Testing for Security
|
|
|
- Leslie Reeves
- 10 years ago
- Views:
Transcription
1 Testing for Security Kenneth Ingham September 29, Course overview The threat that security breaches present to your products and ultimately your customer base can be significant. This course is designed to assist testers in updating their testing practices to include testing for security. The goal of this effort is to reduce the number of identified post-release security vulnerabilities. Many tools exist to assist testers. However, more important is to understand the testing techniques. This class uses the tools to teach the techniques. While the students will learn about some of the available tools, they are not the primary focus of the class. 2 Course objectives Understand how the risk analysis drives security testing. Learn the concepts of penetration, black box, and white box testing, and understand the strengths and weaknesses of each technique. Know when to apply each. Understand the types of attacks (attack patterns) and tools that hackers use against your products in order to develop or utilize testing practices to duplicate the more common forms of these attacks. Thinking like an attacker is important for this understanding, so the class shows the approaches attackers often take. Understand what tools are available and appropriate to use in different security testing situations. 3 Student background If you are attending this class, then we assume that You have already had a class on or experience with threat models and risk analysis. 1
2 You understand programming using a major programming language (C, C++, Java, etc). You are (or will be) testing products or applications for possible security breaches. 4 Logistics The class lasts two days. nothing; no class computers are needed The class uses the following software: Firefox (on Linux distribution but needed for Windows) Firefox Web Developer toolbar Java JDK 1.6 Missing from auth2testing.tex Missing from dynamictesting.tex Missing from errortest.tex Missing from featureinteractions.tex Missing from fuzztesting.tex Missing from injectiontesting.tex Missing from insecurecomm.tex Missing from outputtesting.tex Missing from resourcetesting.tex Missing from staticanalysis.tex Nikto (on class web site) Paros proxy PortSwigger burp suite WebGoat v5.2 WebScarab emacs (on Linux distribution) firefox g++ (on the Linux distribution) gcc (on Linux distribution) gdb (on Linux distribution) opera strace (on the Linux distribution) a class web server that can run perl CGI programs at least one of ddd or the GNU Visual Debugger (on Linux distribution) perl 5.8 (On Linux distribution but needed for Windows) the Firefox web developer toolbar No class network information specified. The class needs a web server for the class web site. The instructor s laptop may be this web server; otherwise the machine provided in the classroom for the instructor is a good choice. This machine obviously will need web server software installed. 2
3 5 Class outline 1. Introduction (Lecture: 15; Lab: 0) (a) Class Introductions (b) Class Logistics i. Class schedule ii. Breaks iii. Question policy iv. Break room and restroom locations v. Assumptions about your background (c) Typographic conventions (d) What the class covers 2. Security Testing Introduction (Lecture: 25; Lab: 0) (b) What is a secure program? (c) The Cost of a Serious Security Problem (d) Why do security testing? (e) Who should perform the testing (f) Types of security testing (g) Limitations of Testing (h) When to test (i) Staying current (j) System Requirements and Security Testing (k) Notes about the class (l) Summary 3. Risk-based Testing (Lecture: 35; Lab: 90) (b) The threat model (c) The assets you are protecting (d) Attackers (e) Common attack goals (f) Example (g) Failures of Imagination i. Clients, servers, and embedded systems A. Embedded system (h) Risk analysis (i) Using risk analysis to drive testing i. Prioritizing Abuse Scenarios ii. Focus Security Testing on Targeted Areas (j) Summary 3
4 (k) Lab 4. Input Validation Vulnerabilities (Lecture: 30; Lab: 30) (b) Beware hidden user input (c) Some failures of input validation i. Buffer Overflows A. A simple buffer overflow example B. Finding buffer overflows ii. Integer Range Errors A. Value truncation B. Example C. Integer overflow and underflow D. Finding integer range errors iii. Format string vulnerabilities iv. Repeated Input (d) Finding input locations i. Example (e) Tools i. Firefox Web Developer toolbar (f) Summary (g) Lab 5. Fuzz testing (fuzzing) (Lecture: 35; Lab: 45) (b) Types of fuzz testing (c) Tools i. The Peach Fuzzer (d) A quick Python tutorial i. Running Python programs ii. Variables and data types iii. I/O iv. Control flow v. Data structures and classes vi. Errors and exceptions (e) Summary (f) Lab 6. Injection vulnerabilities (Lecture: 30; Lab: 30) (b) SQL injection 4
