Intercepting Filter Approach to Injection Flaws
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The growing number of web applications in the global economy has made it critically important to develop secure and reliable software to support the economy’s increasing dependence on web-based systems. We propose an intercepting filter approach to mitigate the risk of injection flaw exploitation- one of the most dangerous methods of attacking web applications. The proposed approach can be implemented in Java or .NET environments following the intercepting filter design pattern. This paper provides examples to illustrate the proposed approach.
Abstract
The growing number of web applications in the global economy has made it critically important to develop secure and reliable software to support the economy’s increasing dependence on web-based systems. We propose an intercepting filter approach to mitigate the risk of injection flaw exploitation- one of the most dangerous methods of attacking web applications. The proposed approach can be implemented in Java or .NET environments following the intercepting filter design pattern. This paper provides examples to illustrate the proposed approach.
참고문헌 (16)
- "the OWASP Top Ten is a list of vulnerabilities that require immediate remediation"[URL]
- SPI Dynamics Inc, "SQL Injection White Paper", SPI Dynamics Inc, ~ (2002)
- Advisees Consulting Group, "Writing Secure Web Applications", Advisees Consulting Group, ~ (2004)
- CERT® Coordination Center, "CERT® Advisory CA-2000-02, Malicious HTML Tags Embedded in Client Web Requests", CERT Coordination Center, Carnegie Mellon University, 15213~3890 (2000)
- Duffy, "Professional JSP Site Design" (2001), Wrox Press
- Anderson, "Professional ASP.NET 1.0" (2002), Wrox Press
- CERT® Coordination Center, "Understanding Malicious Content Mitigation for Web Developers", CERT Coordination Center, Carnegie Mellon University, 15213~3890 (2000)
- "Understanding the cause and effect of CSS (XSS) Vulnerabilities"[URL]
- W. Halfond, "Combining Static Analysis and Runtime Monitoring to Counter SQL-Injection Attacks", International ICSE Workshop on Dynamic Analysis, WODA 2005
- W. Halfond, "AMNESIA: Analysis and Monitoring for Neutralizing SQL-Injection Attacks", Proceedings of the IEEE and ACM International Conference on Automated Software Engineering, ASE 2005
- Rabek, "Detection of Injected, Dynamically Generated, and Obfuscated Malicious Code", Defense Advanced Project Agency (DARPA) (2003), ACM
- Huang, "Securing Web Application Code by Static Analysis and Runtime Protection", ~ (2004)
- Jerry Lee Ford, Jr, "Increase Your Web Traffic", Thomson Course Technology, ~, pp.fourth edition (2006)
- Joel Scramby, "Hacking Web Applications Exposed", The McGraw-Hill Companies, 238~, pp.second edition (2006)
- Stuart McClure, "Hacking Exposed, Network Security Secrets & Solutions", The McGraw-Hill Companies, 581~582, pp.fifth edition (2005)
- "Hackademix"[URL]