Information Systems Security : 6th International Conference, ICISS 2010, Gandhinagar, India, December 17-19, 2010

Somesh Jha

ISBN 10: 3642177131 / ISBN 13: 9783642177132

Published by Springer, Berlin, Springer, 2010

About this Item

Neuware - 2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalrequest with the input parameter username looks like index.php username=bob . The dynamically created database query at line2 is SELECT FROM users WHERE username= bob AND usertype= user . Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code ( alice ) - jected , the query becomes SELECT FROM users WHERE username= alice -- AND usertype= user .

Seller Inventory # 9783642177132

Bibliographic Details

• Title: Information Systems Security : 6th International Conference, ICISS 2010, Gandhinagar, India, December 17-19, 2010
• Publisher: Springer, Berlin, Springer
• Publication Date: 2010
• Language: English
• ISBN 10: 3642177131
• ISBN 13: 9783642177132
• Binding: Taschenbuch
• Condition: Neu
• Dimensions: 242W x 157H x 18D millimeters 242 millimeters width by 157 millimeters height by 18 millimeters depth
• Weight: 417 grams

About this title

Synopsis

2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu?cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of http requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci?edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalhttp request with the input parameter username looks like "http://example. com/ index.php?username=bob". The dynamically created database query at line2 is "SELECT * FROM users WHERE username='bob' AND usertype='user'". Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code ('alice'-') - jected "http://example.com/index.php?username=alice'-", the query becomes "SELECT* FROM users WHERE username='alice'--' AND usertype='user'".

Product Description

This book constitutes the refereed proceedings of the 6th International Conference on Information Systems Security, ICISS 2010, held in Gandhinagar, India, in December 2010. The 14 revised full papers presented together with 4 invited talks were carefully reviewed and selected from 51 initial submissions. The papers are organized in topical sections on integrity and verifiability, web and data security, access control and auditing, as well as system security.