Certified Secure Programmer


Feb 16, 2014 (7 years and 5 months ago)


Certified Secure Programmer
Duration: 5 days
Class Description
Class Overview
EC-Council’s Certified Secure Programmer and Certified Secure Application Developer are being
offered to provide the essential and fundamental skills to programmers and application developers in
secure programming. The most prevalent reason behind buggy code and vulnerabilities being exploited
by hackers and malicious code is the lack of adoption of secure coding practices.

The Certified Secure Programmer and Certified Secure Application Developer programs will ensure that
programmers and developers are exposed to the inherent security drawbacks in various programming
languages or architectures. They will be further trained to exercise secure programming practices to
overcome these inherent drawbacks in order to preempt bugs from the code.

Certified Secure Programmer lays the basic foundation required by all application developers and
development organizations to produce applications with greater stability and posing lesser security risks
to the consumer. The Certified Secure Application Developer standardizes the knowledge base for
application development by incorporating the best practices followed by experienced experts in the
various domains.

Table of Contents:
Lesson 1: Introduction to Secure Coding
Topic 1A: Secure Coding
Topic 1B: Common Security Mistakes
Topic 1C: Why Security Mistakes Are Made
Topic 1D: Need for Secure Programming
Topic 1E: Building Blocks of Software Security
Topic 1F: Types of Security Vulnerabilities
Topic 1G: Vulnerability Cycle
Topic 1H: Types of Attacks
Topic 1I: Hackers and Attackers
Topic 1J: Risk Assessment and Threat Modeling
Topic 1K: STRIDE Threat Model
Topic 1L: Common Criteria
Topic 1M: Security Architecture
Topic 1N: Security Principles
Topic 1O: Secure Development Checklists
Topic 1P: Use of Privilege

Lesson 2: Designing Secure Architecture
Topic 2A: Introduction to Secure Architecture
Topic 2B: Application Security
Topic 2C: Factors Affecting Application Security
Topic 2D: Software Engineering and System
Development Life Cycle (SDLC)
Topic 2E: Software Development Life Cycle
(SDLC) Phases
Topic 2F: Software Methodology Models
Topic 2G: Agile Methodologies
Topic 2H: Extreme Programming (XP)
Topic 2I: Unified Modeling Language (UML)
Topic 2J: Vulnerabilities and Other Security Issues
in a Software Applications
Topic 2K: Security Through Obscurity
Topic 2L: Buffer Overflows
Topic 2M: Format String Vulnerabilities and Race
Topic 2N: Locking Problems
Topic 2O: Exception Handling
Topic 2P: Fundamentals of Control Granularity
Topic 2Q: Fail Safe Design Strategies Concepts
Topic 2R: Input and Parameter Validation
Topic 2S: Encrypting Secrets in Memory and
Topic 2T: Scrubbing Information
Topic 2U: Privilege Levels for Information Access
Topic 2V: Loose Coupling
Topic 2W: High Cohesion
Topic 2X: Change Management and Version
Topic 2Y: Software Development Best Practices

Lesson 3: Cryptography
Topic 3A: Introduction to Cryptography
Topic 3B: Encryption
Topic 3C: Decryption
Topic 3D: Use Of Cryptography
Topic 3E: Classical Cryptographic Techniques
Topic 3F: Modern Cryptographic Techniques
Topic 3G: Cipher
Topic 3H: RSA (Rivest Shamir Adleman)
Topic 3I: Example: RSA Algorithm
Topic 3J: RSA Attacks
Topic 3K: Implementing RSA in C++
Topic 3L: Data Encryption Standard (DES)
Topic 3M: DES Overview
Topic 3N: Implementation of DES in Java
Topic 3O: RC4, RC5, RC6, Blowfish Overview
Topic 3P: RC5
Topic 3Q: Blowfish Algorithm in C
Topic 3R: Message Digest Functions
Topic 3S: One-way Bash Functions
Topic 3T: MD5
Topic 3U: Implementing MD5 in Java
Topic 3V: Secure Hash Algorithm
Topic 3W: Implementing SHA in Java
Topic 3X: SSL (Secure Sockets Layer)
Topic 3Y: What is SSH?
Topic 3Z: Algorithms and Security
Topic 3AA: Disk Encryption
Topic 3AB: Government Access to Keys (GAK)
Topic 3AC: Digital Signature
Topic 3AD: Components of a Digital Signature
Topic 3AE: Method of Digital Signature
Topic 3AF: Use of Digital Signature
Topic 3AG: Digital Signature Standard
Topic 3AH: Digital Signature Algorithm:
Signature Generation/Verification
Topic 3AI: Digital Signature Algorithms: ECDSA,
ElGamal Signature Scheme
Topic 3AJ: Challenges and Opportunities
Topic 3AK: Digital Certificates
Topic 3AL: Creating and Verifying a Simple XML
Digital Signature in C#
Topic 3AM: Cleversafe Grid Builder
Topic 3AN: Pretty Good Privacy
Topic 3AO: CypherCalc
Topic 3AP: Command Line Scriptor
Topic 3AQ: CryptoHeaven
Topic 3AR: Cryptanalysis
Topic 3AS: Cryptography Attacks
Topic 3AT: Brute-Force Attack
Topic 3AU: The distributed.net Organization
Topic 3AV: Summary

