SecDocs Feed for author Jose Palazon

[Paper] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:08:52 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Slides] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:08:27 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:07:43 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] Connection String Parameter Attacks

Tue, 11 Jan 2011 05:59:46 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] FOCA2: The FOCA Strikes Back

Tue, 11 Jan 2011 05:47:40 +0100

Authors: Chema Alonso Jose Palazon
Tags: network privacy
Event: DEFCON 18

[Audio] FOCA2: The FOCA Strikes Back

Tue, 11 Jan 2011 05:38:28 +0100

Authors: Chema Alonso Jose Palazon
Tags: network privacy
Event: DEFCON 18

[Video] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:17 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Audio] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:14 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Paper] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:12 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Slides] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:11 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Slides] Connection String Parameter Pollution Attacks

Sat, 13 Feb 2010 06:10:58 +0100

Authors: Chema Alonso Jose Palazon
Tags: database SQL Server authentication SQL injection
Event: Black Hat DC 2010
Abstract: This session is about Parameter Pollution in Connection Strings Attack. Today, a lot of tools and web applications allow users to configure dynamically a connection against a Database server. This session will demonstrate the high risk in doing this insecurely. This session will show how to steal, in Microsoft Internet Information Services, the user account credential, how to get access to this web applications impersonating the connection and taking advance of the web server credentials and how to connect against internal databases servers in the DMZ without credentials. The impact of these techniques are specially dangerous in hosting companies which allow customers to connect against control panels to configure databases.

[Paper] Connection String Parameter Pollution Attacks

Sat, 13 Feb 2010 06:10:55 +0100