If you don't own the 3 OWASP books, you've failed.

We're still facing the same vulnerabilities we already have, because we are doing something wrong. Maybe it's security professionals that are doing something wrong, by not educating developers properly.

Big security companies still having problems with their websites.

Most vulnerabilities are well known.

Security people don't write code. developers do. They don't "get" security:

• Don't fix the root cause
• Don't understand the threat
• Most have never seen a vulnerability exploited

Sitting down with developers and stepping them through a vulnerability helps show them the light and they understand and think about vulnerabilities.

Talk today designed to show developers exploits in action.

Tools showed:

• Burp - proxy tool for intercepting requests
• A custom sitemap tool that Insomnia uses
• An MS-SQL Enumeration tool that takes a vulnerable url and pulls out all the DB info using the master db to enumerate tables
• ASPX Spy - if you can get this ASP.NET file up on to a server and run, it provides a UI for playing around with the OS.
• SQL Map - an automatic SQL injection tool - can enumerate the DB, even if the data is not displayed by inferring the state of the db based on the page output.

Problems shown:

• Robots.txt is not a place to list parts of your site that you don't want people to know about :)
• Buying -1 quantity of a $1000 book leads to the users credit on the shopping site increasing by $1000 :)
• XML parsing vulnerability that allows external entities to be referenced in the XML provided to a web service - which can pull the contents of a file off the server.
• Query string parameters passed to the command interpreter, and used for file names.
• PHP include let's you include PHP source from another web server (looks like you need to disable URL fopen wrappers).
• Only securing GET requests to an admin directory.
• Showed a fake version of the CCIP website with multiple problems.
• Admin interface for a website is exposed to the internet.

Open questions:

• Who owns server configuration? Architects, developers, system administrators? If server or framework config changes, then we're insecure.
• Is it security professionals job to make sure problems are corrected?