dynamic websites, but they must be written securely.
Embedded Web Server
In some systems, web server functions are built directly into the application or device.
This is common in routers, appliances, and special hardware.
Programs That Should Not Be CGIs
Interpreters and command shells should never be placed in a public CGI area.
Examples include:
• shell programs
Web Security - Unit II Final Notes Page 17
• system command interpreters
• unsafe diagnostic tools
The `phf` Example and Command Injection
Older CGI examples such as `phf` showed how hidden flaws can become dangerous.
If user input is passed directly to a shell command, the attacker may attach extra commands.
Example: Instead of sending only a username, the attacker may insert extra special characters to run another
command on the server.
Never Trust User Input
Whitelist, length, format, recheck
User Input Validation Safe App/DB
This is one of the most important rules in web security.
• validate every field
• check allowed characters
• check length and format
• use whitelisting instead of blacklisting
• recheck all data on the server side
Example: A registration form should accept only valid email format and not allow dangerous script input.
Rules for Secure Programming
Good secure coding practices include:
• design before coding
• keep critical code small and simple
• check all system call return values
• use full path names
• avoid world-writable directories
• log important events without exposing sensitive data
• test both normal and unexpected input
• apply least privilege
Securely Using Fields, Hidden Fields, and Cookies
Data stored in the browser should always be considered untrusted.
This includes:
• form fields
• hidden fields
Web Security - Unit II Final Notes Page 18
• URL parameters
• cookies
Attackers can change these values before sending them back to the server.
So the server must always verify them again.
Using Cryptography to Strengthen Hidden Fields, Compound URLs, and Cookies
Cryptography can make client-side data harder to tamper with.
Methods include:
• signing values
• encrypting sensitive data
• adding timestamps or nonces to reduce replay attacks
Rules for Programming Languages
Different languages have different risks, but some rules are common:
• avoid unsafe functions
• do not trust external data
• initialize variables clearly
• keep the runtime environment controlled
Security-Related CGI/API Variables
Applications may receive variables such as:
• `REMOTE_ADDR`
• `REMOTE_HOST`
• `REMOTE_USER`
• `AUTH_TYPE`
These are useful, but they should not be blindly trusted for security decisions.
Securing Perl, C, and PHP Programs
Important points:
• set safe paths and environment variables
• avoid unsafe shell execution
• use compiler warnings in C
• in PHP, turn off risky settings such as `register_globals`
• do not expose debugging output to normal users
• avoid unnecessary SUID/SGID usage
Database Security
Web applications often connect to databases, so database security is important.
Good practice includes:
• do not hard-code database passwords in public scripts
• store credentials safely
Web Security - Unit II Final Notes Page 19
• use prepared statements or parameterized queries
• quote or escape user input correctly
• separate the database server from the public web server when possible
Example: If a login form sends raw input directly into an SQL query, an attacker may try SQL injection to
bypass authentication.
Web Security - Unit II Final Notes Page 20
Quick Revision Points
• Privacy on the web is affected by logs, cookies, trackers, and careless sharing of information.
• Strong passwords, safe browsing habits, and privacy-aware settings improve user security.
• Anonymous browsing tools, ad blockers, and secure email can reduce privacy exposure.
• Backups protect data from deletion, theft, failure, and disasters.
• Web server security depends on physical protection, host hardening, logging, updates, and firewalls.
• Web applications must never trust user input and should use secure programming practices.
Web Security - Unit II Final Notes Page 21
Conclusion
Unit II shows that web security is not only about stopping hackers. It is also about protecting privacy, securing
devices, creating backups, hardening servers, and writing safe web applications. When these practices are
followed together, both users and organizations become much safer online.
Web Security - Unit II Final Notes Page 22