I n p u t sanitization); drop table slides New attacks and - - PowerPoint PPT Presentation

▶
i n p u t
SMART_READER_LITE
LIVE PREVIEW

I n p u t sanitization); drop table slides New attacks and - - PowerPoint PPT Presentation

Sep 27, 2022 193 likes •1.22k views

This time Continuing with Software Getting insane with Security I n p u t sanitization); drop table slides New attacks and countermeasures: SQL injection Background on web architectures A very basic web architecture Client

slide-1
SLIDE 1

This time

Getting insane with Continuing with

Software

Security

  • New attacks and countermeasures:
  • SQL injection
  • Background on web architectures

I n p u t

sanitization’);

drop table slides

slide-2
SLIDE 2

A very basic web architecture

Client Server

slide-3
SLIDE 3

A very basic web architecture

Client Server

slide-4
SLIDE 4

A very basic web architecture

Client Server

slide-5
SLIDE 5

A very basic web architecture

Browser Web server

Client Server

slide-6
SLIDE 6

A very basic web architecture

Browser Web server Database

Client Server

slide-7
SLIDE 7

A very basic web architecture

Browser Web server Database

Client Server

(Private) Data

slide-8
SLIDE 8

A very basic web architecture

Browser Web server Database

Client Server

(Private) Data

DB is a separate entity, logically (and often physically)

slide-9
SLIDE 9

SQL security

slide-10
SLIDE 10

Databases

  • Provide data storage & data manipulation
  • Database designer lays out the data into tables
  • Programmers query the database
  • Database Management Systems (DBMSes) provide
  • semantics for how to organize data
  • transactions for manipulating data sanely
  • a language for creating & querying data
  • and APIs to interoperate with other languages
  • management via users & permissions
slide-11
SLIDE 11

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-12
SLIDE 12

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

Table

slide-13
SLIDE 13

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-14
SLIDE 14

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

Table name

slide-15
SLIDE 15

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-16
SLIDE 16

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

Column

slide-17
SLIDE 17

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-18
SLIDE 18

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

Row (Record)

slide-19
SLIDE 19

Databases: basics

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-20
SLIDE 20

Database transactions

Transactions are the unit of work on a database

slide-21
SLIDE 21

Database transactions

Transactions are the unit of work on a database

“Deduct $100 from Alice; Add $100 to Bob” “Give me everyone in the User table who is
 listed as taking CMSC414 in the Classes table”

slide-22
SLIDE 22

Database transactions

Transactions are the unit of work on a database

“Deduct $100 from Alice; Add $100 to Bob” “Give me everyone in the User table who is
 listed as taking CMSC414 in the Classes table” 2 reads

2 writes

slide-23
SLIDE 23

Database transactions

Transactions are the unit of work on a database

“Deduct $100 from Alice; Add $100 to Bob” “Give me everyone in the User table who is
 listed as taking CMSC414 in the Classes table”

1 transaction

2 reads 2 writes

slide-24
SLIDE 24

Database transactions

  • Typically want ACID transactions
  • Atomicity: Transactions complete entirely or not at all
  • Consistency: The database is always in a valid state

(but not necessarily correct)

  • Isolation: Results from a transaction aren’t visible

until it is complete

  • Durability: Once a transaction is committed, it

remains, despite, e.g., power failures

Transactions are the unit of work on a database

“Deduct $100 from Alice; Add $100 to Bob” “Give me everyone in the User table who is
 listed as taking CMSC414 in the Classes table”

1 transaction

2 reads 2 writes

slide-25
SLIDE 25

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

slide-26
SLIDE 26

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

slide-27
SLIDE 27

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

slide-28
SLIDE 28

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

slide-29
SLIDE 29

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

readgood@pp.com

slide-30
SLIDE 30

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

readgood@pp.com

INSERT INTO Users Values(‘Frank’, ‘M’, 57, ...);

slide-31
SLIDE 31

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

readgood@pp.com

INSERT INTO Users Values(‘Frank’, ‘M’, 57, ...);

slide-32
SLIDE 32

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

readgood@pp.com

INSERT INTO Users Values(‘Frank’, ‘M’, 57, ...); DROP TABLE Users;

slide-33
SLIDE 33

SQL (Standard Query Language)

