This content is now available in the Pluralsight course "Ethical Hacking: SQL Injection" [http://www.pluralsight.com/courses/ethical-hacking-sql-injection]You know what really strikes me about a lot of the hacks we’ve seen lately? It just seems too easy. I mean we’re seeing a huge number of attacks (an unprecedented number, by some figures) and all too often the perpetrator is a kid. I don’t mean that in a relative sense to myself as I get older, I mean literally a child. The problem, of course...

Who’s hacking us? How are we (as developers) making this possible? What are some of the common flaws we’re building into software? And what exactly is “pwned” anyway?! All these questions and more come up and get answered in the presentation I made to Developers Developers Developers! [http://lanyrd.com/2012/dddsydney/] in Sydney a few months ago. Fortunately the good folks at SSW [http://www.ssw.com.au/ssw/default.aspx] were kind enough to record and very professionally produce a number of the...

Last week, with the help of the good folks at Red Gate, I set up a little competition to give away 5 licenses [https://www.troyhunt.com/2012/09/life-without-source-control-share-your.html] of their very excellent SQL Source Control [http://www.red-gate.com/products/sql-development/sql-source-control/] product. The entry criteria was simple – share your most painful experience which could have been avoided by using source control. Many painful stories emerged but I thought it worth sharing and c...

Back around the turn of the millennium and during the final heights of the dot com boom, I found myself in London building the UX for the brand new online-only cahoot bank [http://www.cahoot.co.uk/]. (I then realised the miserable weather I was enduring was, in fact, summer and hastily returned to a balmy Aussie winter. But I digress.) As with most things dot com, days regularly stretched into nights and frequently consisted of copious amounts of both caffeine and beer. Mistakes were made. The...

Who likes being treated like they’re in a minority group? Unless it means you’re in that exclusive group of playboy (or girl) billionaires, “minority group” often ends up with you being unfairly discriminated against because you don’t represent the perceived majority. As with social discrimination, technology discrimination is frequently the product of ignorance; people often don’t understand the impact of their choices. What a lot of this boils down to is culture, or more specifically, lack of...

There are two security principles which I hold dearly but are often counterintuitive: 1. Users should be able to create any conceivable password they desire – no limits! 2. All input should be treated as hostile and properly sanitised against a whitelist. This is counterintuitive advice in so far as that second point has always been partially supported natively by ASP.NET request validation. I say “partially” because it’s not the final word in request validation [http://www.asp.ne...

Remember hash DoS [https://www.troyhunt.com/2011/12/has-hash-dos-patch-been-installed-on.html]? This was that very clever yet equally nasty little attack which meant that if you formatted the parameters in a post request juuuuust right you could take down an ASP.NET website with a mere single request. Bugger. This made for a rather unpleasant Christmas and New Year period for a number of people at Microsoft as well as sys admins the world over. Microsoft had rapidly released a the MS11-100 [htt...

As many readers and followers will know, I’ve had a bit of fun with scammers [https://www.troyhunt.com/2012/04/type-www-ok-w-w-w-d-o-t-antagonising.html] in the past. Remember those guys who call you up while you’re sitting down for dinner and tell you your computer has all sorts of nasties in it? Yeah, those guys. The blog posts I’ve made have been part of the story and inevitably the one most people are familiar with, but there are a few other things happening which I think some of you would...

It was three weeks ago now that I wrote about Lessons in website security anti-patterns by Tesco [https://www.troyhunt.com/2012/07/lessons-in-website-security-anti.html] where I pointed out a whole raft of basic, flawed practices which jeopardised the security and privacy of shoppers. These practices in and of themselves were (are) bad, but what really seemed to fire up a lot of people was Tesco’s response when I first flagged it with them: [https://twitter.com/UKTesco/status/22954214101210726...

It happened again. After 6pm, unlisted number, foreign accent. I’ve heard this before [https://www.troyhunt.com/2012/04/type-www-ok-w-w-w-d-o-t-antagonising.html]. And again before that [https://www.troyhunt.com/2012/02/scamming-scammers-catching-virus-call.html]. And again before that too [https://www.troyhunt.com/2011/10/anatomy-of-virus-call-centre-scam.html]. And again a bunch of other times where I either didn’t record it, came on a bit strong or, uh, tried to teach them some new words they...