Workshop: The Art of Exploiting Injection Flaws
If you have ever developed a web application you know that attackers try to exploit requests to the web server in order to inject commands sent to a database server. This attack is called SQL injection. It is done by modifying data sent through web forms or parameters that are part of a request to a web server. In theory web developers learn to avoid mistakes leading to SQL injection. In practice not every developer has the skill or the tools to prevent SQL injection due to lack of knowledge. Validating data can be hard if the data is badly defined or if the building blocks of the web application do not offer ways to normalise or sanitise data. Most developers might not even know if the frameworks they are using protects them or does nothing.
OWASP rates injection flaws as the most critical vulnerability within the Top 10 most Critical Web Application Security Risks under the OWASP Top 10 project. 80% (if not more) of all web application compromises occur by exploiting Injection flaws. Some of the recent high profile hacks include SONY PSN, Royal Navy, HBGray, Mysql.com etc.
The problem with injection is not limited to SQL. There’s XPATH inject, XML injection, code injection (into the server application or the operating system itself), XML entity injection and more creative injections yet to come. As soon as your server application exchanges data with a client and processes this data, you have to deal with injection attacks. In-transit protection such as transport layer encryption doesn’t prevent injection attacks because the client might be tricked into accepting and sending manipulated data.
Confused? Don’t know if this applies to your web application? Maybe you feel safe and believe your business logic doesn’t use any web applications. You better check this, the chances are high that you have interface that can be reached by web clients. In order to defend against injection attacks you have to know how they work and which data or which channels can be exploited for injection. You need to understand what’s going on. Then you can turn to defend your applications.
Sumit “sid” Siddharth will guide you through these steps and teach all you need to know about injection attacks. He works as Head of the Penetration Testing for 7Safe Limited in the UK and has contributed a number of whitepapers, security tools, exploits and advisories to the industry.
The workshop is intended for developers of all kinds (don’t let the term web application distract you; your code is prone to injection attacks, don’t worry), security administrators who shepherd a zoo of software, penetration testers, manager who really need a proper understanding why the company’s web site suddenly features pictures of cute cats (or worse) or anyone curious enough. Injection attacks are a major contribution to the risks endangering your information infrastructure.
This training differs from others as this focuses on only Injection Flaws
and aims to provide an in-depth knowledge on Injection Flaws.