Problems with Penetration Testing
Nov 10, 2008, 23:33 (1 Talkback[s])
(Other stories by Kenneth Van Wyk)
"A perfectly natural human response to this message is to
retreat and patch the software to stop that SQL syntax from being
injected into the Web application. The developers are likely to
write some logic that goes like: if (SQL syntax is present in an
input) disallow the input.
"Then, the pen test is repeated, the problem is resolved, and
everyone is happy. Right? Wrong.
"The problem with this approach is that it is almost always a
negative model, not a positive one. That is, the programmers will
naturally be drawn to checking a “blacklist” of banned
SQL syntax, and then disallowing the input. This type of negative
validation can invariably be broken by a determined adversary."
Testing SIP Security on a Budget, Part 1(Oct 02, 2008)
- New Linux Phone Can 'pwn' Wi-Fi(Sep 23, 2008)
- With Linux, Even Rootkits Are Open Source(Sep 10, 2008)
- Network Security Toolkit Distribution Aids Network Security Administrators(Jul 25, 2008)
- Test Your Environment's Security with BackTrack(Jun 17, 2008)
- Metasploit 3.0 Doesn't Pwn Systems, Black Hats Pwn Systems(May 07, 2007)
- Linux.com: Fear the Metasploit Framework(Sep 28, 2006)
- Linux.com: Point, Click, Root: System Exploitation with Open Tools(Sep 22, 2006)