LAMPsig

Main Topic: LAMP -Fu: Securing LAMP Websites

"Grasshopper, snatch the Packet from my LAN..."

Fresh from DEFCON 13, Solomon Chang will lead us in attacking an insecure LAMP site, then show how to harden the site against the bad guys.

Although security itself spans a broad range of topics, this presentation will focus on the four most common LAMP vulnerabilities:

- SQL Injection
- Cross Site Scripting (XSS)
- XML Injection
- PHP Register Globals Exploits

Solomon will distribute a highly vulnerable mock website and database, and you will learn to conduct these attacks yourself on your own computer (so if you own a LAMP-enabled portable, please bring it). Then you will learn to secure your site against these attacks. It is essential to fully learn methods used by a hacker... excuse me, cracker, to safeguard against his attacks.

Solomon Chang is a member of SVGLUG as well as one of the core leaders of LAMPsig. He has developed LAMP Websites for both sides of the Force. Like all good security consultants, he keeps up with the latest exploits in order to protect against them. His laptop has a bumper sticker reading "My Other Computer is Your Linux Machine."

Opening Topic: Table-driven Programming for Taking Money from People via the Web - David Benjamin

Forms with lots of fields can be tedious to author. Having to then program those fields for a financial transaction and again for database insertion and again for reporting and again for
an in-house administrative GUI and again for reading from the database to place a new charge can be tedious to the extreme.

Table-driven programming comes to the rescue. By defining attributes of each field in a data table, a much smaller program can build the needed HTML and transactions. David will show Table-driven Programming with the example of an Authorize.Net component for web form, database, and re-billing. Of course, this component includes the "Pandora" technology described last month.

David has an extensive programming background in Java and other languages. He is currently developing a LAMP site where sensitive information must be kept secure yet accessable.

Check this Website for the beginning of our next class on Object Oriented PHP Programming. Christopher Thompson & Peter Benjamin are finalizing the syllabus now.