NoSQL, No Injection !?
Wayne Huang and Kuon Ding details wayne Huang & Kuon Ding - NoSQL, No Injection.
Summary
Architecture and Background
Wayne Huang & Kuon Ding - NoSQL, No Injection !? This is a short talk on NoSQL technologies and their impacts on traditional injection threats such as SQL injection.
Vulnerability Analysis
This talk surveys existing NoSQL technologies, and then demos proof-of-concept threats found with CouchDB. We then discuss impacts of NoSQL technologies to existing security technologies such as blackbox scanning, static analysis, and web application firewalls.
Exploitation and Demonstrations
Wayne Huang has extensive experience in the security industry and is a frequent speaker at security conferences including RSA (07, 10), SyScan (08, 09), OWASP (08, 09), Hacks in Taiwan (06, 07), WWW (03, 04), PHP (07) and DSN (04). He is the first author to achieve consecutive best paper nominations at the prestigious World Wide Web (WWW) Conferences (2003, 2004), and has a co-authored the Web Application Security chapter of "Computer Security in the 21st Century" (Springer US, 2005).
Remediation and Defensive Strategies
Wayne is a PhD candidate at the EE, NTU, and has received his BS and MS in CS from NCTU. For copies of the slides and additional materials please see the DEF CON 18 Archive here:
Related talks
Main Stage·49 min
Cameron nummish Hotchkies
Cameron nummish Hotchkies explores blind sql injection automation techniques at DEF CON 12, examining blind-sql-injection and practical defenses.
Main Stage·35 min
Vangelis Stykas
Vangelis Stykas demonstrates how typical web application flaws in abandoned malware C2 infrastructure allow researchers to compromise admin panels and identify threat actors.
Main Stage·36 min
regilero
regilero demystifies HTTP request smuggling techniques, illustrating how desynchronizing reverse proxies and backend web servers leads to cache poisoning and filter bypasses.