【賽迪網－IT技術報導】什麼是SQL 指令植入式攻擊？

在設計或者維護Web網站時，你也許擔心它們會受到某些卑鄙用戶的惡意攻擊。的確， 如今的Web網站開發者們針對其站點所在操作系統平台或Web 服務器的安全性而展開的討論實在太多了。不錯，IIS 服務器的安全漏洞可能招致惡意攻擊；但你的安全檢查清單不應該僅僅有 IIS 安全性這一條。有些代碼，它們通常是專門為數據驅動(data-driven) 的 Web 網站而設計的，實際上往往同其它IIS漏洞一樣存在嚴重的安全隱患。這些潛伏於代碼中的安全隱患就有可能被稱為「SQL指令植入式攻擊」 (SQL injection) 的手段所利用而導致服務器受到攻擊。

【賽 迪網-IT技術報導】聽說過灰鴿子、冰河等可以實現遠程控制，但你聽說過IE也可以實現嗎？不錯，一款基於IE的新鮮工具——rmtSvc& vIDC即可讓微軟的IE成為一個超級黑客幫凶。本文除了將為你展現rmtSvc&vIDC是如何基於IE遠程控制肉雞以外，更在如何「暗殺」殺 毒軟件、攻擊思路上有較強的指導性。

如果我問你IE能做什麼？你的答案絕對不完整！IE可不僅僅能瀏覽網頁。如果我再告訴你IE還能用來遠程控制、遠程傳輸、進程管理、代理服務，甚至遠程開啟Telnet、FTP服務等等呢？你一定覺得不可思議吧，有了rmtSvc&vIDC，這一切皆有可能！

一、有IE 想黑就黑

「為什麼安裝了防毒軟體還是會中隨身碟病毒？」

「網路上有很多避免隨身碟病毒的方法，真的有效嗎？」

「網友推薦多套防隨身碟病毒的軟體，哪一套最好用？」

作者：編輯部 2008/3/24

資安工作無法落實的原因有很多，但真的大多與技術、工具沒有太大關聯。

落實資安工作

Just how do you protect your database? Here are eight tips to consider when you are looking to lock down the structured data in your enterprise.

By Brian Prince and Chris Preimesberger

1.  Directly Monitor Your Financial Database
2.  Assess and Remediate Weaknesses
3.  Audit User Access
4.  Know How Users Use the Database
5.  Verify Transaction Authenticity
6. Require Independent Review
7. Automate Controls To Reduce Annual Audit Costs
8. Employ Encryption To Protect Data

Inside an enterprise lives an IT security professional responsible for website security. He takes his job seriously because if his employer's websites get hacked, he gets the late night call from the boss. A big part of the job requires educating developers on the importance of secure coding and informing the business owners of Web security risks. He does this because no amount of patching or firewalling will fend off an attacker with a browser. While doing everything within his power, there's still a total lack of control in protecting the websites he's responsible for. He can't fix the vulnerabilities in website(s) when they're found without developer involvement.

Does this situation sound familiar? I hear the frustration all the time. The problem is when a vulnerability is identified by either a pen-tester, developer, outsider or whomever, these are the sole and painful options: