DEV333. Describe each main attack Demo how the attack works Fix our poor vulnerable application! Why Script Kiddies, Why? Click to Hack.

Slides:

Advertisements

Similar presentations

4/10/2017 2:53 PM SIM202 We Don't Need No Stinkin' GUI: Command-Line Capture Techniques (Remote Options) Laura Chappell Founder, Wireshark University Founder,

Advertisements

WSV405. IPv6 Ready Logo Program

DEV302. Best Practice Visual Studio Ultimate Web Performance Tests Load Tests Load Test Rigs Visual Studio Premium Profiling Tools.

Upgrading SSIS Packages to SQL Server 2012 Sven Aelterman Lecturer in Information Systems & Web/Technology Specialist Troy University, Sorrell College.

SIM201. Announcing… copyright chappellseminars.com some hosts comply; RST = closed no = response open some hosts comply; RST = closed no = response.

WSV304 Manual Deployment High cost Fully Automated Low cost.

What's New in Microsoft Deployment Toolkit 2012 Michael Niehaus Senior Program Manager Microsoft Corporation.

OSP303. demo Status Bar Notification.

Richard Hundhausen People Process Tools Process Tools People.

Sample Fill demo WorkflowServiceHostFactory Tracking Persistence Custom Behaviour Creation Endpoint Control Endpoint Exception Behaviour.

Self Assessment COS202 a-Expense.

SIM Separate solution install paths can be taken, stand alone and SCOM integrated. Both require core AVIcode web apps and DB’s.

DBI331. Cube Measure Group Measure Partition Cube Dimension Dimension Attribute Relationship Hierarchy Level Cube Attribute Cube Hierarchy Measure.

SIM346. General information about the software application.

DEV207. SSDT Database Services Database Services Analysis Services Reporting Services Integration Services.

DEV314. Entity Data Model demo Entity Data Model.

DBI311. Existing NMS application Agent Existing NMS application Agent 0.5 KB/record 2500 records/ agent 10 agents = 25K r/s (12. 5 MB/s) 25K r/s.

SIM329. Certificate Enrollment Without CEP/CES Certificate Authority Active Directory Client Workstations LDAP RPC/DCOM.

SIM402. Kerberos, NTLM, Basic, Digest, Forms?

OSP317. Built on SharePoint Leverage one or more out of the box or custom features. These features can typically live on there own Like any other.

SIM301-R. Courtesy Of CRN Wi Fi Alliance.

SIM314 Introduction Transport Layer Summary Network Layer.

SIM335 Demo 6 7 NetApp Confidential - Internal Use Only.

Node 1Node 2Node 3Node 4Node 5 DB 1Copy 1 DB 2Copy 1 DB 3Copy 1 DB 4Copy 1 DB 5Copy 1 DB 6Copy 1 DB 7Copy 1 DB 8Copy 1 DB 9Copy.

SIM 302. Unprepared UninformedUnaware Untrained Unused.

Margin Content Padding Border.

DBI326. PhraseGoal “Data Mining”Inform actionable decisions “Machine Learning”Determine best performing algorithm.

WCL308. (While you’re sitting there, sign up for the GPanswers.com Tip of the Week … (Scan a tag.. Fill out the little form…) and enter to win a copy.

EXL321. Lync 2010 Planning tool+ Planning guides+ * new in LS significant enhancements in LS 2010.

DPR306. Process and tools Individuals and interactions over Following a plan Responding to change over Source: Comprehensive.

DPR305. Controller Model View Client Business Objects Server Business Objects Data.

MID305. AppFabric / Host WF Runtime Extensions Tracking Persistence … … Tooling VS Designer VS Debugger Rehosted Designer Workflow Activity Library.

OSP402 Required Slide Track PMs will supply the content for this slide, which will be inserted during the final scrub.

DEV211. The simplest way to create business applications for the desktop and the cloud.

SIM333 Microsoft Confidential Simplified Management Manage FPE 2010 and FPSP 2010 Server Discovery and Grouping FPSMC agent deployment Deploy.

DEV 315 –Name –Problem –Context –Forces –Solution –Invariant –Examples –Known Uses –Related patterns : Characteristics :

WPH310. Free Phone! Windows Phone 7 as a Game Platform Free Tools to Build Great Games The Game Loop Input on Windows Phone 7 Building a Game with Your.

DBI325. Monitoring Analytics Support will extend to Analysis Services in the Denali release.