Lesson 4: Buffer Overflows
Topic 4A: Buffer Overflows
Topic 4B: Reasons for Buffer Overflow Attacks
Topic 4C: Why Are Programs/Applications
Topic 4D: Understanding Stacks
Topic 4E: Understanding Heaps
Topic 4F: Stack-based Buffer Overflow
Topic 4G: Heap-based Buffer Overflow
Topic 4H: How to Detect Buffer Overflows in a
Topic 4I: Attacking a Real Program
Topic 4J: Defense Against Buffer Overflows
Topic 4K: Return Address Defender (RAD)
Topic 4L: Tool to Defend Buffer Overflow:
Topic 4M: Tool to Defend Buffer Overflow:
Immunix System
Topic 4N: Vulnerability Search – ICAT
Topic 4O: Valgrind
Topic 4P: Insure++
Topic 4Q: Buffer Overflow Protection Solution:
Topic 4R: Comparing Functions of libc and
Topic 4S: Simple Buffer Overflow in C
Topic 4T: Code Analysis
Topic 4U: Summary

Lesson 5: Secure C and C++ Programming
Topic 5A: Introduction of C/C++
Topic 5B: Vulnerable C/C++ Functions
Topic 5C: C/C++ Vulnerabilities
Topic 5D: GCC Extension to Protect Stack-
Smashing Attacks
Topic 5E: Heap-Based Buffer Overflow
Topic 5F: Off By One/Five Errors
Topic 5G: Double Free Vulnerablility
Topic 5H: Secure Memory Allocation Tips
Topic 5I: Symmetric Encryption
Topic 5J: Blowfish Algorithm in C
Topic 5K: Public Key Cryptography
Topic 5L: Networking
Topic 5M: Creating an SSL Client in C++
Topic 5N: Creating an SSL Server
Topic 5O: Random Number Generation Problem
Topic 5P: Random Number API
Topic 5Q: Anti-Tampering
Topic 5R: Erasing Data from Memory Securely
Using C/C++
Topic 5S: Preventing Memory From Being Paged
to Disk
Topic 5T: Using Variable Arguments Properly
Topic 5U: Signal Handling
Topic 5V: Encapsulation in C++
Topic 5W: Best Practices for Input Validation
Topic 5X: Code Profiling And Memory Debugging
Tool: Val grind
Topic 5Y: Summary

Lesson 6: Secure Java and JSP Programming
Topic 6A: Introduction to Java
Topic 6B: Java Virtual Machine (JVM)
Topic 6C: Java Security
Topic 6D: Sandbox Model
Topic 6E: Security Issues with Java
Topic 6F: SQL Injection Attack
Topic 6G: Preventive Measures for SQL Injection
Topic 6H: URL Tampering
Topic 6I: Denial-of-Service (DoS) Attack on
Topic 6J: DoS from Opening Untrusted Windows
Topic 6K: Preventing DOS Attacks
Topic 6L: .Class File Format
Topic 6M: Byte Code Attack
Topic 6N: Reverse Engineering/ Decompilation by
Topic 6O: Obfuscation Tools: Jmangle
Topic 6P: Cinnabar Canner
Topic 6Q: Byte Code Verifier
Topic 6R: Class Loader
Topic 6S: Building a SimpleClassLoader
Topic 6T: Security Manager
Topic 6U: jarsigner - JAR Signing and Verification
Topic 6V: Signing an Applet Using RSA-Signed
Topic 6W: Signing Tools
Topic 6X: Getting RSA Certificates
Topic 6Y: Bundling Java Applets as JAR Files
Topic 6Z: Signing Java Applets Using Jarsigner
Topic 6AA: Signing Java Applets Using Netscape
Signing Tool
Topic 6AB: Security Extensions
Topic 6AC: Java Authentication and Authorization
Service (JAAS)
Topic 6AD: Java Cryptographic Extension (JCE)
Topic 6AE: Java(TM) Secure Socket Extension
Topic 6AF: Creating Secure Client Sockets
Topic 6AG: Creating Secure Server Sockets
Topic 6AH: Choosing the Cipher Suites
Topic 6AI: Java GSS Security
Topic 6AJ: Security From Untrusted User Input
Topic 6AK: Cross Site Scripting
Topic 6AL: Overcoming Cross Site Scripting
Topic 6AM: Permissions in Java
Topic 6AN: How to create new types of
Topic 6AO: Security Policy
Topic 6AP: Specifying an additional Policy File at
Topic 6AQ: Policy Tool
Topic 6AR: Best practices for developing secure
Java Code
Topic 6AS: Summary

Lesson 7: Secure Java Script and VB Script
Topic 7A: Script: Introduction
Topic 7B: JavaScript Vulnerability
Topic 7C: XSS Attacks
Topic 7D: Avoiding XSS?
Topic 7E: JavaScript Hijacking
Topic 7F: Defending Against JavaScript Hijacking
Topic 7G: Decline Malicious Requests
Topic 7H: Prevent Direct Execution of the
JavaScript Response
Topic 7I: Malicious Script Embedded in Client
Web Requests
Topic 7J: Malicious Script Embedded in Client
Web Requests: Effects
Topic 7K: Malicious Script Embedded in Client
Web Requests: Solution
Topic 7L: Tool: Thicket Obfuscator for JavaScript
Topic 7M: JavaScript Security in Mozilla
Topic 7N: Netscape's SignTool
Topic 7O: Privileges
Topic 7P: Tool for Encryption: TagsLock Pro
Topic 7Q: Jash: Javascript Command-Line
Debugging Tool
Topic 7R: Tool: Script Encoder
Topic 7S: Tool: Scrambler
Topic 7T: VBScript: CryptoAPI Tools
Topic 7U: Signing A Script (Windows Script Host)
Topic 7V: Verifying a Script
Topic 7W: Signature Verification Policy
Topic 7X: Software Restriction Policies for
Windows XP
Topic 7Y: Designing a Software Restriction Policy
Topic 7Z: Creating Additional Rules
Topic 7AA: Blocking Malicious Scripts
Topic 7AB: Summary

