1. Welcome to Blackhat! Blackhat Security Briefings New Orleans- Feb 2002 Timothy M. Mullen AnchorIS.Com, Inc. Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

2. Web Vulnerability and SQL Injection Countermeasures Securing your servers from the most insidious of attacks: The demands of the Global Marketplace have made web development more complex than ever. With customer demands and competitive influences, the functions our applications must be capable of performing constantly push our development into new areas. Even with enterprise firewall solutions, hardened servers, and up-to-date web server software in place and properly configured, poor design methodology can leave our systems open for attack. Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

3. Session Overview Part I: ∙ Vulnerabilities Client-side HTML, URL Manipulation, SQL Injection ∙ Countermeasures Input Validation, Data Sanitation, Variable Typing, Procedure Structure, Permissions and ACL’s. Part II: ∙ Live Demos highlighting real-word sites with different issues, participant involvement and brainstorming (Time Permitting) Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

4. Part I Vulnerabilites ∙ Client-side HTML ∙ URL Manipulation ∙ SQL Injection Countermeasures ∙ Implementation/Setup∙ Input Validation ∙ Data Sanitation∙ Variable Typing ∙ Procedure Structure∙ Permissions and ACL’s Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

5. Vulnerabilities – Session Demos Client-side HTML Issues ∙ Web Forms ∙ Input/Select controls ∙ Hidden Fields URL Manipulation ∙ Editing the URL ∙ Session variables ∙ Cookies SQL Injection ∙ The possibilities are endless! Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

6. Countermeasures- Session Demos Implementation and Setup ∙ ADODB Connection Strings and DSN’s ∙ ODBC Error reporting ∙ Custom error pages Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

7. Countermeasures- Session Demos Input Validation ∙ Consider ALL input EVIL! ∙ Querystring count checking ∙ Data Type Validation ∙ Value/Length Checking ∙ Extents/Boundary Checking ∙ Host submission limits per unit of time Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

8. Countermeasures- Session Demos Data Sanitation ∙ REPLACE function ∙ RegExp function ∙ Custom functions / explicit declarations Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

9. Countermeasures- Session Demos Variable Typing ∙ Command object ∙ Parameter declaration ∙ Command type declaration ∙ Execute as methods Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

10. Countermeasures- Session Demos SQL Stored Procedure Structure ∙ Use stored procedures whenever possible ∙ Type cast variables ∙ Create and use Views as table sources ∙ Avoid “Select *” statements for performance as well as security ∙ sp_executeSQL procedure for ad hoc queries Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

11. Countermeasures- Session Demos Permissions and ACL’s. ∙ Open views, but lock down tables ∙ Use groups ∙ lock down xp_cmdshell, xp_sendmail or remove ∙ SQL Service context ∙ Integrated/Mixed security Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

12. Part II Live Web Demos and Feedback ∙ Expose potentially insecure implementations of web applications ∙ Discuss potential vulnerabilities and exploits ∙ Mitigation and Prevention Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

13. Web Vulnerabilities- Live Demos Real-world web application issues and feedback Discussion Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com

14. THANK YOU! Additional Resources: http://www.hammerofgod.com emailto:thor@hammerofgod.com http://www.securityfocus.com http://www.securityfocus.com http://www.securityfocus.com http://www.sqlsecurity.com http://www.sqlsecurity.com http://www.sqlsecurity.com http://heap.nologin.net/aspsec.html http://heap.nologin.net/aspsec.html http://heap.nologin.net/aspsec.html http://security.devx.com/bestdefense/default.asp http://security.devx.com/bestdefense/default.asp http://security.devx.com/bestdefense/default.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp http://www.microsoft.com/technet/treeview/default.asp?url=/technet/itsolutions/security/database/dat abase.asp Blackhat New Orleans – Feb 2002; Timothy M. Mullen, AnchorIS.Com; thor@hammerofgod.com