[Security] The security craftsman - Part 7

January 8, 2009 - 21:20 CET "As you saw from your implementation, writing your own security routines isn't always a good idea", Mr. X said looking me straight in the eyes.
[...]

4 comment(s) | Permalink | | This entry has been viewed 1836 time(s).

[Security] The security craftsman - Part 6

January 5, 2009 - 22:15 CET I thought about what Mr. X said for a while.
[...]

0 comment(s) | Permalink | | This entry has been viewed 1782 time(s).

[Security] The security craftsman - Part 5

January 4, 2009 - 15:21 CET "So let's go back to the input validation", Mr. X said. "How do you want to do the validation of the names now?"
[...]

0 comment(s) | Permalink | | This entry has been viewed 2018 time(s).

[Security] The security craftsman - Part 4

January 4, 2009 - 14:17 CET "Now remember", Mr. X said, "that we are storing most of our user data in LDAP. But when we are storing orders, we store the name in our SQL database as a part of the shipping address. How do you suggest we handle LDAP injection with your approach?"
[...]

0 comment(s) | Permalink | | This entry has been viewed 1131 time(s).

[Security] The security craftsman - Part 3

January 4, 2009 - 10:17 CET After finishing the call, Mr. X came back into my office.
[...]

0 comment(s) | Permalink | | This entry has been viewed 1297 time(s).

[Security] The security craftsman - Part 2

January 3, 2009 - 11:39 CET The next morning I got my first go at a real system for a real customer. One of the company's clients had recently had a successful hacking attempt on one of their systems, and they wanted us to review and fix it.
[...]

0 comment(s) | Permalink | | This entry has been viewed 1074 time(s).

[Security] The security craftsman - Part 1

December 8, 2008 - 21:09 CET Today was a disaster - I really messed it up.
[...]

0 comment(s) | Permalink | | This entry has been viewed 1280 time(s).

[Security] Looking at some SQL injection attacks

November 11, 2008 - 19:21 CET I just posted a new blog entry over at honeynor.no with at analysis of some of the SQL-injection attacks we've seen in Norway lately. Read the full post here: http://www.honeynor.no/2008/11/11/looking-at-some-sql-injection-attacks/[...]

0 comment(s) | Permalink | | This entry has been viewed 862 time(s).

[.NET] LINQ to SQL and SQL Injection

June 19, 2008 - 00:36 CEST The last couple of days I've been attending NDC2008(Norwegian Developer Conference) here in Oslo. Mats Torgersen's talk on LINQ under the covers was quite interesting.
[...]

0 comment(s) | Permalink | | This entry has been viewed 3526 time(s).

[Security] SQL Injection to spread malware

May 28, 2008 - 08:37 CEST I just read Ronald van den Heetkamp's post about hackers using SQL-injection spread malware. The hackers are basically using SQL-injection to inject code that, when opened in a browser, will exploit a security hole in the latest version of flash.[...]

0 comment(s) | Permalink | | This entry has been viewed 1532 time(s).

[1 - 10][11 - 14]Next >

About Erlend

I'm a senior consultant at Bekk Consulting AS. This blog is about software development, with a special focus on security.

Follow me on twitter

31.08	[Security] Rails 3.0 and XSS-protection
6.07	[Security] Avoiding NoSQL-injection with MongoDB
27.06	[Security] NOSQL-injection
7.06	[.NET] Microsoft Pex - exploratory testing
18.05	[Security] Security podcasts