From: 3 shool (3shool@gmail.com)
Date: Fri Aug 25 2006 - 18:06:58 EDT
Hi Tim,
The web services here are well tested and stable. They have been
tested for OWASP top ten and the owners of web service have their own
security team taking care of the security of web services.
Other things that I'm yet to try are SQL Injection on the desktop
application to see if we can get access to SQL server. Also Code
Injection and command injection are a few other things that we would
be looking at. This wil be done from the UI of the application that's
writen in C#.
Thnx again.
On 8/25/06, Tim <pand0ra.usa@gmail.com> wrote:
> Sorry for the mutiple responses but I missed the rest of what you were
> writing. The web server is an interface that can allow other systems
> to interact over a network. For example, you can often send SQL
> queries to a web server that will pass that query to the database if
> the web server does not have any input validation coded in. The
> database on the back end will then respond to the query as if it was
> supposed to. You will probably need to provide the list with more
> information if you want better feedback. If you can afford to purchase
> application testing software I would suggest you go that route
> (webinspect and such).
>
> On 8/25/06, 3 shool <3shool@gmail.com> wrote:
> > Hi,
> >
> > I'm testing a C# desktop application. During my testing so far we have
> > found security issues that lead to application crash with following
> > type of errors:
> >
> > 1. Acess Violation Acception
> > 2. Null Reference Acception
> > 3. Invalid Object Acception
> > 4. Application crash dump
> >
> > Are these issues really a security threat for a desktop application?
> >
> > We got these errors by sending junk data over the network replies that
> > this application gets from its web services. However I fail to
> > understand the security implication and risk of these exceptions.
> > Since this is a desktop application and not a web service or server
> > how would these issues impact the security of the desktop application.
> > The application doesn't open any port on the network for incoming
> > requests. What would be the best strategy to test such application?
> > What would be the points from where attacker could attack such a
> > aplication.
> >
> > I'll really appreciate some enlightening thoughts on above queries.
> >
> > Thanx in advance.
> >
> > ------------------------------------------------------------------------
> > This List Sponsored by: Cenzic
> >
> > Need to secure your web apps?
> > Cenzic Hailstorm finds vulnerabilities fast.
> > Click the link to buy it, try it or download Hailstorm for FREE.
> > http://www.cenzic.com/products_services/download_hailstorm.php
> > ------------------------------------------------------------------------
> >
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:49 EDT