Pentest 101 @ Mahanakorn Network Research Laboratory
Exploiting Blind Vulnerabilities
1. Exploiting Blind Vulnerabilities
A tale of webapp security wizard
Pichaya Morimoto
IT Security Consultant, SEC Consult (Thailand) Co.,Ltd.
GIAC Web Application Penetration Tester Certified
8. ★ Advisor for information security
★ Expert for the implementation of security processes and policies
(ISO 27001, BS 25999, GSHB)
★ Leading company for technical security audits
★ Specialist for web application security according to ONR 17700
★ Independent of product manufacturers
★ Our customers are public authorities, financial institutions and
insurance companies in Central Europe
★ Sectoral orientation (defence, public, finance, industry)
SEC Consult - Who we are
10. SEC Consult Vulnerability Lab
European leading research lab for the
identification of vulnerabilities and
the analysis of new technologies,
products and applications (security
advisories)
Integral part of the education and the
further training of the security experts
at SEC Consult
Early information of our customers
due to SEC Consult security alerts
Support of well-known manufacturers
to enhance the security of their
products
Companies and organisations SEC Consult has released security advisories for (excerpt).
For details see: http://www.sec-consult.com/72.html
18. SQL Injection
SELECT text, description FROM news WHERE
description LIKE '%let's go%'
SELECT text, description FROM news WHERE
description LIKE '%let's go%'
49. ★ ตองมี IP จริง เขาถึงไดจากอินเทอรเน็ต
★ ควรจะเปนเครื่อง Linux สะดวกกวา Windows
★ จด domain มาใชดวยจะดีมาก (ดูกันตอวาทําไม)
★ ควรเปนเครื่องใน network ที่ไมโดน block port
หรือมีการใช proxyใด ๆ ที่แกไขขอมูลเขา-ออก
Setup Server for Testing