Lesson 8: Secure ASP Programming
Topic 8A: ASP- Introduction
Topic 8B: Improving ASP Design
Topic 8C: Using Server-Side Includes
Topic 8D: Taking Advantage of VBScript Classes
Topic 8E: Using Server.Execute
Topic 8F: Using Server.Transfer
Topic 8G: The #include Directive
Topic 8H: .BAK Files on the Server
Topic 8I: Programming Errors
Topic 8J: Detecting Exceptions with Scripting
Language Error-Handling Mechanisms
Topic 8K: Using VBScript to Detect an Error
Topic 8L: Using Jscript to Detect an Error
Topic 8M: Notifying the Support Team When an
Error Occurs Using CheckForError
Topic 8N: Attacks on ASP
Topic 8O: ASP DypsAntiSpam: A CAPTCHA for
Topic 8P: Preventing Automatic Submission With
Topic 8Q: CAPTCHA: Examples
Topic 8R: Using Database and ASP Sessions to
Implement ASP Security
Topic 8S: Step 1: Create A User Database Table
Topic 8T: Step 2: Create And Configure The
Virtual Directory
Topic 8U: Step 3: Create The Sample Pages
Topic 8V: Step 4: Add Validation Code To Pages
Topic 8W: Protecting Your ASP Pages
Topic 8X: Encoding ASP Code: Script Encoder
Topic 8Y: Protecting Passwords of ASP Pages
with a One-way Hash Function
Topic 8Z: ASP Best Practices
Topic 8AA: ASP Best Practices: Error Handling
Topic 8AB: Summary

Lesson 9: Secure Microsoft.NET Programming
Topic 9A: Common Terminology
Topic 9B: Microsoft .NET: Introduction
Topic 9C: .NET Framework
Topic 9D: Security Policy Levels
Topic 9E: Security Features in .NET
Topic 9F: Key Concepts in .NET Security
Topic 9G: Code Access Security (CAS)
Topic 9H: Evidence-Based Security
Topic 9I: Role-Based Security
Topic 9J: Declarative and Imperative Security
Topic 9K: Cryptography
Topic 9L: Generate Key for Encryption and
Topic 9M: Symmetric Encryption in .Net
Topic 9N: Asymmetric Encryption in .Net
Topic 9O: Symmetric Decryption in .Net
Topic 9P: Asymmetric Decryption in .Net
Topic 9Q: Protecting Client and Server Data Using
Topic 9R: Cryptographic Signatures
Topic 9S: Write a Signature in .Net
Topic 9T: Verify a Signature in .Net
Topic 9U: Ensuring Data Integrity with Hash
Topic 9V: Hash Code Generation
Topic 9W: Verification of Hash Code
Topic 9X: Permissions
Topic 9Y: Code Access Permissions
Topic 9Z: Identity Permissions
Topic 9AA: Role-Based Security Permissions
Topic 9AB: SkipVerification
Topic 9AC: Stack Walk
Topic 9AD: Writing Secure Class Libraries
Topic 9AE: Runtime Security Policy
Topic 9AF: Step-By-Step Configuration of
Runtime Security Policies
Topic 9AG: Creating a Security Policy
Deployment Package
Topic 9AH: Type Safety
Topic 9AI: Canonicalization
Topic 9AJ: Access Control List Editor
Topic 9AK: Securing User Credentials and Logon
Topic 9AL: Obfuscation
Topic 9AM: Dotfuscator: .NET Obfuscator Tool
Topic 9AN: Administration Tool: Authorization
Manager (AzMan) with ASP.Net
Topic 9AO: ASP.NET Security Architecture
Topic 9AP: Authentication and Authorization
Topic 9AQ: URL Authorization
Topic 9AR: File Authorization
Topic 9AS: Windows Authentication
Topic 9AT: Forms Authentication
Topic 9AU: Passport Authentication
Topic 9AV: Custom Authentication
Topic 9AW: Implementing Custom Authentication
Topic 9AX: Configuring Security with
Topic 9AY: Process Identity for ASP.NET
Topic 9AZ: Impersonation
Topic 9BA: Impersonation Sample Code
Topic 9BB: Secure Communication
Topic 9BC: Storing Secrets
Topic 9BD: Options for Storing Secrets in
Topic 9BE: Web.config Vulnerabilities
Topic 9BF: Securing Session and View State
Topic 9BG: Web Form Considerations
Topic 9BH: Securing Web Services
Topic 9BI: Secure Remoting
Topic 9BJ: Create a Remotable Object
Topic 9BK: Secure Data Access
Topic 9BL: .NET Security Tools
Topic 9BM: Code Access Security Policy Tool:
Topic 9BN: Certificate Creation Tool:
Topic 9BO: Certificate Manager Tool:
Topic 9BP: Certificate Verification Tool:
Topic 9BQ: Permissions View Tool: Permview.exe
Topic 9BR: PEVerify Tool: Peverify.exe
Topic 9BS: Best Practices for .NET Security
Topic 9BT: Summary

Lesson 10: Secure PHP Programming
Topic 10A: Introduction to PHP (Hypertext
Topic 10B: PHP Security Blunders
Topic 10C: Security Sensitive PHP Functions: File
Topic 10D: Security Sensitive PHP Functions:
Topic 10E: PHP Vulnerabilities
Topic 10F: Common PHP Attacks
Topic 10G: Secure PHP Practices
Topic 10H: Best Practices for PHP Security
Topic 10I: Acunetix Web Vulnerability Scanner
Topic 10J: Encryption Software: PHP Codelock
Topic 10K: Zend Guard
Topic 10L: POBS
Topic 10M: Summary

