Name: Information Systems Security: 6th International Conference, Iciss 2010, Gandhinagar, India, December 17-19, 2010 (Security and Cryptology) (en Inglés)
Price: 64.17 USD
Availability: InStock
Author: somesh (edt) jha
ISBN: 9783642177132

portada Information Systems Security: 6th International Conference, Iciss 2010, Gandhinagar, India, December 17-19, 2010 (Security and Cryptology) (en Inglés)

Information Systems Security: 6th International Conference, Iciss 2010, Gandhinagar, India, December 17-19, 2010 (Security and Cryptology) (en Inglés)

Formato

Libro Físico

Editorial

Springer

Autor

somesh (edt) jha

Año

2010

Idioma

Inglés

N° páginas

260

Encuadernación

Tapa Blanda

Peso

0.95

ISBN13

9783642177132

N° edición

2010

Categorías

Medios de almacenamiento y dispositivos periféricos
Recuperación de información
Administración del sistema

Information Systems Security: 6th International Conference, Iciss 2010, Gandhinagar, India, December 17-19, 2010 (Security and Cryptology) (en Inglés)

Somesh (Edt) Jha (Autor) · Springer · Tapa Blanda

Libro Nuevo Importado

Envío: 24 a 32 días háb.

$ 128.33$ 64.17

-50%

Costos de importación incluídos en el precio ✅

Libro Nuevo

Quedan 100 unidades

$ 64.17

Llega entre el 24 Jul y el 07 Ago a Quito, Pichincha. Seleccionar ubicación

Agregar a lista de deseos

Reseña del libro "Information Systems Security: 6th International Conference, Iciss 2010, Gandhinagar, India, December 17-19, 2010 (Security and Cryptology) (en Inglés)"

2.1 Web Application Vulnerabilities Many web application vulnerabilities havebeenwell documented andthemi- gation methods havealso beenintroduced [1]. The most common cause ofthose vulnerabilities isthe insu?cient input validation. Any data originated from o- side of the program code, forexample input data provided by user through a web form, shouldalwaysbeconsidered malicious andmustbesanitized before use.SQLInjection, Remote code execution orCross-site Scriptingarethe very common vulnerabilities ofthattype [3]. Below isabrief introduction toSQL- jection vulnerability though the security testingmethodpresented in thispaper is not limited toit. SQLinjectionvulnerabilityallowsanattackertoillegallymanipulatedatabase byinjectingmalicious SQL codes into the values of input parameters of http requests sentto the victim web site. 1: Fig.1. An example of a program written in PHP which contains SQL Injection v- nerability Figure 1 showsaprogram that uses the database query function mysql query togetuserinformationcorrespondingtothe userspeci?edby the GETinput- rameterusername andthen printtheresultto the clientbrowser.Anormalhttp request with the input parameter username looks like "http://example. com/ index.php?username=bob". The dynamically created database query at line2 is "SELECT * FROM users WHERE username='bob' AND usertype='user'". Thisprogram is vulnerabletoSQLInjection attacks because mysql query uses the input value of username without sanitizingmalicious codes. A malicious code can be a stringthatcontains SQL symbols ork- words.Ifan attacker sendarequest with SQL code ('alice'-') - jected "http://example.com/index.php?username=alice'-", the query becomes "SELECT* FROM users WHERE username='alice'--' AND usertype='user'".