Definition of SQL Injection
|
|
SQL Injection
|
|
SQL Injection, Are Your Web Applications Vulnerable?
The objective of this paper is to educate the professional security community on the techniques that can be used to take advantage of a web application that is vulnerable to SQL injection, and to make clear the correct mechanisms that should be put in place to protect against SQL injection and input validation problems in general.
Read the Article
|
SQL Injection Protection by Variable Normalization of SQL Statement
We present here a method to protect from SQL injection attack. The method involve using a virtual database connectivity drive as well as a special method named "variable normalization" to extract the basic structure of a SQL statement so that we could use that information to determine if a SQL statement is allowed to be executed. The method can be used in most scenarios and does not require changing the source code of database applications (i.e. the CGI web application). The presented method can also be used for auto-learning the allowable list of SQL statements, which makes the system very easy to setup. And since the decision of whether a SQL statement is allowed is to check if the normalized statement exists in our ready-sorted allowable list, the overhead of the system is very minimal.
Read the Article
|
Introduction to SQL Injection
It is very hard to understand the conceptual idea of SQL injection without partially understanding the code that runs in the background. With this paper I hope to explain, with the help of some examples, just how easy it is to exploit a system with SQL injection and how to defend against it.
Read the Article
|
Detection of SQL Injection and Cross-site Scripting Attacks
In the last couple of years, attacks against the Web application layer have required increased attention from security professionals. This is because no matter how strong your firewall rulesets are or how diligent your patching mechanism may be, if your Web application developers haven't followed secure coding practices, attackers will walk right into your systems through port 80. The two main attack techniques that have been used widely are SQL Injection [ref 1] and Cross Site Scripting [ref 2] attacks. SQL Injection refers to the technique of inserting SQL meta-characters and commands into Web-based input fields in order to manipulate the execution of the back-end SQL queries. These are attacks directed primarily against another organization's Web server. Cross Site Scripting attacks work by embedding script tags in URLs and enticing unsuspecting users to click on them, ensuring that the malicious Javascript gets executed on the victim's machine.
Read the Article
|
|
|
Page: 1 2
Members currently browsing this category:
|
|