Lesson 11: Secure PERL Programming
Topic 11A: Introduction: Practical Extraction and
Report Language (PERL)
Topic 11B: Common Terminology
Topic 11C: Security Issues in Perl Scripts
Topic 11D: Basic User Input Vulnerabilities
Topic 11E: Overcoming Basic User Input
Topic 11F: Insecure Environmental Variables
Topic 11G: Algorithmic Complexity Attacks
Topic 11H: Perl: Taint, Strict, and Warnings
Topic 11I: Taint Mode
Topic 11J: How Does Taint Mode Work?
Topic 11K: Taint Checking
Topic 11L: Using Tainted Data
Topic 11M: Securing the Program Using Taint
Topic 11N: Strict Pragma
Topic 11O: The Setuid Command
Topic 11P: The Perl crypt() Function
Topic 11Q: Logging Into a Secure Web Site with
Perl Script
Topic 11R: Secure Log-in Checklist
Topic 11S: Program for Secure Log-in
Topic 11T: Securing open() Function
Topic 11U: Unicodes
Topic 11V: Displaying Unicode As Text
Topic 11W: Summary

Lesson 12: Secure XML, Web Services and
AJAX Programming
Topic 12A: Web Application and Web Services
Topic 12B: Web Application Vulnerabilities
Topic 12C: XML- Introduction
Topic 12D: XSLT and XPath
Topic 12E: XML Signature
Topic 12F: An Enveloped, Enveloping and
Detached XML Signature Simultaneously
Topic 12G: XML Encryption
Topic 12H: Security Considerations for the XML
Encryption Syntax
Topic 12I: Canonicalization
Topic 12J: Validation Process in XML
Topic 12K: XML Web Services Security
Topic 12L: XML-aware Network Devices Expand
Network Layer Security
Topic 12M: Security of URI in XML
Topic 12N: Security of Opaque Data in XML
Topic 12O: Growth of XML as Percentage of
Network Traffic
Topic 12P: XML Web Services Security Best
Topic 12Q: XML Security Tools
Topic 12R: V-Sentry
Topic 12S: Vordel SOAPbox
Topic 12T: AJAX- Introduction
Topic 12U: Anatomy of an AJAX Interaction
(Input Validation Example)
Topic 12V: AJAX: Security Issues
Topic 12W: How to Prevent AJAX Attacks
Topic 12X: Tool: HTML Guardian ™
Topic 12Y: Tool: Sprajax- AJAX Security Scanner
Topic 12Z: Tool: DevInspect
Topic 12AA: Summary

Lesson 13: Secure RPC, ActiveX and DCOM
Topic 13A: RPC Introduction
Topic 13B: RPC Authentication
Topic 13C: RPC Authentication Protocol
Topic 13D: NULL Authentication
Topic 13E: UNIX Authentication
Topic 13F: Data Encryption Standard (DES)
Topic 13G: Diffie-Hellman Encryption
Topic 13H: Security Methods
Topic 13I: Security Support Provider Interface
Topic 13J: Security Support Providers (SSPs)
Topic 13K: Secure RPC Protocol
Topic 13L: RpcServerRegisterAuthInfo Prevents
Unauthorized Users from Calling your Server
Topic 13M: RPC Programming Best Practices
Topic 13N: Make RPC Function Calls
Topic 13O: RPC and the Network
Topic 13P: Writing a Secure RPC Client or Server
Topic 13Q: ActiveX Programming: Introduction
Topic 13R: Preventing Repurposing
Topic 13S: SiteLock Template
Topic 13T: IObjectSafety Interface
Topic 13U: Code Signing
Topic 13V: Creating a Code Signing Certificate
and Signing an ActiveX Component in Windows
Topic 13W: Protecting ActiveX Controls
Topic 13X: DCOM: Introduction
Topic 13Y: Security in DCOM
Topic 13Z: Application-Level Security
Topic 13AA: Security by Configuration
Topic 13AB: Programmatic Security
Topic 13AC: Run As a Launching user
Topic 13AD: Run As a Interactive User
Topic 13AE: Run As a Specific User
Topic 13AF: Security Problem on the Internet
Topic 13AG: Security on the Internet
Topic 13AH: Heap Overflow Vulnerability
Topic 13AI: Workarounds for Heap Overflow
Topic 13AJ: Tool: DCOMbobulator
Topic 13AK: DCOM Security Best Practices
Topic 13AL: Summary

Lesson 14: Secure Linux Programming
Topic 14A: Introduction
Topic 14B: Open Source and Security
Topic 14C: Linux File Structure
Topic 14D: Basic Linux Commands
Topic 14E: Linux Networking Commands
Topic 14F: Linux Processes
Topic 14G: POSIX Capabilities
Topic 14H: UTF-8 Security Issues
Topic 14I: UTF-8 Legal Values
Topic 14J: Security Linux Programming
Topic 14K: Requirements for Security Measure
Topic 14L: Enabling Source Address Verification
Topic 14M: Linux iptables and ipchains
Topic 14N: Controlling Access by MAC Address
Topic 14O: Permitting SSH Access Only
Topic 14P: Network Access Control
Topic 14Q: Layers of Security for Incoming
Network Connections
Topic 14R: Prohibiting Root Logins on Terminal
Topic 14S: Authentication Techniques
Topic 14T: Authorization Controls
Topic 14U: Running a Root Login Shell
Topic 14V: Protecting Outgoing Network
Topic 14W: Logging in to a Remote Host
Topic 14X: Invoking Remote Programs
Topic 14Y: Copying Remote Files
Topic 14Z: Public-key Authentication between
OpenSSH Client and Server
Topic 14AA: Authenticating in Cron Jobs
Topic 14AB: Protecting Files
Topic 14AC: File Permissions
Topic 14AD: Shared Directory
Topic 14AE: Encrypting Files
Topic 14AF: Listing Your Keyring
Topic 14AG: Signing and Encrypting Files
Topic 14AH: Encrypting Directories
Topic 14AI: POP/IMAP Mail Server
Topic 14AJ: Testing an SSL Mail Connection
Topic 14AK: Securing POP/IMAP with SSL and
Topic 14AL: SMTP Server
Topic 14AM: Testing and Monitoring
Topic 14AN: Testing Login Passwords (John the
Topic 14AO: Testing Login Passwords (CrackLib)
Topic 14AP: Testing Search Path
Topic 14AQ: Searching Filesystems Effectively
Topic 14AR: Finding Setuid (or Setgid) Programs
Topic 14AS: Securing Device Special Files
Topic 14AT: Looking for Rootkits
Topic 14AU: Tracing Processes
Topic 14AV: Observing Network Traffic
Topic 14AW: Detecting Insecure Network
Topic 14AX: Detecting Intrusions with Snort
Topic 14AY: Log Files (syslog)
Topic 14AZ: Testing a Syslog Configuration
Topic 14BA: Logwatch Filter
Topic 14BB: Structure Program Internals and
Topic 14BC: Minimize Privileges Sample Code
Topic 14BD: Filter Cross-Site Malicious Content
on Input
Topic 14BE: Filter HTML/URIs that may be Re-
Topic 14BF: Avoid Buffer Overflow
Topic 14BG: Language−Specific Issues
Topic 14BH: Linux Application Auditing Tool:
Topic 14BI: Summary

Lesson 15: Secure Linux Kernel Programming
Topic 15A: Introduction to Kernels
Topic 15B: Building a Linux Kernel
Topic 15C: Procedures to Follow Post-Build
Topic 15D: Compiling a Linux Kernel
Topic 15E: Summary

Lesson 16: Secure Xcode Programming
Topic 16A: Introduction to Xcode
Topic 16B: Mac OS X applications
Topic 16C: Cocoa
Topic 16D: Carbon
Topic 16E: AppleScript
Topic 16F: Script Editor
Topic 16G: Script Window
Topic 16H: Common Data Security Architecture
Topic 16I: Secure Transport API Set and
Cryptographic Service Provider (CSP)
Topic 16J: Creating SSL Certificate on Mac OS X
Topic 16K: Using SSL with the Web Server
Topic 16L: Setting up SSL for LDAP
Topic 16M: Protecting Security Information
Topic 16N: Security in Mac OS X
Topic 16O: Security Management Using System
Topic 16P: Authentication Methods
Topic 16Q: Encrypted disk images
Topic 16R: Networking Security Standards
Topic 16S: Personal firewall
Topic 16T: Checklist of Recommended steps
required to secure Mac OS X
Topic 16U: Summary

Lesson 17: Secure Oracle PL/SQL
Topic 17A: Introduction: PL/SQL
Topic 17B: Security Issues in Oracle
Topic 17C: SQL Injection Attacks
Topic 17D: Defending Against SQL Injection
Topic 17E: SQL Manipulation
Topic 17F: Code Injection Attack
Topic 17G: Function Call Injection Attack
Topic 17H: Buffer Overflow and Other
Topic 17I: DBMS_SQL Vulnerabilities in PL/SQL
Topic 17J: Protecting DBMS_SQL in PL/SQL
Topic 17K: Types of Database
Topic 17L: Password Management Policy
Topic 17M: Auditing Policy
Topic 17N: Oracle Policy Manager
Topic 17O: Oracle Label Security (OLS)
Topic 17P: Create an Oracle Label Security Policy
Topic 17Q: Step 1: Define the Policy
Topic 17R: Step 2: Define the Components of the
Topic 17S: Step 3: Identify the Set of Valid Data
Topic 17T: Step 4: Apply Policy to Tables and
Topic 17U: Step 5: Authorize Users
Topic 17V: Step 6: Create and Authorize Trusted
Program Units (Optional)
Topic 17W: Step 7: Configure Auditing (Optional)
Topic 17X: Oracle Identity Management
Topic 17Y: Security Tools
Topic 17Z: Secure Backups: Tool
Topic 17AA: Obfuscation
Topic 17AB: Obfuscation Sample Code
Topic 17AC: Encryption Using DBMS_CRYPTO
Topic 17AD: Advanced Security Option
Topic 17AE: Row Level Security
Topic 17AF: Oracle Database Vaults: Tool
Topic 17AG: Auditing
Topic 17AH: Auditing Methods
Topic 17AI: Audit Options
Topic 17AJ: View Audit Trail
Topic 17AK: Fine-Grained Auditing (FGA)
Topic 17AL: Oracle Auditing Tools (OAT)
Topic 17AM: Testing PL/SQL Programs
Topic 17AN: SQL Unit Testing Tools: SPUnit
Topic 17AO: SQL Unit Testing Tools: TSQLUnit
Topic 17AP: SQL Unit Testing Tools: utPLSQL
Topic 17AQ: Steps to Use utPLSQL
Topic 17AR: Summary

Lesson 18: Secure SQL Server Programming
Topic 18A: Introduction
Topic 18B: SQL Server Security Model: Login
Topic 18C: Creating an SQL Server Login
Topic 18D: Database User
Topic 18E: Guest User
Topic 18F: Permissions
Topic 18G: Database Engine Permissions
Topic 18H: Roles
Topic 18I: User-Defined Roles
Topic 18J: Application roles
Topic 18K: Security Features of MS-SQL Server
Topic 18L: SQL Server Security Vulnerabilities
Topic 18M: SQL Injection Attacks
Topic 18N: Preventing SQL Injection Attacks
Topic 18O: Sqlninja: SQL Server Injection Tool
Topic 18P: Data Encryption
Topic 18Q: Built-in Encryption Capabilities
Topic 18R: Encryption Keys
Topic 18S: Encryption Hierarchy
Topic 18T: Transact-SQL
Topic 18U: Create Symmetric Key in T-SQL
Topic 18V: Create Asymmetric Key in T-SQL
Topic 18W: Certificates
Topic 18X: Create Certificate in T-SQL
Topic 18Y: SQL Server Security: Administrator
Topic 18Z: SQL Server Installation
Topic 18AA: Best Practices for Database Object
Topic 18AB: Auditing and Intrusion Detection
Topic 18AC: Enabling Auditing
Topic 18AD: Database Security Auditing Tools
Topic 18AE: Summary

Lesson 19: Secure Network Programming
Topic 19A: Basic Network Concepts
Topic 19B: Basic Web Concepts
Topic 19C: Network Programming
Topic 19D: Benefits of Secure Network
Topic 19E: Network Interface
Topic 19F: Securing Sockets
Topic 19G: Ports
Topic 19H: UDP Datagram and Sockets
Topic 19I: Internet Address
Topic 19J: Connecting to secure websites
Topic 19K: URL Decoder
Topic 19L: Reading Directly from a URL
Topic 19M: Content Handler
Topic 19N: Cookie Policy
Topic 19O: RMI Connector
Topic 19P: .Net : Internet Authentication
Topic 19Q: Network Scanning Tool: ScanFi
Topic 19R: Network Programming Best Practices
Topic 19S: Summary

Lesson 20: Windows Socket Programming
Topic 20A: Introduction to Windows Sockets
Topic 20B: Windows NT and Windows 2000
Sockets Architecture
Topic 20C: Socket Programming
Topic 20D: Client Side Socket Programming
Topic 20E: Initializing a Socket and Connecting
Topic 20F: Server-Side Socket Programming
Topic 20G: Creating a Server
Topic 20H: Winsock 2.0
Topic 20I: Winsock Linking Methods
Topic 20J: Starting a Winsock 2 API
Topic 20K: Accepting Connections: AcceptEx
Topic 20L: WinSock: TransmitFile and
Topic 20M: Grabbing a Web Page Using Winsock
Topic 20N: Generic File – Grabbing Application
Topic 20O: Writing Client Applications
Topic 20P: TCP Client Application Sample Code
Topic 20Q: Writing Server Applications
Topic 20R: TCP Server Application Sample Code
Topic 20S: Winsock Secure Socket Extensions
Topic 20T: WSADeleteSocketPeerTargetName
Topic 20U: WSAImpersonateSocketPeer Function
Topic 20V: WSAQuerySocketSecurity
Topic 20W: WSARevertImpersonation Function
Topic 20X: WSASetSocketPeerTargetName
Topic 20Y: WSASetSocketSecurity Function
Topic 20AA: Using WinSock to Execute a Web
Topic 20AB: Using Winsock to Execute a Remote
Buffer Overflow
Topic 20AC: MDACDos Application
Topic 20AD: Summary

Lesson 21: Writing Shellcodes
Topic 21A: Shellcode Introduction
Topic 21B: Shellcode Development Tools
Topic 21C: Remote Shellcode
Topic 21D: Port Binding Shellcode
Topic 21E: FreeBSD Port Binding Shellcode
Topic 21F: Clean Port Binding Shellcode
Topic 21G: Socket Descriptor Reuse Shellcode
Topic 21H: Local Shellcode
Topic 21I: The execve Shellcode
Topic 21J: Executing /bin/sh
Topic 21K: Byte Code
Topic 21L: The setuid Shellcode
Topic 21M: The chroot Shellcode
Topic 21N: Breaking of chroot jails (Traditional
Topic 21O: Breaking Out of Chroot Jails on Linux
Topic 21P: Windows Shellcode
Topic 21Q: Shellcode Examples
Topic 21R: Steps to Execute Shell Code Assembly
Topic 21S: The Write System Call
Topic 21T: Linux Shellcode for “Hello, world!”
Topic 21U: The Write System Call in FreeBSD
Topic 21V: The execve Shellcode in C
Topic 21W: FreeBSD execve jmp/call Style
Topic 21X: FreeBSD execve Push Style
Topic 21Y: FreeBSD execve Push Style, Several
Topic 21Z: Implementation of execve on Linux
Topic 21AA: Linux Push execve Shellcode
Topic 21AB: System Calls
Topic 21AC: The Socket System Call
Topic 21AD: The Bind System Call
Topic 21AE: The Listen System Call
Topic 21AF: The Accept System Call
Topic 21AG: The dup2 System Calls
Topic 21AH: The execve System Call
Topic 21AI: Linux Port Binding Shellcode
Topic 21AJ: Compile, Print, and Test Shellcode
Topic 21AK: Reverse Connection Shellcode
Topic 21AL: Socket Reusing Shellcode
Topic 21AM: Linux Implementation of Socket
Reusing Shellcode
Topic 21AN: Reusing File Descriptors
Topic 21AO: Using the setuid Root
Topic 21AP: Using the ltrace utility
Topic 21AQ: Using GDB
Topic 21AR: Assembly Implementation
Topic 21AS: SysCall Trace
Topic 21AT: RW Shellcode
Topic 21AU: Encoding Shellcode
Topic 21AV: Decoder Implementation and
Topic 21AW: Decoder Implementation Program
Topic 21AX: Results of Implementation Program
Topic 21AY: OS-Spanning Shellcode
Topic 21AZ: Assembly Creation
Topic 21BA: Summary