5 (c) Shell injection (d) Finding these vulnerabilities (e) Tools i. SQL injection (f) Summary (g) Lab 7. Static code analysis (Lecture: 30; Lab: 30) (b) Test types i. Type checking ii. Style checking iii. Property checking and program verification iv. Bug finders (c) Tools i. Commercial ii. Open Source 8. Testing resource management (Lecture: 10; Lab: 30) (b) Graceful degradation (c) Testing for this problem 9. Dynamic analysis (Lecture: 30; Lab: 45) (b) Tools (c) valgrind i. Example bug finding ii. Finding memory leaks A. Command-line flags specific to memcheck iii. Finding illegal free() calls iv. Other uses of memcheck 10. Complete and correct error handling (Lecture: 15; Lab: 40) (b) Examples 5
6 (c) Proper failure state (d) Testing for these problems i. Fault injection (e) Summary (f) Lab 11. Output validation (Lecture: 10; Lab: 30) (b) Examples (c) Testing for this problem 12. Feature interactions (Lecture: 10; Lab: 30) (b) Finding feature interaction vulnerabilities (c) Summary (d) Lab 13. Data Security Testing (Lecture: 20; Lab: 40) (b) Least Privilege (c) Separation of privilege i. Example: NTP client ii. Compartmentalization (d) Erasing data (e) Erasing Memory (f) Testing (g) Summary (h) Lab 14. Insecure Communication (Lecture: 30; Lab: 30) (b) Using cryptography to protect communication i. Using public key cryptography to protect communication (c) Testing for this problem 15. Authentication and Authorization Errors (Lecture: 25; Lab: 45) (b) Example failures (c) Authentication 6
7 Appendices (d) Access control i. Access control vocabulary ii. Access Control Matrix (e) Testing for these problems i. Bad habits to check for (f) Summary (g) Lab A. Debugging with gdb (Lecture: 25; Lab: 30) (b) Compiling programs to be debugged (c) Working in gdb i. Starting and exiting gdb ii. gdb commands iii. Help iv. Info v. Show vi. Running programs (d) Breakpoints and watchpoints (e) Continuing and single stepping (f) Viewing data and the stack (g) Demonstration (h) GUI front ends for gdb (i) Lab B. More debugging with gdb (Lecture: 20; Lab: 50) (a) Dealing with core dumps (b) Debugging when the program was not compiled for debugging (c) Attaching to already-running programs (d) fork and processes (e) Debugging threads (f) Signals (g) Lab C. Attacking Web Applications (Lecture: 50; Lab: 45) (b) PortSwigger s Burp Suite (c) WebScarab (d) Paros Suite (e) Nikto 7
8 (f) Firefox Web Developer toolbar (g) WebGoat (h) Summary (i) Lab 8
Ethical Hacking and Attack Tools
Ethical Hacking and Attack Tools Kenneth Ingham September 29, 2009 1 Course overview Attackers have at their disposal a large collection of tools that aid their exploiting systems. If you plan to defend
Designing and Coding Secure Systems
Designing and Coding Secure Systems Kenneth Ingham and Anil Somayaji September 29, 2009 1 Course overview This class covers secure coding and some design issues from a language neutral approach you can
Web Application Security: Exercise Development Approaches
Web Application Security: Exercise Development Approaches James Walden [email protected] Approaches 1. Write your own web application Students evaluate and fix your code. 2. Students write a web application
Peach Fuzzer Platform
Fuzzing is a software testing technique that introduces invalid, malformed, or random data to parts of a computer system, such as files, network packets, environment variables, or memory. How the tested
Secure Web Development Teaching Modules 1. Security Testing. 1.1 Security Practices for Software Verification
Secure Web Development Teaching Modules 1 Security Testing Contents 1 Concepts... 1 1.1 Security Practices for Software Verification... 1 1.2 Software Security Testing... 2 2 Labs Objectives... 2 3 Lab
The purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
Mobile Application Hacking for Android and iphone. 4-Day Hands-On Course. Syllabus
Mobile Application Hacking for Android and iphone 4-Day Hands-On Course Syllabus Android and iphone Mobile Application Hacking 4-Day Hands-On Course Course description This course will focus on the techniques
Linux Operating System Security
Linux Operating System Security Kenneth Ingham and Anil Somayaji September 29, 2009 1 Course overview This class is for students who want to learn how to configure systems to be secure, test the security
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT
ASL IT SECURITY XTREME XPLOIT DEVELOPMENT V 2.0 A S L I T S e c u r i t y P v t L t d. Page 1 Overview: The most dangerous threat is the one which do not have a CVE. Until now developing reliable exploits
Integrating Web Application Security into the IT Curriculum
Integrating Web Application Security into the IT Curriculum James Walden Dept. of Computer Science Northern Kentucky University Highland Heights, KY [email protected] ABSTRACT Attackers are increasingly
ensuring security the way how we do it
ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working
Monitoring, Tracing, Debugging (Under Construction)
Monitoring, Tracing, Debugging (Under Construction) I was already tempted to drop this topic from my lecture on operating systems when I found Stephan Siemen's article "Top Speed" in Linux World 10/2003.
