Defending Web Services using Mod Security (Apache) Methodology and Filtering Techniques (Whitepaper)

Web services are vulnerable to several attacks. These attacks can lead to information leakage and further aid in remote command execution. By using WSDL an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. If these inputs are not defended well at the source code level, they can be compromised and exploited. ModSecurity operates as an Apache Web server module, ideal for defending web services against attacks that also include malicious /POST variable/content. This paper describes techniques to defend your web services layer using mod_security.
Infosecwriters(Read Here)

Some interesting resources on same topic.
Read Here

Web Services – Attacks and Defense (Whitepaper)

Web Services is growing at a rapid rate and bringing into focus, new security issues in the web security landscape. How do we start assessing web services deployed at any corporate location? That is the fundamental question and once again it all starts with information gathering. UDDI, WSDL and SOAP are three cornerstones of this technology and they can be powerful tools for information gathering. Universal Business Registry (UBR) can help in footprinting using UDDI. UBR and technology fingerprinting can be used to perform discovery of web services. The scope in this paper is limited to only the first phase, namely the Web Services Information Gathering Phase. The entire methodology for web services information gathering is covered in this paper. The next two phases of the Assessment methodology are enumeration and defining attack vectors, both extensive topics too. These will be taken up in later papers.
Infosecwriters (Read Here)

HITB 2004 - Slides

HITB (Hack In The Box) 2004 Presentation by shreeraj Shah: "Web Services - Attacks and Defense Strategies, Methods and Tools". The web service is the new security Lego Land. The main building blocks are UDDI, SOAP and WSDL. This presentation will briefly touch upon each of these aspects.

Read Here

Interview with star-techcentral Malaysia

[Interview during HITB 2003 KL]
Bad coding can lead to attacks
By RAVIND RAMESH

BAD web application coding is one of the main culprits behind network intrusion incidences said Shreeraj Shah, director of Net Square.

“Although it’s difficult to say if it’s the back-end services or the front-end application at fault, the chances that a system compromise was due to flawed web application code is much higher,” he said.

“This is especially so since there are more services level defences available these days,” he added.

Read Here

HITB 2003 - Slides & Presentations

Talk on web application security at KL during HITB2003
Read Here

Spot the Star by Nasscom

Presented Net Square at Nasscom forum in "Spot the Star" event. It was fun!
Read Here

CII seminar at Ahmedabad

CIT was organized by CII at Ahmedabad. My talk there.
Read Here

Web Hacking in Inodnesia

Book is published in different language in Indonesia.

Read Here

E-Shoplifting (InformIT Article)

Introduction

In the beginning, computer systems were installed to manage back-end operations and support employees in their daily tasks. As technology evolved and systems became cheaper to deploy, businesses started using computers more and more in the management of their operations. By the early 1990s, computers and computer networks had become the information backbone of most enterprises, hosting a myriad of applications that even handled complex business logic.

Read Here

Book appeared in SUN newsletter

Sun featured web hacking book

Go

Web Hacking - Attacks & Defense (Book)

AWL published my book on web hacking.

Enjoy and if you have question drop me mail.
Cheers!

Author's bio
Read Here

Architectural Threats and Countermeasures for Java Application Servers - RSA Conference 2002

Presentation on Java Application server issues.
Enjoy!
Read Here

All my security advisories

Here is a list from Security Focus..
Advisories on Java Application Servers like WebLogic, WebSphere, JRun etc.

Read Here

Some more on the same line

Read Here