Lesson 22: Writing Exploits
Topic 22A: Introduction to Writing Exploits
Topic 22B: Targeting Vulnerabilities
Topic 22C: Remote and Local Exploits
Topic 22D: Remote and Local Exploits
Topic 22E: A Two-Stage Exploit
Topic 22F: Format String Attacks
Topic 22G: Using %n Character
Topic 22H: Fixing Format String Bugs
Topic 22I: User-Supplied Format String
Vulnerability CVE-2000-0763
Topic 22J: TCP/IP Vulnerabilities
Topic 22K: Race Conditions
Topic 22L: File Race Conditions
Topic 22M: Signal Race Conditions
Topic 22N: Input Validation Error in a man
Topic 22O: Case Study: ‘man’ Input Validation
Error (Snippet 1)
Topic 22P: Case Study: ‘man’ Input Validation
Error (Snippet 2)
Topic 22Q: Writing Exploits and Vulnerability
Checking Programs
Topic 22R: Stack Overflow Exploits
Topic 22S: Memory Organization
Topic 22T: Stack Overflows
Topic 22U: Finding Exploitable Stack Overflows
in Open-Source Software
Topic 22V: Finding Exploitable Stack Overflows
in Closed-Source Software
Topic 22W: Heap Corruption Exploits
Topic 22X: Doug Lea Malloc
Topic 22Y: Figure: Dlmalloc Chunk
Topic 22Z: Figures: Fake Chunk, Overwritten
Topic 22AA: OpenSSL SSLv2 Malformed Client
Key Remote Buffer Overflow Vulnerability CAN-
Topic 22AB: Exploitation
Topic 22AC: Exploitation Sample Code
Topic 22AD: The Complication
Topic 22AE: Improving the Exploit
Topic 22AF: Integer Bug Exploits
Topic 22AG: Integer Wrapping
Topic 22AH: Program: Addition-Based Integer
Topic 22AI: Multiplication-Based Integer
Topic 22AJ: Bypassing Size Checks
Topic 22AK: Using the Metasploit Framework
Topic 22AL: Determining Attack Vector
Topic 22AM: Finding the Offset: Overwriting the
Return Address
Topic 22AN: The First Attack String
Topic 22AO: Overwriting EIP with a Known
Topic 22AP: Selecting a Control Vector
Topic 22AQ: Finding a Return Address
Topic 22AR: Selecting the Search Method in the
Metasploit Opcode Database
Topic 22AS: Search Method in Metasploit Opcode
Topic 22AT: Using the Return Address
Topic 22AU: Increasing Reliability with a Nop
Topic 22AV: Choosing a Payload and Encoder
Topic 22AW: List of Available Encoders
Topic 22AX: Choosing a Payload and Encoder:
msfencode Results
Topic 22AY: The msfweb Payload Generation
Topic 22AZ: Setting msfweb Payload Options
Topic 22BA: msfweb Generated and Encoded
Topic 22BB: Integrating Exploits into Framework
Topic 22BC: Summary

Lesson 23: Programming Port Scanners and
Hacking Tools
Topic 23A: Port Scanner
Topic 23B: libpcap
Topic 23C: Packet Capturing Example
Topic 23D: Saving Captured Packets to a File
Topic 23E: The wiretap Library
Topic 23F: Adding a new file format to the wiretap
Topic 23G: The wtap Struct
Topic 23H: Creating a New Dissector
Topic 23I: Programming the Dissector
Topic 23J: Adding a tap Module
Topic 23K: Nessus Attack Scripting Language
Topic 23L: Writing Personal-Use Tools in NASL
Topic 23M: Programming in the Nessus
Topic 23N: Porting to and from NASL
Topic 23O: Metasploit Framework (MSF)
Topic 23P: msfweb Interface
Topic 23Q: Selecting the Exploit Module
Topic 23R: The msfconsole Interface
Topic 23S: The msfcli Interface
Topic 23T: Updating the MSF
Topic 23U: Writing Basic Rules
Topic 23V: The Rule Header
Topic 23W: Rule Options
Topic 23X: Writing Advanced Rules: Perl-
Compatible Regular Expressions (PCRE)
Topic 23Y: The Byte_test and Byte_jump Function
Topic 23Z: Optimizing Rules
Topic 23AA: Testing Rules
Topic 23AB: Writing Detection Plugins
Topic 23AC: Netcat Source Code
Topic 23AD: Summary