Creating Stronger, Safer, Web Facing Code. JPL IT Security Mary Rivera June 17, 2011
Creating Stronger, Safer, Web Facing Code JPL IT Security Mary Rivera June 17, 2011 Agenda Evolving Threats Operating System Application User Generated Content JPL s Application Security Program Securing
GDB Tutorial. A Walkthrough with Examples. CMSC 212 - Spring 2009. Last modified March 22, 2009. GDB Tutorial
A Walkthrough with Examples CMSC 212 - Spring 2009 Last modified March 22, 2009 What is gdb? GNU Debugger A debugger for several languages, including C and C++ It allows you to inspect what the program
Security Tools - Hands On
Security Tools - Hands On SecAppDev 2014 Ken van Wyk, @KRvW! Leuven, Belgium 10-14 February 2014 Caveats and Warnings This is not a sales pitch for any product(s) If you want to talk to a sales person,
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda
Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current
Application Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
Integrating Tools Into the SDLC
Integrating Tools Into the SDLC FIRST Conference 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to
The Hacker Strategy. Dave Aitel [email protected]. Security Research
1 The Hacker Strategy Dave Aitel [email protected] Security Research Who am I? CTO, Immunity Inc. History: NSA->@stake -> Immunity Responsible for new product development Vulnerability Sharing Club
Advanced Linux System Administration on Red Hat
Advanced Linux System Administration on Red Hat Kenneth Ingham September 29, 2009 1 Course overview This class is for people who are familiar with basic Linux administration (i.e., they know users, packages,
Linux System Administration on Red Hat
Linux System Administration on Red Hat Kenneth Ingham September 29, 2009 1 Course overview This class is for people who are familiar with Linux or Unix systems as a user (i.e., they know file manipulation,
Evaluation of Penetration Testing Software. Research
Evaluation of Penetration Testing Software Research Penetration testing is an evaluation of system security by simulating a malicious attack, which, at the most fundamental level, consists of an intellectual
Application Security Testing. Erez Metula (CISSP), Founder Application Security Expert [email protected]
Application Security Testing Erez Metula (CISSP), Founder Application Security Expert [email protected] Agenda The most common security vulnerabilities you should test for Understanding the problems
WEB APPLICATION HACKING. Part 2: Tools of the Trade (and how to use them)
WEB APPLICATION HACKING Part 2: Tools of the Trade (and how to use them) Jonathan Eddy September 27, 2013 Last Updated September 27, 2013 MAPPING THE APPLICATION 4 2 ENUMERATING CONTENT AND FUNCTIONALITY
Security Testing OpenGGSN: a Case Study
Security Testing OpenGGSN: a Case Study Esa Tikkala, Mikko Rapeli, Kaarina Karppinen, Hannu Honkanen VTT Technical Research Centre of Finland, Oulu, Finland Abstract As systems today are more and more
KEN VAN WYK. Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY)
TECHNOLOGY TRANSFER PRESENTS KEN VAN WYK Fundamentals of Secure Coding and how to break Software MARCH 19-23, 2007 RESIDENZA DI RIPETTA - VIA DI RIPETTA, 231 ROME (ITALY) [email protected] www.technologytransfer.it
Detecting Web Application Vulnerabilities Using Open Source Means. OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008
Detecting Web Application Vulnerabilities Using Open Source Means OWASP 3rd Free / Libre / Open Source Software (FLOSS) Conference 27/5/2008 Kostas Papapanagiotou Committee Member OWASP Greek Chapter [email protected]
Penetration Testing. Types Black Box. Methods Automated Manual Hybrid. oless productive, more difficult White Box
