|
|
| (39 intermediate revisions by 5 users not shown) |
| Line 1: |
Line 1: |
| − | ; '''Nov 9 - [http://www.enterprisestrategygroup.com/ESGPublications/ReportListings.asp?ReportType=briefs SDL 2008 or bust!]'''
| + | <IfLanguage Is="en"> |
| − | : "ESG believes that other ISVs should embrace an SDL model as soon as possible and that enterprise organizations should mandate that technology vendors establish a measurable and transparent SDL process by 2008 or risk losing business."
| + | This news feed is moderated by OWASP and will feature high-quality posts focused on application security that advance the field, provide useful insight, or are useful educational resources. |
| | + | </IfLanguage> |
| | + | <IfLanguage Is="es"> |
| | + | Estas noticias son moderadas por OWASP y mostrarán publicaciónes de alta calidad enfocadas en seguridad de aplicaciones de avanzada, proveen razonamiento profundo o son recursos educativos útiles. |
| | + | </IfLanguage> |
| | | | |
| − | ; '''Nov 7 - [http://www.sourceforge.net/projects/jbrofuzz JBroFuzz 0.2 Network Protocol Fuzzer Released]'''
| + | <owaspfeed/> |
| − | :JBroFuzz is a stateless network protocol fuzzer for penetration tests. Written in Java (exe also available) it provides a number of generators, as well as basic checks involving SQL injection, Cross Site Scripting (XSS), Buffer/Integer Overflows, as well as Format String Errors.
| |
| − | | |
| − | ; '''Nov 5 - [http://portal.spidynamics.com/blogs/msutton/archive/2006/09/26/How-Prevalent-Are-SQL-Injection-Vulnerabilities_3F00_.aspx 11.3% Vulnerable to SQL Injection]'''
| |
| − | : Micheal Sutton experimented with a survey of sites that have a parameter named "id" in the URL. He finds that 11.3% of them cough up a SQL error. "The statistics are significant as they provide evidence of the prevalence of web application vulnerabilities. Coverage of this issue has however been somewhat misleading as reports have suggested that it is a measure of what attackers are doing."
| |
| − | | |
| − | ; '''Nov 1 - [http://www.darkreading.com/document.asp?doc_id=109150 Don't blame the browser]'''
| |
| − | : Client side applications are all intertwined, and a flaw in one may compromise the rest. But don't forget the web applications!
| |
| − | | |
| − | ; '''Oct 25 - [http://www.computerweekly.com/Articles/2006/10/23/219377/Microsoft+takes+Vista+security+to+a+new+level+using.htm Michael Howard's advice from OWASP AppSec Conference]'''
| |
| − | : Michael argued convincingly for a comprehensive application security education program first, then use of tools, threat modeling, and code review. His presentation and all the rest are on the [[OWASP_AppSec_Seattle_2006/Agenda|conference page]]
| |
| − | | |
| − | ; [[Application Security News|Older news...]]
| |
Latest revision as of 15:30, 6 May 2012
This news feed is moderated by OWASP and will feature high-quality posts focused on application security that advance the field, provide useful insight, or are useful educational resources.
<owaspfeed/>
