"piping commands directly to a site's back end"
That can be nasty!!
It's been a busy week for high-profile web vulnerabilities, with discoveries of careless bugs on the sites of three British companies. Online banking sites for HSBC and Barclays Group and the website for The Telegraph were caught with their pants down, as hackers published screenshots and other details that showed all three …
but don't they teach you to sanitize your data on pretty much day one of the "how to write web applications" class ?
What little I know says that's the first thing you check for (and I'm self taught)
And for every web app I've had written for clients gets sent off for pen tested by a very nice company I know for a "proper" go at breaking it
Seems the bright thing to do <shrugz> though like I said Im self taught but like keeping my customers so what do I know ?
Ohh and PLEASE dont post that XKCD cartoon again - we have all see in about 30 times now and get the joke
Paris as she knows the trouble a decent penetration can cause ;)
...there are other culprits:
:: "programmers" who are hired out of the call centres because they've written a "hello world" website and so management think they must be whizzkids;
:: self-taught coders who never read a security blog or articles teaching them how to better their code so they drift along thinking they're good at their job;
:: companies who don't enforce peer review either through lack of time, or incompetence.
:: contractors who are in it for the quick buck or speedy solution (disclaimer: I am a contractor but I am not a cowboy)
:: sign-off departments who only test if something works (in IE6), not how it works if you try to break it using devious methods.
Sadly, coding for prevention takes time and businesses are loathe to spend the monies required to take the time to do a job properly, or hire the right people for the job.
Biting the hand that feeds IT © 1998–2019