Penetration Testing Penetration Testing Types Black Box oless productive, more difficult White Box oopen, team supported, typically internal osource available Gray Box (Grey Box) omixture of the two Methods
ABSTRACT' INTRODUCTION' COMMON'SECURITY'MISTAKES'' Reverse Engineering ios Applications
Reverse Engineering ios Applications Drew Branch, Independent Security Evaluators, Associate Security Analyst ABSTRACT' Mobile applications are a part of nearly everyone s life, and most use multiple mobile
Tools and Techniques to automate the discovery of Zero Day Vulnerabilities. A.K.A Fuzzing 101
Tools and Techniques to automate the discovery of Zero Day Vulnerabilities A.K.A Fuzzing 101 Agenda GEEKZONE Overview of fuzzing techniques Tutorials on specific open-source fuzzers Demonstrations DIY
(WAPT) Web Application Penetration Testing
(WAPT) Web Application Penetration Testing Module 0: Introduction 1. Introduction to the course. 2. How to get most out of the course 3. Resources you will need for the course 4. What is WAPT? Module 1:
Web application testing
CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration
Bug hunting. Vulnerability finding methods in Windows 32 environments compared. FX of Phenoelit
Bug hunting Vulnerability finding methods in Windows 32 environments compared FX of Phenoelit The goal: 0day What we are looking for: Handles network side input Runs on a remote system Is complex enough
Using Free Tools To Test Web Application Security
Using Free Tools To Test Web Application Security Speaker Biography Matt Neely, CISSP, CTGA, GCIH, and GCWN Manager of the Profiling Team at SecureState Areas of expertise: wireless, penetration testing,
Hands-on Security Tools
Hands-on Security Tools SecAppDev 2010 Caveats and Warnings This is not a sales pitch for any product(s) If you want to talk to a sales person, tell me Otherwise, you will NOT get calls or spam You are
protocol fuzzing past, present, future
protocol fuzzing past, present, future luiz eduardo senior systems & security engineer leduardo (at) musecurity.com Hack in the Box 07 - Kuala Lumpur Mu Security, Inc. All Rights Reserved Copyright 2007
Using Nessus In Web Application Vulnerability Assessments
Using Nessus In Web Application Vulnerability Assessments Paul Asadoorian Product Evangelist Tenable Network Security [email protected] About Tenable Nessus vulnerability scanner, ProfessionalFeed
3. Broken Account and Session Management. 4. Cross-Site Scripting (XSS) Flaws. Web browsers execute code sent from websites. Account Management
What is an? s Ten Most Critical Web Application Security Vulnerabilities Anthony LAI, CISSP, CISA Chapter Leader (Hong Kong) [email protected] Open Web Application Security Project http://www.owasp.org
90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
Threat Modeling/ Security Testing. Tarun Banga, Adobe 1. Agenda
Threat Modeling/ Security Testing Presented by: Tarun Banga Sr. Manager Quality Engineering, Adobe Quality Leader (India) Adobe Systems India Pvt. Ltd. Agenda Security Principles Why Security Testing Security
DEVELOPING SECURE SOFTWARE
DEVELOPING SECURE SOFTWARE A FOUNDATION FOR CLOUD AND IOT SECURITY Eric Baize @ericbaize Senior Director, Product Security Office EMC Corporation Chairman of SAFECode CSA EMEA Congress November 2015 1
When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.
Ethical Hacking and Countermeasures Course Description: This class will immerse the student into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Programming Flaws and How to Fix Them
19 ö Programming Flaws and How to Fix Them MICHAEL HOWARD DAVID LEBLANC JOHN VIEGA McGraw-Hill /Osborne New York Chicago San Francisco Lisbon London Madrid Mexico City- Milan New Delhi San Juan Seoul Singapore
Tuning WebSphere Application Server ND 7.0. Royal Cyber Inc.
