Sergey Gordeychik SQADays 2008

Оценка защищенности Web- приложений Сергей Гордейчик Positive Technologies

О чем пойдет речь ,[object Object],[object Object],[object Object],[object Object]

Уязвимости Web- приложений ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Уязвимости Web- приложений http://www.webappsec.org/projects/statistics/

Подходы к защите ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

«Безопасное»??? ,[object Object]

«Безопасное»??? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

OWASP vs WSTC ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

WSTC v 2.0 WSTC v 1.0 6 классов уязвимостей 24 типа атак / уязвимостей 1 Authentication 2 Authorization 3 Client-side Attacks 4 Command Execution 5 Information Disclosure 6 Logical Attacks WSTC v 2 .0 9 классов уязвимостей 3 7 типа атак / уязвимостей 1 Authentication 2 Authorization 3 Client-Side 4 Command Execution 5 Information Disclosure 6 Logical Flaws 7 Misconfiguration 8 Protocol Abuse 9 XML Attacks

Методы и подходы ,[object Object],[object Object],[object Object],[object Object]

Анализ спецификации ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Т естирование ф ункци й ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Т естирование ф ункци й ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Fuzzing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Fuzzing ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Анализ исходного кода ,[object Object],[object Object],[object Object],[object Object],[object Object]

Статический vs Динамический ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Анализ исходного кода ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Качество качества? ,[object Object],[object Object]

Резюме ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Вопросы? ,[object Object],[object Object],[object Object]

Sergey Gordeychik SQADays 2008

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Viewers also liked

Viewers also liked (20)

Similar to Sergey Gordeychik SQADays 2008

Similar to Sergey Gordeychik SQADays 2008 (20)

Recently uploaded

Recently uploaded (9)

Sergey Gordeychik SQADays 2008