Users

Name Gender Age Email Password Dee F 28 dee@pp.com j3i8g8ha Mac M 7 bouncer@pp.com a0u23bt Charlie M 32 aneifjask@pp.com 0aergja Dennis M 28 imagod@pp.com 1bjb9a93 Frank M 57 armed@pp.com ziog9gga

SELECT Age FROM Users WHERE Name=‘Dee’;

28

UPDATE Users SET email=‘readgood@pp.com’
 WHERE Age=32; -- this is a comment

readgood@pp.com

INSERT INTO Users Values(‘Frank’, ‘M’, 57, ...); DROP TABLE Users;

slide-34
SLIDE 34

Server-side code

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

Website “Login code” (php) Suppose you successfully log in as $user
 if this query returns any rows whatsoever

slide-35
SLIDE 35

Server-side code

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

Website “Login code” (php) Suppose you successfully log in as $user
 if this query returns any rows whatsoever How could you exploit this?

slide-36
SLIDE 36

SQL injection

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

slide-37
SLIDE 37

SQL injection

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

frank’ OR 1=1); --

slide-38
SLIDE 38

SQL injection

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

frank’ OR 1=1); --

$result = mysql_query(“select * from Users where(name=‘frank’ OR 1=1); -- and password=‘whocares’);”);

slide-39
SLIDE 39

SQL injection

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

frank’ OR 1=1); DROP TABLE Users; -- Can chain together statements with semicolon:
 STATEMENT 1 ; STATEMENT 2

slide-40
SLIDE 40

SQL injection

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

frank’ OR 1=1); DROP TABLE Users; --

$result = mysql_query(“select * from Users where(name=‘frank’ OR 1=1); DROP TABLE Users; -- ‘ and password=‘whocares’);”);

Can chain together statements with semicolon:
 STATEMENT 1 ; STATEMENT 2

slide-41
SLIDE 41

SQL injection attacks are prevalent

5 10 15 20 2 2 2 3 2 4 2 5 2 6 2 7 2 8 2 9 2 1 2 1 1 2 1 2 2 1 3 2 1 4 2 1 5

% of vulnerabilities that
 are SQL injection

http://web.nvd.nist.gov/view/vuln/statistics

slide-42
SLIDE 42

Buffer overflow attacks are prevalent

5 10 15 20 2 2 2 3 2 4 2 5 2 6 2 7 2 8 2 9 2 1 2 1 1 2 1 2 2 1 3 2 1 4 2 1 5

% of vulnerabilities that
 are buffer overflows

http://web.nvd.nist.gov/view/vuln/statistics

slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45

SQL injection countermeasures

  • Blacklisting: Delete the characters you don’t want
  • ’
  • --
  • ;
  • Downside: “Peter O’Connor”
  • You want these characters sometimes!
  • How do you know if/when the characters are bad?
slide-46
SLIDE 46

SQL injection countermeasures

  • Check that the user-provided input is in some set of

values known to be safe

  • Integer within the right range
  • Given an invalid input, better to reject than to fix
  • “Fixes” may introduce vulnerabilities
  • Principle of fail-safe defaults
  • Downside:
  • Um.. Names come from a well-known dictionary?
  • 1. Whitelisting
slide-47
SLIDE 47

SQL injection countermeasures

  • Escape characters that could alter control
  • ’ ⇒ \’
  • ; ⇒ \;
  • - ⇒ \-
  • \ ⇒ \\
  • Hard by hand, but there are many libs & methods
  • magic_quotes_gpc = On
  • mysql_real_escape_string()
  • Downside: Sometimes you want these in your SQL!
  • 2. Escape characters
slide-48
SLIDE 48

The underlying issue

  • This one string combines the code and the data
  • Similar to buffer overflows:

