Exploitation

Contributed by Corsaire and Stephen de Vries

In order to achieve business goals, organisations frequently have to develop bespoke application solutions or customise commercial off-the-shelf (COTS) packages. These range from complex back-office database applications, CRMs and asset management systems to customer-facing fat and thin applications. Corporate web-applications offer anything from a simple brochure request to a full e-business implementation.

Availability of these services is important for customers and users of the site, with any disruption directly affecting revenues, negatively impacting confidence in the company or even damaging the brand.

Contributed by Bryan Sullivan

More and more, developers are becoming aware of the threats posed by malicious code, and SQL injection in particular, and by leaving code vulnerable to such attacks. However, while SQL is the most popular type of code injection attack, there are several others that can be just as dangerous to your applications and your data, including LDAP injection and XPath injection. While these may not be as well-known to developers, they are already in the hands of hackers, and they should be of concern.

This document is in PDF format. To view it click here.

Contributed by Raj Chandel (www.hackingarticles.in)

Facebook was founded by 2004 by Harvard student Mark Zuckerberg and originally called thefacebook. It was quickly successful on campus and expanded beyond Harvard into other Ivy League schools. With the phenomenon growing in popularity, Zuckerberg enlisted two other students, Duston Moskovitz and Chris Hughes, to assist. Within months, thefacebook became a nationwide college networking website.

This document is in PDF format. To view it click here.

Contributed by Manish Saindane

The basic idea behind writing this article was to put forward a systematic approach that needs to be followed to perform a successful penetration test. It has been written keeping in mind both, existing penetration testers as well as newcomers who want to make this field as a career. People responsible for maintaining security in an organization can refer to this and know what they can expect from such an exercise.

This document is in PDF format. To view it click here.

Contributed by Aelphaeis Mangarae and restored from the Infosecwriters archives

This paper is a sequel to my “Learn Information Gathering By Example”. This paper will go through looking for Vulnerabilities in remote system(s), which is what you would do in a Penetration Test after gathering information on the target. I will be using real world examples for nearly everything in this paper.

Although I covered scanning a network range for possible targets in my last paper I will cover it again in this paper, because it is related. I am aware that 99.5 % of people will already know how to do this, and should know how to do it. For the sake of complete beginners I will cover it again. Not everything covered in this paper is entirely legal to do in some countries to remote machines with out the owner’s permission.

This document is in PDF format. To view it click here.