June 2006
The reign of bots
by Sam Varughese, CISSP, SCSA
I have often wondered how attackers get enough systems to mount Distributed Denial of Service attacks. How do they manage to time and control these attacks? In a typical Distributed Denial of Service (DDoS) attack, thousands of systems attack a victim and take it offline. Attackers first compromise a large number of machines and then setup backdoors on them. The backdoors listen for commands from their masters - they perform a coordinated attack at their master’s bidding. This network of compromised systems, working under a central command is called a ‘botnet’… more →
Dodging the spiders
by Shalini Gupta
Web spider is a software program that traverses pages in the World Wide Web in an automated manner and extracts information from web pages. They are also known as web crawlers or web robots. Web spiders can read the HTML content and hence can read both the visible and non-visible parts of the webpage. Spiders cannot access the contents that require authentication or authorization. Spiders can search for data across websites much quicker and deeper than humans can ever do.… more →
Are stored procedures safe against SQL injection?
by Santosh Kumar
Stored procedures are widely used due to the benefits like encapsulation of business logic in a single entity, strong validation, faster execution and exception handling. But are they safe against SQL injection attacks? Not always. SQL injection is possible if the dynamic SQL inside the stored procedure is not handled properly… more →
Quiz: Directory Traversal Attacks
It is very essential to control the access to web content for running a secure web server. Directory traversal is an exploit that takes advantage of the lack of controls on the web server to access restricted directories and execute commands. So how can we prevent these directory traversal attacks on the web servers?
- Applying latest security patches
- Turning off directory-browsing
- Performing strong input validation with white lists
- Placing web-root directories and virtual directories on a separate partition from the system files
- Using tools
- All of the above.
Review: Head Rush Ajax
by Brett McLaughlin
If you have read a Head First book, you will be very comfortable with Head Rush Ajax. Visual metaphors, humor and surprise in these books engage the reader thoroughly. Having heard the buzzword called AJAX, you may be eager to learn it quickly. This unpretentious book is just right for you. … more →