Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

RE: Languages/platforms used for Web apps. Any stats?

from [Mark Curphey] Network Security [Permanent Link]
Subject: RE: Languages/platforms used for Web apps. Any stats?
Date: Sat, 25 Jun 2005 18:19:14 -0400 
Its also possible to write insecure apps in any language that run just fine.


See the Hacme series for a shameless plug ;-) Coldfusion and PHP versions
coming in the next few months into the integrated Hacme Suite to prove the
point

 http://www.foundstone.com/resources/s3i_tools.htm

-----Original Message-----
From: Ben Sytko [mailto:bsytko@gmail.com] 
Sent: Saturday, June 25, 2005 11:06 AM
To: webappsec@securityfocus.com
Subject: Re: Languages/platforms used for Web apps. Any stats?

One of the problems here also, its that its possible with PHP to make
insecure programs that run just fine. You can code away for days with
seemingly great working program, but if you don't take the precautions to
prevent attacks, its a recipe for disaster. As others have said, its about
knowing where the security risks are, and taking the steps to prevent them.
Using htmlentities() is a good step to help prevent XSS, and being sure to
turn off register_globals helps as well.

And Andrew, in PHP5, there is a new error flag, E_STRICT, which throws
warnings when you use deprecated functions. See:

http://us2.php.net/manual/en/ref.errorfunc.php#errorfunc.constants

-Ben
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: Languages/platforms used for Web apps. Any stats?, Gary Warner
Next by Date:  RE: Should login pages be protected by SSL?, Simon Zuckerbraun
Previous by Thread:  Re: Languages/platforms used for Web apps. Any stats?, Ben Sytko
Next by Thread:  OT: Review of CISSP Training Material, Saqib Ali
Indexes:  [Date] [Thread] [Top] [All Lists]