Websheltz, SQL Injection and Cross-Site Scripting is Boring - Gimme a Command Prompt.pdf

(220 KB) Pobierz

WebShellz

Presented By:

Joe McCray

joe@strategicsec.com

http://www.linkedin.com/in/joemccray

http://twitter.com/j0emccray

Strategic Security, Inc. ©

http://www.strategicsec.com/

Joe McCray.... Who the heck are you?

IT Security Consultant (Hacker)

AKA: The Black Guy at Security Conferences

Strategic Security, Inc. ©

http://www.strategicsec.com/

I Only Offer You The Truth Neo...

Strategic Security, Inc. ©

http://www.strategicsec.com/

What Are We Up Against?

News Flash:

Port Scanning is Dead & Your Firewall Is Useless!

Hackers today use client-side exploits to get into

your network, or attack your company‟s web apps.

Deal with it!

Strategic Security, Inc. ©

http://www.strategicsec.com/

3 Primary Classes Of Web Vulnerabilities

• Injection Vulnerabilities

•

SQL, XPATH, LDAP, SSI

• Abuse of Trust Vulnerabilities

•XSS, CSRF, HTTP Request Smuggling/Response Splitting

•File Handling Vulnerabilities

•RFI/LFI/Unchecked File Upload

http://www.strategicsec.com/