Tuning WebSphere Application Server ND 7.0 Royal Cyber Inc. JVM related problems Application server stops responding Server crash Hung process Out of memory condition Performance degradation Check if the
Web App Security Audit Services
locuz.com Professional Services Web App Security Audit Services The unsecured world today Today, over 80% of attacks against a company s network come at the Application Layer not the Network or System
CS3600 SYSTEMS AND NETWORKS
CS3600 SYSTEMS AND NETWORKS NORTHEASTERN UNIVERSITY Lecture 2: Operating System Structures Prof. Alan Mislove ([email protected]) Operating System Services Operating systems provide an environment for
Application Security Testing
Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the
Web Application Security
E-SPIN PROFESSIONAL BOOK Vulnerability Management Web Application Security ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. COMBATING THE WEB VULNERABILITY THREAT Editor s Summary
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability
Web Application Threats and Vulnerabilities Web Server Hacking and Web Application Vulnerability WWW Based upon HTTP and HTML Runs in TCP s application layer Runs on top of the Internet Used to exchange
elearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI
Lab 8.3.1.2 Configure Basic AP Security through IOS CLI Estimated Time: 30 minutes Number of Team Members: Students will work in teams of two. Objective In this lab, the student will learn the following
Bust a cap in a web app with OWASP ZAP
The OWASP Foundation http://www.owasp.org Bust a cap in a web app with OWASP ZAP Adrien de Beaupré GSEC, GCIH, GPEN, GWAPT, GCIA, GXPN ZAP Evangelist Intru-Shun.ca Inc. SANS Instructor, Penetration Tester,
Security Testing Of (Web) Applications. Erwin Geirmaert Security Innovation
Security Testing Of (Web) Applications Erwin Geirmaert Security Innovation SECURITY INNOVATION BVBA Security Testing of (web) applications Erwin Geirnaert Security Innovation BVBA [email protected]
Homeland Security Red Teaming
Homeland Security Red Teaming Directs intergovernmental coordination Specifies Red Teaming Viewing systems from the perspective of a potential adversary Target hardening Looking for weakness in existing
Threat Modeling. Frank Piessens ([email protected] ) KATHOLIEKE UNIVERSITEIT LEUVEN
Threat Modeling Frank Piessens ([email protected] ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process
OWASP WebScarab NG FOSDEM 2008. The OWASP Foundation http://www.owasp.org/
OWASP WebScarab NG FOSDEM 2008 Rogan Dawes, WebScarab Project Lead Senior Application Security Engineer Aspect Security [email protected] Copyright 2008 - The OWASP Foundation Permission is granted to
Secure Web Development Teaching Modules 1. Threat Assessment
Secure Web Development Teaching Modules 1 Threat Assessment Contents 1 Concepts... 1 1.1 Software Assurance Maturity Model... 1 1.2 Security practices for construction... 3 1.3 Web application security
Secure Programming Lecture 9: Secure Development
Secure Programming Lecture 9: Secure Development David Aspinall, Informatics @ Edinburgh 24th February 2014 Outline Overview Lifecycle security touchpoints 1. Code review and repair 2. Architectural risk
Web Application Penetration Testing
Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel [email protected]
Rapid Security Framework (RSF) Taxonomie, Bewertungsparameter und Marktanalyse zur Auswahl von Fuzzing-Tools
Rapid Security Framework (RSF) Taxonomie, Bewertungsparameter und Marktanalyse zur Auswahl von Fuzzing-Tools Prof. Dr. Hartmut Pohl Peter Sakal, B.Sc. M.Sc. Motivation Attacks Industrial espionage Sabotage
Software Security Touchpoint: Architectural Risk Analysis
Software Security Touchpoint: Architectural Risk Analysis Gary McGraw, Ph.D. Chief Technology Officer, Cigital Founded in 1992 to provide software security and software quality professional services Recognized
In Building Security In, Gary McGraw proposes three pillars to use throughout the lifecycle: I: Applied Risk Management
Secure Programming Lecture 9: Secure Development David Aspinall, Informatics @ Edinburgh 24th February 2014 Outline Overview Lifecycle security touchpoints 1. Code review and repair 2. Architectural risk
Chapter 1 Web Application (In)security 1
Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Common Web Application Functions 4 Benefits of Web Applications 5 Web Application Security 6 "This Site Is
Real-time Debugging using GDB Tracepoints and other Eclipse features
Real-time Debugging using GDB Tracepoints and other Eclipse features GCC Summit 2010 2010-010-26 [email protected] Summary Introduction Advanced debugging features Non-stop multi-threaded debugging
Red Hat Linux Internals
Red Hat Linux Internals Learn how the Linux kernel functions and start developing modules. Red Hat Linux internals teaches you all the fundamental requirements necessary to understand and start developing
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance
