SQL Injection Attacks and Defense - 2009

include web application security assessment, network penetration testing
and vulnerability research. Gary is also the lead author and trainer for the
Sec-1 Certified Network Security Professional (CNSP) training program
that has seen more than 3,000 attendees since its launch.
Gary is credited by Microsoft, RSA, GFI and Marshal Software for the
discovery of security flaws within their commercial applications.
Alberto Revelli is a security researcher and the author of sqlninja, an open
source toolkit that has become a “weapon of choice” when exploiting
a SQL Injection vulnerability on a web application based on Microsoft
SQL Server. As for his day job, he works as a senior security consultant for
Portcullis Computer Security, mostly breaking into web applications and
into any other thing that happens to tickle his curiosity.
During his career he has assisted a multitude of clients including
major financial institutions, telecom operators, media and manufacturing
companies. He has been invited as a speaker to several security conferences,
including EuSecWest, CONFidence, Shakacon, and SOURCE. He is the
Technical Director of the Italian Chapter of OWASP and he is one of the
authors of the OWASP Testing Guide. Prior to joining Portcullis, Alberto
worked for Spike Reply and McKinsey&Company.
He currently resides in London, enjoying its awful weather and its
crazy nightlife together with his girlfriend.
Marco Slaviero (MSc) is an associate at SensePost, a South African
information security company focused on providing penetration
testing services to global clients in the financial services, mining and
telecommunications sectors. Marco specializes in web application
assessments with a side interest in thick applications and network
assessments.
Marco has spoken on SQL Injection at Black Hat USA, and he
developed the proof-of-concept Squeeza tool.
Marco lives with Juliette, his wonderful wife, who gave him the
space to contribute to this book.
vi