July 2006 - The HP Security Laboratory Blog

The HP Security Laboratory Blog

Sort by: Most Recent | Most Viewed | Most Commented

SQL Injecting Microsoft Access

It is widely believed that retrieving data from a Microsoft Access database using SQL Injection is more difficult than more robust databases such as MySQL or SQL Server. There are two reasons for this misconception. First, widely employed “Convert/cast...

Published 07-28-2006 11:49 AM by erik.peterson
Whitelisting: Not just for Web Applications Anymore...

An interesting vulnerability was found this week in a prominent web app firewall. A user could append a pound sign (#) to the end of any URL and bypass all file type restrictions the firewall implements. This is yet another example of a fundamental problem...

Published 07-21-2006 11:44 AM by erik.peterson
The Dangers of Shared Hosting:

When you pay someone to host your website, chances are your site isn’t running on a single box all by itself. Hosting companies like GoDaddy or Rackspace use shared hosting, which means your website is stored on a computer with multiple other websites...

Published 07-14-2006 2:52 PM by erik.peterson
Blind Attack Methodologies Come of Age.

While current vulnerabilities are still a threat, a new breed of so-called “blind” vulnerabilities is coming of age. This new strain of threats are not as blatant or easily executed but can be just as dangerous as traditional exploits in the hands of...

Published 07-06-2006 5:57 PM by erik.peterson