pf » How to Break Web Software
How to Break Web Software
There is a good presentation on Google Video called How To Break Web Software - A look at security vulnerabilities in web software given by Mike Andrews to Google staff. Mike's book also happens to be called How to break web software.
I really liked the session hi-jacking part of the talk, he showed a tool that visualizes the entropy (or randomness) of your session id's. An attacker can then look for weaknesses in the algorithm to guess session id's.
He also does a good job explaining why you should be concerned about XSS.
add to del.icio.usRelated Entries
- Announcing Web Application Firewall for ColdFusion - July 9, 2007
- Web Application Vulnerabilities trump Buffer Overflows - November 2, 2006
- Risks of FCKeditor Vulnerability in CF8 - July 6, 2009
- Tips for Secure File Uploads with ColdFusion - June 24, 2009
- CFPARAM for Simple String Validation - May 29, 2007
- J2EE Session Cookies on ColdFusion / JRun
- Hands on ColdFusion Security Training
- ColdFusion 9 Solr Vulnerability - Are you at Risk?
- FCKEditor Year 2010 Bug for Firefox 3.6
- jQuery UI Sortable Tutorial
- CFLogin Security Considerations
- Use varchar(max) instead of text in SQL Server
- ColdFusion SOAP Web Services and onRequestStart
RSS
Pete Freitag is a software engineer, and web developer located in central new york.
Pete's company Foundeo Inc. builds products for web developers and provides consulting services.
In 2003 Pete published the ColdFusion MX Developers Cookbook with SAMs Publishing.
More about Pete.
