Security at the Next Level:  Are your Web applications vulnerable?
27182
(Source: HP)  Are your Web applications vulnerable? What techniques are hackers using to exploit Web-based applications and how can you protect your site? Unfortunately, most security products available today cannot adequately examine the applications that reside on your Web server! Yet these applications often provide backend access to confidential data! This paper explains web application security including a report on the top web application vulnerabilities and how your site might be open to threats such as SQL Injection, Parameter Manipulation, Common File Query, Cross-Site Scripting, and Cookie Tampering.
484719
The Client-Side Attacks section focuses on the abuse or exploitation of a Web site's users. Topics covered are content spoofing, cross-site scripting, buffer overflow, denial of service attacks, and more. By Ryan C. Barnett. 1227
82875
This week we look at attacks that target a Web site's method of determining if a user, service, or application has the necessary permissions to perform a requested action. Using various techniques, attackers can fool a Web site into increasing their privileges to protected areas. By Ryan C. Barnett. 1218
607068
As per suggestions contained in the FAQ: Herein lies a report of two identified and as-of-yet uncorrected security flaws in Scoop. &nbsp;Enough detail will be provided to assist admins in investigating and correcting the flaws, but it is the author's hope that the details of the flaws will be sufficiently obscured to prevent abuse by the undesirables. Executive summary: Through the exploitation of various unchecked privileged operations, attackers may be able to perform admin-level actions leading to data loss. &nbsp;Additionally, well-intentioned security measures combined with XSS vulnerabilities can be exercised to simulate admin-level action, resulting in data loss.
249002
Prepare yourself for "time bomb" exploits that attack web-based systems at a pre-determined time.
704303
Matthew McCool has a few reminders for developers out there thinking of using Ajax in your applications - mainly to remember that it has the potential of adding another vulnerability to your application.   Consider a registration form built out of PHP. Any aspect of your script that accepts and processes data is a potential point of attack. If you add Ajax, what youÃ¢ÂÂre doing is increasing the complexity of the application and, by extension, introducing greater vulnerability. More points of entry equal a larger attack surface, and that means potential problems for your application.   He continues his login form example and mentions a few things you could do to help protect your application and its users (including using the escaping functions built in to PHP to help remove some harmful input).
355754
Hot Fuzz Google is developing an automated tool for finding common web application vulnerabilities.â¦
408189
The SANS (SysAdmin, Audit, Network, Security) Institute has issued its latest list of 20 most critical Internet security vulnerabilities. Web servers top the list of ten vulnerabilities for Windows-based systems, and they fall second on the list for those that are Unix- or Linux-based.
189807
Browser flaw may leave you vulnerable to phishing attacks.
456097
More than 80,000 Web sites worldwide display a small green logo that proclaims them to be "Hacker Safe." Is it a promise or a target?
347402
In this new post on the PHP Security Blog, Stefan Esser brings up an interesting issue when dealing with web applications - being able to bind a script/application to a different port on the local machine.   Unfortunately the ability to bind yourself to a port and receive connections is a threat to webapplications installed on different virtual hosts on the same IP, even if other security measures in place, like tight filesystem permissions or executing PHP script with the permission of the owner.   He gives an example in PHP of how this can happen and one of the scary side effects of having it in the same domain - the cookie information is passed in. It's a simple concept that could have very bad consequences in the wrong hands.    Additionally, you don't even have to create it in PHP either. As cyberlot mentions, it could be created in any language that has socket functions. Be sure to check out the comments for more thoughts and comments on the post.
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
87414
A few of my previous columns discussed my vision of creating a more secure Internet. It involved replacing the Internet's default anonymity with pervasive authentication, from the hardware initialization, through the OS and all applications, the user, and ending with a verifiable network stream. It is my strong belief that without a complete overhaul of default authentication, malicious hacking is going to continue indefinitely.
653200
An investor's guide to service-oriented architecture
134164
Script down to the core Security researchers have begun a month-long project to highlight security flaws in PHP, the popular scripting language.â¦
197002
On the SitePoint PHP blog today, Troels Knak-Nielsen has written up an article that talks about dependencies in your applications - those little interconnections your code relies on to do more with less.   In lack of better words, I'll call this compositional programming style. It's a style which is usually more prevalent with experienced programmers. [...] There is, however, a dark side to composition - dependencies.   He starts with a definition to bring everyone up to a level field then moves on to how their used (through a "global symbol" or directly passed in) and how they can "leak" if you're not careful.    To help protect you and your code from any kind of damage down the line, Troels suggests making a container to keep objects where they need to be. He even includes an example with namespace support to make things even easier down the road.
320458
Web servers may be vulnerable to attack, security company warns.