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

When the boundary between code and data blurs, we open ourselves up to vulnerabilities

slide-49
SLIDE 49

The underlying issue

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

select / from / where * Users and = name $user = password $pass

slide-50
SLIDE 50

The underlying issue

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

select / from / where * Users and = name $user = password $pass

$user

slide-51
SLIDE 51

SQL injection countermeasures

$result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

  • 3. Prepared statements & bind variables

Key idea: Decouple the code and the data

slide-52
SLIDE 52

SQL injection countermeasures

$db = new mysql(“localhost”, “user”, “pass”, “DB”); $statement = $db->prepare(“select * from Users where(name=? and password=?);”); $statement->bind_param(“ss”, $user, $pass); $statement->execute(); $result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

  • 3. Prepared statements & bind variables

Key idea: Decouple the code and the data

slide-53
SLIDE 53

SQL injection countermeasures

$db = new mysql(“localhost”, “user”, “pass”, “DB”); $statement = $db->prepare(“select * from Users where(name=? and password=?);”); $statement->bind_param(“ss”, $user, $pass); $statement->execute(); $result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

Bind variables

  • 3. Prepared statements & bind variables

Key idea: Decouple the code and the data

slide-54
SLIDE 54

SQL injection countermeasures

$db = new mysql(“localhost”, “user”, “pass”, “DB”); $statement = $db->prepare(“select * from Users where(name=? and password=?);”); $statement->bind_param(“ss”, $user, $pass); $statement->execute(); $result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

Bind variables Bind variables are typed

  • 3. Prepared statements & bind variables

Key idea: Decouple the code and the data

slide-55
SLIDE 55

SQL injection countermeasures

$db = new mysql(“localhost”, “user”, “pass”, “DB”); $statement = $db->prepare(“select * from Users where(name=? and password=?);”); $statement->bind_param(“ss”, $user, $pass); $statement->execute(); $result = mysql_query(“select * from Users where(name=‘$user’ and password=‘$pass’);”);

Bind variables Bind variables are typed Decoupling lets us compile now, before binding the data

  • 3. Prepared statements & bind variables

Key idea: Decouple the code and the data

slide-56
SLIDE 56

The underlying issue

$statement = $db->prepare(“select * from Users where(name=? and password=?);”);

select / from / where * Users and = name

?

= password

?

$user $pass

slide-57
SLIDE 57

The underlying issue

$statement = $db->prepare(“select * from Users where(name=? and password=?);”);

select / from / where * Users and = name

?

= password

?

slide-58
SLIDE 58

The underlying issue

$statement = $db->prepare(“select * from Users where(name=? and password=?);”);

select / from / where * Users and = name

?

= password

?

Prepare is only applied to the leaves, so the structure of the tree is fixed

slide-59
SLIDE 59

Mitigating the impact

  • Limit privileges
  • Can limit commands and/or tables a user can access
  • Allow SELECT queries on Orders_Table but not on

Creditcards_Table

  • Follow the principle of least privilege
  • Incomplete fix, but helpful
  • Encrypt sensitive data stored in the database
  • May not need to encrypt Orders_Table
  • But certainly encrypt Creditcards_Table.cc_numbers
slide-60
SLIDE 60

Web security

slide-61
SLIDE 61

A very basic web architecture

Browser Web server Database

Client Server

(Private) Data

DB is a separate entity, logically (and often physically)

slide-62
SLIDE 62

A very basic web architecture

Browser Web server Database

Client Server

(Private) Data

DB is a separate entity, logically (and often physically) (Much) user data is part of the browser

slide-63
SLIDE 63

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL

slide-64
SLIDE 64

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Protocol ftp https tor

slide-65
SLIDE 65

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL

slide-66
SLIDE 66

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Hostname/server Translated to an IP address by DNS (more on this later)

slide-67
SLIDE 67

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL

slide-68
SLIDE 68

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server

slide-69
SLIDE 69

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server http://facebook.com/delete.php

slide-70
SLIDE 70

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server http://facebook.com/delete.php Path to a resource Here, the file home.html is dynamic content i.e., the server generates the content on the fly

slide-71
SLIDE 71

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server http://facebook.com/delete.php Here, the file home.html is dynamic content i.e., the server generates the content on the fly

slide-72
SLIDE 72

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server http://facebook.com/delete.php Here, the file home.html is dynamic content i.e., the server generates the content on the fly ?f=joe123&w=16