Lesson 24: Secure Mobile phone and PDA
Topic 24A: Mobile Phone Programming
Topic 24B: Different OS Structure in Mobile
Topic 24C: Symbian Operating System
Topic 24D: Guidelines for Securing Symbian OS
Topic 24E: PalmOS
Topic 24F: PalmOS Vulnerabilities
Topic 24G: HotSync Vulnerability
Topic 24H: Creator ID Switching
Topic 24I: Windows Mobile
Topic 24J: Calling Secure Web Services
Topic 24K: Security Practices for Windows
Mobile Programming
Topic 24L: Comparison of Common Programming
Topic 24M: PDA Programming
Topic 24N: PDA Security Issues
Topic 24O: Security Policies for PDAs
Topic 24P: PDA Security Products
Topic 24Q: PDA Security Vendors
Topic 24R: Java 2 Micro Edition (J2ME)
Topic 24S: J2ME Architecture
Topic 24T: J2ME Security Issues
Topic 24U: CLDC Security
Topic 24V: Mobile Information Device Profile
Topic 24W: MIDP Security
Topic 24X: Programming the BlackBerry With
Topic 24Y: Security and Trust Services API
(SATSA) for J2ME: The Security APIs
Topic 24Z: Certificate Enrollment in SATSA
Topic 24AA: Generating a Private Key and
Certificate Signing Request in SATSA
Topic 24AB: Verifying the CSR
Topic 24AC: Storing a Certificate into the
Certificate Local Store
Topic 24AD: Data Integrity with Message Digests
Topic 24AE: Generating a Message Digest
Topic 24AF: Verifying a Message Digest
Topic 24AG: Authentication With Digital
Topic 24AH: Signing a byte Array for
Authentication Purposes
Topic 24AI: Verifying a Digital Signature using
Topic 24AJ: Data Confidentiality - Using Ciphers
for Data Encryption
Topic 24AK: Using Cipher to Encrypt Data using a
Symmetric Encryption
Topic 24AL: Using Cipher to Decrypt Data using a
Symmetric Encryption
Topic 24AM: Security Issues in Bluetooth
Topic 24AN: Security Attacks in Bluetooth
Topic 24AO: Bluetooth security
Topic 24AP: Bluetooth Security : Key
Topic 24AQ: Tool: Bluekey
Topic 24AR: Tool: BlueWatch
Topic 24AS: Tool: BlueSweep
Topic 24AT: Tool: Bluediving
Topic 24AU: Tool: Smartphone Security Client
Topic 24AV: Tool: BlueFire Mobile Security
Enterprise Edition
Topic 24AW: Mobile Phone Security Tips
Topic 24AX: Defending Cell Phones and PDAs
Against Attack
Topic 24AY: Antivirus Tools for Mobile Devices
Topic 24AZ: F-Secure Antivirus for Palm OS
Topic 24BA: Summary

Lesson 25: Secure Game Designing
Topic 25A: Game Designing Introduction
Topic 25B: Threats to Online Gaming
Topic 25C: Game Authoring Tools
Topic 25D: Game Engine
Topic 25E: Best Practices for Secure Game
Topic 25F: Summary

Lesson 26: Securing E-Commerce Applications
Topic 26A: Purpose of Secure E-Commerce
Topic 26B: E-Business Concepts: Secure
Electronic Transaction (SET)
Topic 26C: Using SET
Topic 26D: Secure Socket Layer (SSL)
Topic 26E: SSL Certificates
Topic 26F: VeriSign SSL Certificates
Topic 26G: Entrust SSL Certificates
Topic 26H: Digital Certificates
Topic 26I: Digital Signature
Topic 26J: Digital Signature Algorithms: ECDSA,
ElGamal Signature Scheme
Topic 26K: HACKER SAFE® Certification
Topic 26L: HACKER SAFE Technology
Topic 26M: Guidelines for Developing Secure E-
Commerce Applications
Topic 26N: Summary

Lesson 27: Software Activation, Piracy Blocking
and Automatic Updates
Topic 27A: Software Activation: Introduction
Topic 27B: Software Activation Process
Topic 27C: Software Activation: Advantages
Topic 27D: Activation Explained
Topic 27E: Online License Management Server
Topic 27F: Activation Policies
Topic 27G: Policy Control Parameters
Topic 27H: Piracy
Topic 27I: The Effects of piracy
Topic 27J: Piracy Blocking
Topic 27K: Digital Right Management (DRM)
Topic 27L: Software Piracy Protection Strategies
Topic 27M: Copy protection for DVDs
Topic 27N: Application Framework –DVD Copy
Protection System
Topic 27O: Content Protection During Digital
Topic 27P: Watermark System Design Issues
Topic 27Q: Costs Effectiveness
Topic 27R: False Positives Rate
Topic 27S: Interaction with MPEG compression
Topic 27T: Detector Placement
Topic 27U: Copy Generation Management
Topic 27V: Tool: Crypkey
Topic 27W: EnTrial Key Generation
Topic 27X: EnTrial Distribution File
Topic 27Y: EnTrial Product & Package
Initialization Dialog
Topic 27Z: Windows Automatic Updates
Topic 27AA: Summary

Lesson 28: Secure Application Testing
Topic 28A: Software Development Life Cycle
Topic 28B: Introduction to Testing
Topic 28C: Types of Testing
Topic 28D: White Box Testing
Topic 28E: Types of White Box Testing
Topic 28F: Dynamic White-Box Testing
Topic 28G: Integration Test
Topic 28H: Regression Testing
Topic 28I: System Testing
Topic 28J: Black Box Testing
Topic 28K: Load Testing
Topic 28L: Strategies For Load Testing
Topic 28M: Functional Testing
Topic 28N: Testing Steps
Topic 28O: Creating Test Strategy
Topic 28P: Creating Test Plan
Topic 28Q: Creating Test Cases and Test Data
Topic 28R: Executing, Bug Fixing and Retesting
Topic 28S: Classic Testing Mistakes
Topic 28T: User Interface Errors
Topic 28U: Good User Interfaces
Topic 28V: Use Automatic Testing and Tools
Topic 28W: Generic Code Review Che
Topic 28X: Software Testing Best Practices
Topic 28Y: Testing Tool
Topic 28Z: Real Time Testing
Topic 28AA: Summary

Lesson 29: Writing Secure Documentation and
Error Messages
Topic 29A: Error Message
Topic 29B: Common Error Messages
Topic 29C: Error Messages: Categories
Topic 29D: Good Error Message
Topic 29E: Error Message in a Well-designed
Topic 29F: Good Error Message Example
Topic 29G: Miscommunications in Error Messages
Topic 29H: Error Message Usability Checklist
Topic 29I: Guidelines For Creating Effective Error
Topic 29J: Best Practices for Designing Error
Topic 29K: Error Messages: Examples
Topic 29L: Security Issues in an Error Message
Topic 29M: Security Precautions in
Topic 29N: Summary

Please note that this content is meant to be a guideline.
Class material is subject to change and may be presented in a slightly different format than listed.