DPR301 demo Executable Requirements.

Data transport Cloud Backend Data transport Cloud Backend Cloud Provider Backend Virtualization Sidechannels You Clients Logons Who’s responsibility.

VIR326. Dell Compellent always puts the right data in the right place at the right time at the right cost. That’s Fluid Data.

DEV332. Required Slide Speakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification Exam that.

DEV327. tag – you’re it! Application Tier (AT) Data Tier (DT) Configuration Database Relational Warehouse OLAP Cube Database Collection Databases.

DEV321. demo Rule: Any slide about UX must be charcoal gray or black.

#TEDEV342 A A B B I currently deploy via FTP directly to my host. My deployment is manual because I need to set permissions on the target server.

DEV203. Coded workflows Declarative workflows Web part hook-up Professional developerBusiness Analyst/Process Designer List definitions Event receivers.

Learn more: Download SCM: Join the TechNet Wiki community:

DEV349 Minifig by Dunechaser: Support the

Redeploying from on-premises to the cloud SharePoint burst out to Azure Hybrid event based applications Building a private cloud.

OSP-302. DescriptionUri All lists on a site.../_vti_bin/ListData.svc All Items in a named list.../_vti_bin/ListData.svc/MyList 2nd Item in the list.../_vti_bin/ListData.svc/MyList(2)

DEV348. demo Valid HTML5 Syntax demo.

WPH307. announcement Architect in the Microsoft Mobility Center of Excellence Created the Microsoft Mobile Line of Business Accelerator for Windows Mobile.

WSV303. I live here... DC DNS DHCP WDS Clients DC DNS WDS/DHCP DC/DNS.

DEV354. Describe your data Create screens for common tasks Author business logic Customize screen layouts Define custom queries Create custom Silverlight.

DEV325. ODATA Service metadata demo.

MID Deploy Workflow Service definition (.xamlx) T Contracts inferred from Receive / Reply activities Endpoints opened A Persistence.

WCL301. demo Basic Custom XML-file.

About Me AUTHENTICATION Identity Provider.

DEV355 Jack Swigert demo my wife demo.

DEV353. Required Slide Speakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification.

DBI401 Customer challenges Protect data-at-rest Transparent Data Encryption Data/Key separation Extensible Key Managements Use strong authentication.

Presentation transcript:

DEV333

Describe each main attack Demo how the attack works Fix our poor vulnerable application! Why Script Kiddies, Why? Click to Hack

SQL Injection SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Information Leakage Encryption

' Network enumeration Account creating/cracking Database Copying over port 80 Data Tampering Code Download Backdoors Expected Input Unexpected Input '

ALL calls are parameterized No dynamic strings Escape/Whitelist input. Audit table permissions! Use Entity Framework!! DEMO - Permissions checker code

Cross Site Scripting SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Encryption / Protecting Credentials Information Leakage

Candidate Names Included: Unauthorized Site Scripting Unofficial Site Scripting URL Parameter Script Insertion Cross Site Scripting Synthesized Scripting Fraudulent Scripting Script Injected to Web Page Evil Script User Visits Page

Cross Site Request Forgery SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Encryption / Protecting Credentials Information Leakage

GET Request Data Returned-No Action POST Request with Token Token Check->Action!

Parameter Tampering SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Encryption / Protecting Credentials Information Leakage

Client contains key field Attacker alters data (userId) on POST Wrong data updated based on new key UserId=59 UserId=1

Encryption / Protecting Credentials SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Encryption / Protecting Credentials Information Leakage

Forms Authentication Tokens Basic Credentials CookiesNTLM

Information Leakage SQL Injection Cross Site Scripting Cross Site Request Forgery Parameter Tampering Encryption / Protecting Credentials Information Leakage

Simplest Implementation in web.config

All links at: Free Trial!! PluralSite OnDemand Training Library – Free Trial!! OWASP: The Open Web Application Security Project Security Tools Microsoft Anti-Cross Site Scripting Library V4.0 (4.1 in beta!) Microsoft Code Analysis Tool.NET (CAT.NET) v1 CTP - 32 bit

Required Slide Speakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification Exam that relate to your session. Also indicate when they can find you staffing in the TLC.

Sessions On-Demand & CommunityMicrosoft Certification & Training Resources Resources for IT ProfessionalsResources for Developers Connect. Share. Discuss.

Scan the Tag to evaluate this session now on myTechEd Mobile