mrx wrote, > I am a little frightened that my web app will be owned and user > credentials exposed. ...
Keep that attitude when you are no longer a "noob" web-app developer and the world will be a better place. There are far too many "hack" web coders out there, and the evidence suggests that Sony employs quite a few of them... > ... I have read much on SQL injection, XSS, remote > execution, session hijacking etc. I only think I have all bases > covered, I am not 100% sure. Is there a definitive text/book/white > paper on such matters and if so could someone please let me know > where I can find this? I'm not a web-app expert at all -- I live and work in a niche necessitated by the appalling condition that is "web security" in general (I'm a malware analyst who spends much of my time looking at the stuff the bad guys who break poorly configured servers, poorly configured and/or written web-apps, etc, etc put on those compromised machines to wreak havoc further down the food chain) -- but if you're a web-app developer and do not know about OWASP or what the OWASP "Top 10" is, you're probably a shockingly bad web-app developer (but probably well able to get plenty of work at the likes of Sony). Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
