The use user provides the data carries on the database inquiry any application procedure is SQL pours into the attack a latent goal. The database administrator is possibly unable to prevent completely in view of its database server's SQL spoon-feeding attack; But, the managers and the application procedure development personnel may handle some matters, these attack influence minimum. Then
What can the database administrator make?
Do not let the database and the Web server places on the identical Taiwan computer.
Uses the firewall or cannot route's IP address prevent to the database Internet visit. Once disposed finishes, could not retransmit from database server's data packet the Internet. Needs to increase a route on the Web server, like this could find the database server.
The disposition may trust the IP turning on and the visit (e.g., does IPSEC), which machines control to be able with the database server correspondence.
Uppers shift from the database server eliminates all demonstration script and the application procedure.
Uses a special-purpose low privilege account for each application procedure's database connection account. Do not use sa, dba, admin.
Do not allow the user or the application procedure direct visit database table. Must use visit to the database has the limited application procedure role. If the application procedure only needs to read the visit, must the database visit limit for read-only.
Memory process which the detachment has not used from the production database.
Only will be authorized the memory process which visit to application procedure's founds to the user.
“_ANY_” the authorization do not give the operating system order or the system memory process the application procedure.
What can the application procedure's designers make?
The programmers shoulder are safeguarding the Web application procedure security the important responsibility. Is designing and the code stage strengthens safely investigates ceases the procedure crack's key. Says roughly, the procedure designer must implement the following some measures at least:
Must found the specific general wrong news which the application procedure must produce. Because, pours into attack period in SQL, through the database production's default's wrong news, the aggressor may gain the valuable information, like form and fence's name.
Before gives the user service's input submission the database, confirmation user input validity. Only accepts the user input which expected, and limits its length. Attention, so long as is possible, the use white list tabulates the inspection all user input. The application procedure server firewall may use in inspecting all inputs, and only accepts these meet standards the input.
In procedure development period, uses in the Web application procedure scanning tool discovery code the crack.
Isolate the Web application procedure and the SQL database, the application procedure will request all SQL lays aside on the database server.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> network management
> Content
Category: Home
> network management