资源描述：
《XSS and SQL Injections_ The Tip of the Web Security Iceberg Presentation.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。
1、XSSandSQLInjections:TheTipoftheWebSecurityIcebergTobiasZander
2、@airbone42http://www.shouduzp.com/wp-content/uploads/2014/07/germany_win_champions_fifa_world_cup_2014_photos.jpgXSSCross-Site-ScriptingCross-Site-ScriptingescapeoutputHTML-TextCSVHTML-AttributeJavaScriptinHT
3、ML-AttributeCSSinJavaScriptinHTML-AttributeIllustrationfrom„SecurityimE-Commerce“/ISBN:3868021299http://xkcd.com/327/PreparedStatements$stmt=$mysqli->prepare('UPDATEusersSETemail=?WHEREid=123'‚);$stmt->bind_param('s',$email);PreparedStatements$stmt=$mysqli->prepare('UPD
4、ATEusersSETemail=?WHEREid=123'‚);$stmt->bind_param('s',$email);PreparedStatements$stmt=$mysqli->prepare('UPDATEusersSETemail=?WHEREid=123'‚);$stmt->bind_param('s',$email);DatabaseAbstraction$q=Doctrine_Query::create()->update('Account')->set('email','foo@bar.de')->where
5、('usernameLIKE?',$username);DatabaseAbstraction$q=Doctrine_Query::create()->update('Account')->set('email','foo@bar.de')->where('usernameLIKE?',$username);DatabaseAbstraction$q=Doctrine_Query::create()->update('Account')->set('email','foo@bar.de')->where('usernameLIKE?'
6、,$username);DatabaseAbstraction$q=Doctrine_Query::create()->update('Account')->set('email','foo@bar.de')->where('usernameLIKE?',$username);DatabaseAbstraction$username='A%';$q=Doctrine_Query::create()->update('Account')->set('email','foo@bar.de')->where('usernameLIKE?',
7、$username);Titanicsinkpicturehttp://www.titanicuniverse.com/wp-content/uploads/2009/10/titanic-sinking.jpgMyfavoritesfortodaySame-Origin-PolicySQL-InjectionPixelPerfectTimingClickjackingContent-Security-PolicySame-Origin-PolicySQL-Injectionhttp://tobiaszander.de/osconSa
8、me-Origin-PolicyPreventsaccesstoDOMXMLHttpRequestWebsocketsSame-Origin-PolicyIllustrationfrom„SecurityimE-Commerce“/ISBN:3868021299Cross-OriginResourceSharingTherequestissentanyway…andexecuted…alsoinjections!readyStateMeasuretimingsDetectinternalnetworkRouterJiraTime-ba
9、sedSQL-InjectionSELECTIF(SUBSTRING(user_password,1,1)=CHAR(65),BENCHMARK(5000000,ENCODE('foo','bar')),null)FRO