Protect Your Organization With the Certification That Maps to a Master s-level Education in Software Assurance Sponsored by the U.S. Department of Homeland Security (DHS), the Software Engineering Institute
CS 253: Intro to Systems Programming
CS 253: Intro to Systems Programming Spring 2014 Amit Jain, Shane Panter, Marissa Schmidt Department of Computer Science College of Engineering Boise State University Logistics Instructor: Amit Jain http://cs.boisestate.edu/~amit
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
Web Application Report
Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012
Custom Penetration Testing
Custom Penetration Testing Compromising a Vulnerability through Discovery and Custom Exploitation Stephen Sims Advanced Penetration Testing - 2009 SANS 1 Objectives Penetration Testing Precompiled Tools
Common Security Vulnerabilities in Online Payment Systems
Common Security Vulnerabilities in Online Payment Systems Author- Hitesh Malviya(Information Security analyst) Qualifications: C!EH, EC!SA, MCITP, CCNA, MCP Current Position: CEO at HCF Infosec Limited
Web attacks and security: SQL injection and cross-site scripting (XSS)
Web attacks and security: SQL injection and cross-site scripting (XSS) License This work by Z. Cliffe Schreuders at Leeds Metropolitan University is licensed under a Creative Commons Attribution-ShareAlike
Telecom Testing and Security Certification. A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT
Telecom Testing and Security Certification A.K.MITTAL DDG (TTSC) Department of Telecommunication Ministry of Communication & IT 1 Need for Security Testing and Certification Telecom is a vital infrastructure
Source Code Review Using Static Analysis Tools
Source Code Review Using Static Analysis Tools July-August 05 Author: Stavros Moiras Supervisor(s): Stefan Lüders Aimilios Tsouvelekakis CERN openlab Summer Student Report 05 Abstract Many teams at CERN,
Threat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
Cutting Edge Practices for Secure Software Engineering
Cutting Edge Practices for Secure Software Engineering Kanchan Hans Amity Institute of Information Technology Amity University, Noida, 201301, India [email protected] Abstract Security has become a high
TOOL EVALUATION REPORT: FORTIFY
TOOL EVALUATION REPORT: FORTIFY Derek D Souza, Yoon Phil Kim, Tim Kral, Tejas Ranade, Somesh Sasalatti ABOUT THE TOOL Background The tool that we have evaluated is the Fortify Source Code Analyzer (Fortify
SAFECode Security Development Lifecycle (SDL)
SAFECode Security Development Lifecycle (SDL) Michael Howard Microsoft Matthew Coles EMC 15th Semi-annual Software Assurance Forum, September 12-16, 2011 Agenda Introduction to SAFECode Security Training
Programming with the Dev C++ IDE
Programming with the Dev C++ IDE 1 Introduction to the IDE Dev-C++ is a full-featured Integrated Development Environment (IDE) for the C/C++ programming language. As similar IDEs, it offers to the programmer
Software Design and Implementation - or, how to be a hacker
Computer Science 50 Software Design and Implementation - or, how to be a hacker In what follows, we discuss the course overview, grading, books, weekly schedule, laboratory assignments, group projects
Threat Modeling for Secure Embedded Software
SECURITY INNOVATION & KLOCWORK WHITE PAPER JUNE 2011 Threat Modeling for Secure Embedded Software As embedded software becomes more ubiquitous and connected powering everything from home appliances and
Easy Method: Blind SQL Injection
16-05-2010 Author: Mohd Izhar Ali Email: [email protected] Website: http://johncrackernet.blogspot.com Table of Contents Easy Method: Blind SQL Injection 1. Introduction... 3 2. Finding Vulnerable
Debugging & Profiling with Open Source SW Tools
Debugging & Profiling with Open Source SW Tools Ivan Giro*o igiro*[email protected] Informa(on & Communica(on Technology Sec(on (ICTS) Interna(onal Centre for Theore(cal Physics (ICTP) What is Debugging?! Iden(fying
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis
How to achieve PCI DSS Compliance with Checkmarx Source Code Analysis Document Scope This document aims to assist organizations comply with PCI DSS 3 when it comes to Application Security best practices.
Modern Binary Exploitation Course Syllabus
Modern Binary Exploitation Course Syllabus Course Information Course Title: Modern Binary Exploitation Course Number: CSCI 4968 Credit Hours: 4 Semester / Year: Spring 2015 Meeting Days: Tuesday/Friday
DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES
DISCOVERY OF WEB-APPLICATION VULNERABILITIES USING FUZZING TECHNIQUES By Michael Crouse Dr. Errin W. Fulp, Ph.D., Advisor Abstract The increasingly high volume of users on the web and their use of web
Frysk The Systems Monitoring and Debugging Tool. Andrew Cagney
Frysk The Systems Monitoring and Debugging Tool Andrew Cagney Agenda Two Use Cases Motivation Comparison with Existing Free Technologies The Frysk Architecture and GUI Command Line Utilities Current Status
<Insert Picture Here> What's New in NetBeans IDE 7.2
Slide 1 What's New in NetBeans IDE 7.2 The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated