Information Systems Security [recurso electrónico] : 6th International Conference, ICISS 2010, Gandhinagar, India, December 17-19, 2010. Proceedings / edited by Somesh Jha, Anish Mathuria.
Tipo de material:
TextoSeries Lecture Notes in Computer Science ; 6503Editor: Berlin, Heidelberg : Springer Berlin Heidelberg, 2010Descripción: XIV, 261p. 60 illus. online resourceTipo de contenido: text Tipo de medio: computer Tipo de portador: online resourceISBN: 9783642177149Tema(s): Computer science | Computer Communication Networks | Data protection | Data encryption (Computer science) | Information storage and retrieval systems | Biometrics | Information Systems | Computer Science | Computer Communication Networks | Systems and Data Security | Information Storage and Retrieval | Management of Computing and Information Systems | Biometrics | Data EncryptionFormatos físicos adicionales: Printed edition:: Sin títuloClasificación CDD: 004.6 Clasificación LoC:TK5105.5-5105.9Recursos en línea: Libro electrónico
En: Springer eBooksResumen: 2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu?cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of http requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci?edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalhttp request with the input parameter username looks like “http://example.com/ index.php?username=bob”. The dynamically created database query at line2 is “SELECT * FROM users WHERE username=’bob’ AND usertype=’user’”. Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code (‘alice’–’) - jected “http://example.com/index.php?username=alice’–”, the query becomes “SELECT* FROM users WHERE username=’alice’--’ AND usertype=’user’”.
| Tipo de ítem | Biblioteca actual | Colección | Signatura | Copia número | Estado | Fecha de vencimiento | Código de barras |
|---|---|---|---|---|---|---|---|
| Libro Electrónico | Biblioteca Electrónica | Colección de Libros Electrónicos | TK5105.5 -5105.9 (Browse shelf(Abre debajo)) | 1 | No para préstamo | 375576-2001 |
Navegando Biblioteca Electrónica Estantes, Código de colección: Colección de Libros Electrónicos Cerrar el navegador de estanterías (Oculta el navegador de estanterías)
| TK5105.5 -5105.9 Distributed Computing and Networking | TK5105.5 -5105.9 Towards a Service-Based Internet | TK5105.5 -5105.9 Transactions on Computational Science XI | TK5105.5 -5105.9 Information Systems Security | TK5105.5 -5105.9 The Semantic Web – ISWC 2010 | TK5105.5 -5105.9 The Semantic Web – ISWC 2010 | TK5105.5 -5105.9 Mobile Wireless Middleware, Operating Systems, and Applications |
2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu?cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of http requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci?edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalhttp request with the input parameter username looks like “http://example.com/ index.php?username=bob”. The dynamically created database query at line2 is “SELECT * FROM users WHERE username=’bob’ AND usertype=’user’”. Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code (‘alice’–’) - jected “http://example.com/index.php?username=alice’–”, the query becomes “SELECT* FROM users WHERE username=’alice’--’ AND usertype=’user’”.
19
