Home > Research_library > Application Security Whitepapers

Application Security Whitepapers

Most of the computer security white papers in the Research Library have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS SSI attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

Quick Links

General Papers

Software Security FAQ

Authors: Tanya Baccam, Ralf Durkee, Barbara L. Filkins,
Kevin Fuller, Leo McCavana, Mark Williams, Lenny Zeltser

Added: February 13, 2008

top^

Research Library

Application/Database Sec

Featuring 9 papers as of Jul 27, 2008

Achieving PCI Compliance with Log Management

SenSage - July 2008

To decide how to protect customer account data when processing credit card transactions, a posse of major credit card companies gathered and issued the Payment Card Industry Data Security Standard ("PCI DSS"). The PCI Standard is comprised of 12 sepa

Closing Internal User Visibility and Data Governance Gaps with PacketMotion

PacketMotion - April 2008

Understanding and Selecting a Database Activity Monitoring Solution

Guardium, Imperva, Secerno, Sentrigo, & Tizor - April 2008

JavaScript Hijacking

Fortify Software - August 2007

An increasing number of rich Web applications, often called Ajax applications, make use of JavaScript as a data transport mechanism. This paper describes a vulnerability we term JavaScript Hijacking.

Web Based Attacks: Justin Crist - January 4, 2008
Analyzing Attack Surface Code Coverage: Justin Seitz - November 14, 2007
Forensic Analysis of a SQL Server 2005 Database Server: Kevvie Fowler - September 28, 2007
Automated Scanning of Oracle 10g Databases: Rory McCune - August 7, 2007
Using Oracle Forensics to determine vulnerability to Zero Day exploits: Paul Wright - February 28, 2007; This paper has shown the reader what PLSQL injection is and how it can be exploited to gain DBA whilst bypassing current IDS technology. We then explored how to find PLSQL injection vulnerabilities in order to identify potential new zerodays. Then by comparing DBstates before and after January 2007 CPU installation both silently fixed bugs and mistakenly omitted fixes were identified in the CPU installation process. A differentiation was made between potential vectors of SQL injection such as triggers and the actual underlying source of vulnerability in dependency code. The process of tracing back the dependencies to join the vector to the source of the vulnerability were shown. The best verification of vulnerability was then used i.e. reading the code itself. The change made at code level by the CPU installation was inspected thus identifying the use of prepared statements by Oracle, in the patched code in order to secure against SQL injection.

top^