HITB videos

Dhillon has just posted HITB videos on his site for HITB2004.
Go

Web Services: Enumeration and Profiling (Whitepaper)

Web services assessment can begin with a corporate name or some other such bit of information. This simple hint offers a wealth of information that needs to be unearthed. Focus first on locating single or multiple access points for a particular corporate. The methodology, which includes web services footprinting, discovery and search, is described in another paper (http://packetstormsecurity.org/papers/web/Defense_using_mod_security.pdf). Once an access point for a web service is uncovered, the next obvious step is to extract information from it.

Web services are deployed to invoke remote calls over HTTP/HTTPS. To make calls such as these, requires that information about the calls be shared with the end client. In the past, during the days of CORBA, developers used to share IDL (Interface Definition Language) files providing the required information over the network. Now, in the days of web services this has changed to WSDL (Web Services Definition Language). WSDL is a major source for information and can help in the enumeration process. We shall go over the enumeration process in subsequent sections.
Read Here

Web application defense at the gates – Leveraging IHttpModule (Whitepaper)

Web applications are vulnerable to many attacks, mainly due to poor input validation at the source code level. Firewalls can block access to ports but once a web application goes live and TCP ports 80 and 443 are accessible, the web application can be an easy prey for attackers. HTTP traffic is legitimate traffic for web applications; all the more reason to include application-level content-filtering over unencrypted and encrypted communication channels. Application-level content filtering is possible to some extent but may not work over HTTPS (port 443). The only way to provide a strong defense is by applying powerful content-filtering at the application-level for both TCP port 80 and TCP port 443.

The .Net framework with ASP.NET provides the IHttpModule interface access to HTTP pipes - the lowest of programming layers - before an incoming HTTP request hits the web application. This can provide defense at the gates. In this paper, we look at how one can build this sort of defense in all three aspects - coding, deployment and configuration.
Read Here

Web Application Footprints and Discovery

Serious challenges arise when doing web application assessments on web servers that host multiple virtual hosts and all this with zero knowledge about the number of web applications mapped to a single IP address. Using the manual techniques outlined in the paper, the methodology pinpoints specific ways to discover applications and enhance web application assessment with tangible results.
Read Here

Defending Web Services using Mod Security (Apache) Methodology and Filtering Techniques (Whitepaper)

Web services are vulnerable to several attacks. These attacks can lead to information leakage and further aid in remote command execution. By using WSDL an attacker can determine an access point and available interfaces for web services. These interfaces or methods take inputs using SOAP over HTTP/HTTPS. If these inputs are not defended well at the source code level, they can be compromised and exploited. ModSecurity operates as an Apache Web server module, ideal for defending web services against attacks that also include malicious /POST variable/content. This paper describes techniques to defend your web services layer using mod_security.
Infosecwriters(Read Here)

Some interesting resources on same topic.
Read Here

Web Services – Attacks and Defense (Whitepaper)

Web Services is growing at a rapid rate and bringing into focus, new security issues in the web security landscape. How do we start assessing web services deployed at any corporate location? That is the fundamental question and once again it all starts with information gathering. UDDI, WSDL and SOAP are three cornerstones of this technology and they can be powerful tools for information gathering. Universal Business Registry (UBR) can help in footprinting using UDDI. UBR and technology fingerprinting can be used to perform discovery of web services. The scope in this paper is limited to only the first phase, namely the Web Services Information Gathering Phase. The entire methodology for web services information gathering is covered in this paper. The next two phases of the Assessment methodology are enumeration and defining attack vectors, both extensive topics too. These will be taken up in later papers.
Infosecwriters (Read Here)

HITB 2004 - Slides

HITB (Hack In The Box) 2004 Presentation by shreeraj Shah: "Web Services - Attacks and Defense Strategies, Methods and Tools". The web service is the new security Lego Land. The main building blocks are UDDI, SOAP and WSDL. This presentation will briefly touch upon each of these aspects.

Read Here

Interview with star-techcentral Malaysia

[Interview during HITB 2003 KL]
Bad coding can lead to attacks
By RAVIND RAMESH

BAD web application coding is one of the main culprits behind network intrusion incidences said Shreeraj Shah, director of Net Square.

“Although it’s difficult to say if it’s the back-end services or the front-end application at fault, the chances that a system compromise was due to flawed web application code is much higher,” he said.

“This is especially so since there are more services level defences available these days,” he added.

Read Here

HITB 2003 - Slides & Presentations

Talk on web application security at KL during HITB2003
Read Here

Spot the Star by Nasscom

Presented Net Square at Nasscom forum in "Spot the Star" event. It was fun!
Read Here

CII seminar at Ahmedabad

CIT was organized by CII at Ahmedabad. My talk there.
Read Here

Web Hacking in Inodnesia

Book is published in different language in Indonesia.

Read Here

E-Shoplifting (InformIT Article)

Introduction

In the beginning, computer systems were installed to manage back-end operations and support employees in their daily tasks. As technology evolved and systems became cheaper to deploy, businesses started using computers more and more in the management of their operations. By the early 1990s, computers and computer networks had become the information backbone of most enterprises, hosting a myriad of applications that even handled complex business logic.

Read Here

Book appeared in SUN newsletter

Sun featured web hacking book

Go

Web Hacking - Attacks & Defense (Book)

AWL published my book on web hacking.

Enjoy and if you have question drop me mail.
Cheers!

Author's bio
Read Here

Architectural Threats and Countermeasures for Java Application Servers - RSA Conference 2002

Presentation on Java Application server issues.
Enjoy!
Read Here

All my security advisories

Here is a list from Security Focus..
Advisories on Java Application Servers like WebLogic, WebSphere, JRun etc.

Read Here

Some more on the same line

Read Here