slide-73
SLIDE 73

Interacting with web servers

http://www.cs.umd.edu/~dml/home.html Get and put resources which are identified by a URL Path to a resource Here, the file home.html is static content i.e., a fixed file returned by the server http://facebook.com/delete.php Here, the file home.html is dynamic content i.e., the server generates the content on the fly ?f=joe123&w=16 Arguments

slide-74
SLIDE 74

Basic structure of web traffic

Browser Web server

Client Server

Database (Private) Data

slide-75
SLIDE 75

Basic structure of web traffic

Browser Web server

Client Server

slide-76
SLIDE 76

Basic structure of web traffic

Browser Web server

Client Server HTTP

slide-77
SLIDE 77

Basic structure of web traffic

Browser Web server

Client Server

  • HyperText Transfer Protocol (HTTP)
  • An “application-layer” protocol for exchanging

collections of data

HTTP

slide-78
SLIDE 78

Basic structure of web traffic

Browser Web server

Client Server

slide-79
SLIDE 79

Basic structure of web traffic

Browser Web server

Client Server User clicks

slide-80
SLIDE 80

Basic structure of web traffic

Browser Web server

Client Server HTTP Request User clicks

slide-81
SLIDE 81

Basic structure of web traffic

Browser Web server

Client Server HTTP Request User clicks

  • Requests contain:
  • The URL of the resource the client wishes to obtain
  • Headers describing what the browser can do
  • Requests be GET or POST
  • GET: all data is in the URL itself (supposed to have no side-effects)
  • POST: includes the data as separate fields (can have side-effects)
slide-82
SLIDE 82

HTTP GET requests

http://www.reddit.com/r/security

slide-83
SLIDE 83

HTTP GET requests

http://www.reddit.com/r/security

slide-84
SLIDE 84

HTTP GET requests

http://www.reddit.com/r/security User-Agent is typically a browser but it can be wget, JDK, etc.

slide-85
SLIDE 85
slide-86
SLIDE 86
slide-87
SLIDE 87

Referrer URL: the site from which
 this request was issued.

slide-88
SLIDE 88

HTTP POST requests

Posting on Piazza

slide-89
SLIDE 89

HTTP POST requests

Posting on Piazza

slide-90
SLIDE 90

HTTP POST requests

Posting on Piazza Implicitly includes data
 as a part of the URL

slide-91
SLIDE 91

HTTP POST requests

Posting on Piazza Explicitly includes data as a part of the request’s content Implicitly includes data
 as a part of the URL

slide-92
SLIDE 92

Basic structure of web traffic

Browser Web server

Client Server HTTP Request User clicks

slide-93
SLIDE 93

Basic structure of web traffic

Browser Web server

Client Server User clicks

slide-94
SLIDE 94

Basic structure of web traffic

Browser Web server

Client Server User clicks HTTP Response

slide-95
SLIDE 95

Basic structure of web traffic

Browser Web server

Client Server User clicks

  • Responses contain:
  • Status code
  • Headers describing what the server provides
  • Data
  • Cookies
  • State it would like the browser to store on the site’s behalf

HTTP Response

slide-96
SLIDE 96

<html> …… </html>

HTTP responses

slide-97
SLIDE 97

<html> …… </html> Headers Data HTTP version Status code Reason phrase HTTP responses

slide-98
SLIDE 98
slide-99
SLIDE 99
slide-100
SLIDE 100
slide-101
SLIDE 101

HTTP is stateless

  • The lifetime of an HTTP session is typically:
  • Client connects to the server
  • Client issues a request
  • Server responds
  • Client issues a request for something in the response
  • …. repeat ….
  • Client disconnects
  • HTTP has no means of noting “oh this is the same

client from that previous session”

  • With this alone, you’d have to log in at every page load
slide-102
SLIDE 102

Next time

Continuing with

Web

Security

Cookies

XSS & CSRF

Required reading for next lecture: “Web Security: Are You Part Of The Problem?” “Cross Site Request Forgery: An Introduction…”

Optional reading for this lecture:

“SQL Injection Attacks by Example”