Band 6503
Information Systems Security 6th International Conference, ICISS 2010, Gandhinagar, India, December 17-19, 2010
Aus der Reihe
Security and Cryptology
-
- Taschenbuch ausgewählt
- eBook
-
Sprache:Englisch
Fr. 73.90
inkl. gesetzl. MwSt.,
Beschreibung
Produktdetails
Einband
Taschenbuch
Erscheinungsdatum
02.12.2010
Abbildungen
XIV, 261 p. 60 illus.
Herausgeber
Somesh Jha + weitereVerlag
Springer BerlinSeitenzahl
261
Gewicht
443 g
Sprache
Englisch
ISBN
978-3-642-17713-2
2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu?cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci?edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalrequest with the input parameter username looks like index.php?username=bob . The dynamically created database query at line2 is SELECT FROM users WHERE username= bob AND usertype= user . Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code ( alice ) - jected , the query becomes SELECT FROM users WHERE username= alice -- AND usertype= user .
Noch keine Bewertungen vorhanden
Verfassen Sie die erste Bewertung zu diesem Artikel
Helfen Sie anderen Kundinnen und Kunden durch Ihre Meinung.