APPLICATION PENETRATION TEST SUPER VEDA

More documents

Recommendations

Info

Application Penetration Test for Super Veda- Sample Report -• Using common HTTP knowledge a user can use theTRACE directive in order to query the server for its typeand the OS type. Such a query results in the Serverparameter returned, indicating the fact that the site isoperating on Microsfot-IIS/5.0 server.ImpervaPage32 of73
Application Penetration Test for Super Veda- Sample Report -6 RECOMMENDATIONSImplementing the following recommendations will eliminate the abovementioned problems:6.1 AVOIDING SQL INJECTIONThe following recommendations refer to all pages that are susceptible toSQL Injection. This includes:• showproducts.asp• proddetails.asp• addcomments.asp• dosearch.asp• getstates.asp• login.aspThe best way to avoid SQL Injection is by using prepared statements,rather than using string queries. With a prepared statement, the syntax ofthe statement is first set, and only later the parameters are transferred,ensuring that there is no possible mix between the SQL syntax and theparameter (unlike string queries, that mix, during the creation of the string,the parameters and the syntax).In addition, it is recommended that sanity checks will be performed oneach received parameter before processing it. All ID parameters (such asCatID, ProdID, etc.), can be easily validated by verifying they contain onlydigits. Other parameters may have only specific values, or should containonly alphanumeric characters.ImpervaPage33 of73
Page 1 and 2: APPLICATION PENETRATION TESTSUPER V
Page 3 and 4: REFERENCESREF DOCUMENT VERSION DATE
Page 5 and 6: 5.6 Script Injection into User’s
Page 7 and 8: Application Penetration Test for Su
Page 31: Application Penetration Test for Su
Page 73: Application Penetration Test for Su

APPLICATION PENETRATION TEST SUPER VEDA

Create successful ePaper yourself

Delete template?

Save as template?