Monday, January 26, 2009

Drag-and-drop

In computer graphical user interfaces, drag-and-drop or DnD is the action of (or support for the action of) clicking on a virtual object and dragging it to a different location or onto another virtual object. In general, it can be used to invoke many kinds of actions, or create various types of associations between two abstract objects.

As a feature, support for drag-and-drop is not found in all software, though it is sometimes a fast and easy-to-learn technique for users to perform tasks. However, the lack of affordances in drag-and-drop implementations means that it not always obvious that an item can be dragged.

Monday, January 19, 2009

Technical vulnerabilities

• Unvalidated input:
o Tainted parameters - Parameters users in URLs, HTTP headers, and forms are often used to control and validate access to sensitive information.
o Tainted data
• Cross-Site Scripting flaws:
o XSS takes advantage of a vulnerable web site to attack clients who visit that web site. The most frequent goal is to steal the credentials of users who visit the site.
• Content Injection flaws:
o Data injection
o SQL injection - SQL injection allows commands to be executed directly against the database, allowing disclosure and modification of data in the database
o XPath injection - XPath injection allows attacker to manipulate the data in the XML database
o Command injection - OS and platform commands can often be used to give attackers access to data and escalate privileges on backend servers.
o Process injection
• Cross-site Request Forgeries

Monday, January 12, 2009

Web Applications Issues

* Scripting issues
* Sources of input: forms, text boxes, dialog windows, etc.
* Multiple Charest Encoding (UTF-8, ISO-8859-15, UTF-7, etc.)
* Regular expression checks
* Header integrity (e.g. Multiple HTTP Content Length, HTTP Response Splitting)
* Session handling/fixation
* Cookies
* Framework vulnerabilities(Java Server Pages, .NET, Ruby On Rails, Django, etc.)
* Success control: front door, back door vulnerability assessment
* Penetration attempts versus failures.

Monday, January 5, 2009

Web Template System

Dynamic web pages usually consist of a static part (HTML) and a dynamic part, which is code that generates HTML. The code that generates the HTML can do this based on variables in a template, or on code. The text to be generated can come from a database, thereby making it possible to dramatically reduce the number of pages in a site.

Consider the example of a real estate agent with 500 houses for sale. In a static web site, the agent would have to create 500 pages in order to make the information available. In a dynamic website, the agent would simply connect the dynamic page to a database table of 500 records.

In a template, variables from the programming language can be inserted without using code, thereby losing the requirement of programming knowledge to make updates to the pages in a web site. Syntax is made available to distinguish between HTML and variables. E.g. in JSP the tag is used to output variables, and in Smarty, {$variable} is used.

Many template engines do support limited logic tags, like IF and FOREACH. These are to be used only for decisions that need to be made for the presentation layer, in order to keep a clean separation from the business logic layer, or the model in the MVC pattern.