All you ever wanted to know about auditing but were afraid ...
Troy Hunt_ Everything You Wanted to Know About SQL Injection (but Were Afraid to Ask)
-
Upload
nyasha-dombas-sadomba -
Category
Documents
-
view
216 -
download
0
description
Transcript of Troy Hunt_ Everything You Wanted to Know About SQL Injection (but Were Afraid to Ask)
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
7XHVGD\-XO\
7KLVFRQWHQWLVQRZDYDLODEOHLQWKH3OXUDOVLJKWFRXUVH(WKLFDO+DFNLQJ64/,QMHFWLRQ
3XWRQ\RXUEODFNKDWVIRONVLWVWLPHWROHDUQVRPHJHQXLQHO\LQWHUHVWLQJWKLQJVDERXW64/LQMHFWLRQ1RZUHPHPEHU\DOOSOD\QLFHZLWKWKHELWVDQGSLHFHV\RXUHDERXWWRUHDGRN"
64/LQMHFWLRQLVDSDUWLFXODUO\LQWHUHVWLQJULVNIRUDIHZGLIIHUHQWUHDVRQV
,WVJHWWLQJLQFUHDVLQJO\KDUGHUWRZULWHYXOQHUDEOHFRGHGXHWRIUDPHZRUNVWKDWDXWRPDWLFDOO\SDUDPHWHULVHLQSXWV\HWZHVWLOOZULWHEDGFRGH
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
7KHHQWLUH85/SUREDEO\ORRNHGVRPHWKLQJOLNHWKLV
3UHWW\EDVLFVWXIIZKHUHLWVWDUWVWRJHWLQWHUHVWLQJLVZKHQ\RXFDQPDQLSXODWHWKHGDWDLQWKH85/VXFKWKDWLWFKDQJHVWKHYDOXHSDVVHGWRWKHTXHU\2NFKDQJLQJWRZLOOJLYH\RXDGLIIHUHQWZLGJHWDQGWKDWVWREHH[SHFWHGEXWZKDWLI\RXGLGWKLV
KWWSZLGJHWVKRSFRPZLGJHW"LG RU
7KDWPLJKWWKHQSHUVLVWWKURXJKWRWKHGDWDEDVHVHUYHUOLNHVR
:KDWWKLVWHOOVXVLVWKDWWKHGDWDLVQRWEHLQJVDQLWLVHGLQWKHH[DPSOHVDERYHWKH,'VKRXOGFOHDUO\EHDQLQWHJHU\HWWKHYDOXH25 KDVEHHQDFFHSWHG0RUHLPSRUWDQWO\WKRXJKEHFDXVHWKLVGDWDKDVVLPSO\EHHQDSSHQGHGWRWKHTXHU\LWKDVEHHQDEOHWRFKDQJHWKHIXQFWLRQRIWKHVWDWHPHQW5DWKHUWKDQMXVWVHOHFWLQJDVLQJOHUHFRUGWKLVTXHU\ZLOOQRZVHOHFWDOOUHFRUGVDVWKH VWDWHPHQWZLOODOZD\VEHWUXH$OWHUQDWLYHO\ZHFRXOGIRUFHWKHSDJHWRUHWXUQQRUHFRUGVE\FKDQJLQJRU WRDQG DVLWZLOODOZD\VEHIDOVHKHQFHQRUHVXOWV%HWZHHQWKHVHWZRDOWHUQDWLYHVZHFDQHDVLO\DVVHVVLIWKHDSSLVDWULVNRIDQLQMHFWLRQDWWDFN
7KLVLVWKHHVVHQFHRI64/LQMHFWLRQPDQLSXODWLQJTXHU\H[HFXWLRQZLWKXQWUXVWHGGDWDDQGLWKDSSHQVZKHQGHYHORSHUVGRWKLQJVOLNHWKLV
TXHU\ 6(/(&7)520:LGJHW:+(5(,' 5HTXHVW4XHU\6WULQJ>,'@([HFXWHWKHTXHU\
2IFRXUVHZKDWWKH\VKRXOGEHGRLQJLVSDUDPHWHULVLQJWKHXQWUXVWHGGDWDEXW,PQRWJRLQJWRJRLQWRWKDWKHUHUHIHUEDFNWRSDUWRQHRIP\2:$63VHULHVIRUPRUHLQIRRQPLWLJDWLRQLQVWHDG,ZDQWWRWDONPRUHDERXWH[SORLWLQJ64/L
2NVRWKDWEDFNJURXQGFRYHUVKRZWRGHPRQVWUDWHWKDWDULVNLVSUHVHQWEXWZKDWFDQ\RXQRZGRZLWKLW"/HWVVWDUWH[SORULQJVRPHFRPPRQLQMHFWLRQSDWWHUQV
/HWVWDNHDQH[DPSOHZKHUHZHH[SHFWDVHWRIUHFRUGVWREHUHWXUQHGWRWKHSDJHLQWKLVFDVHLWVDOLVWRIZLGJHWVRI7\SH,GRQD85/OLNHWKLV
KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G
Joining the dots: Union query-based injection
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G
7KHUHVXOWRQWKHSDJHWKHQORRNVOLNHVR
:HGH[SHFWWKDWTXHU\WRORRNVRPHWKLQJOLNHWKLVRQFHLWKLWVWKHGDWDEDVH
%XWLIZHFDQDSSO\ZKDW,YHRXWOLQHGDERYHQDPHO\WKDWZHPLJKWEHDEOHWRMXVWDSSHQG64/WRWKHGDWDLQWKHTXHU\VWULQJZHPLJKWEHDEOHWRGRVRPHWKLQJOLNHWKLV
KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G XQLRQDOOVHOHFWQDPHIURPV\VREMHFWVZKHUH[W\SH X
:KLFKZRXOGWKHQFUHDWHD64/TXHU\OLNHVR
1RZNHHSLQPLQGWKDWWKHV\VREMHFWVWDEOHLVWKHRQHWKDWOLVWVDOOWKHREMHFWVLQWKHGDWDEDVHDQGLQWKLVFDVHZHUHILOWHULQJWKDWOLVWE\[W\SHXRULQRWKHUZRUGVXVHUWDEOHV:KHQDQLQMHFWLRQULVNLVSUHVHQWWKDWZRXOGPHDQWKHIROORZLQJRXWSXW
7KLVLVZKDWVUHIHUUHGWRDVDXQLRQTXHU\EDVHGLQMHFWLRQDWWDFNDVZHYHVLPSO\DSSHQGHGDQDGGLWLRQDOUHVXOWVHWWRWKHRULJLQDODQGLWVPDGHLWVZD\RXWGLUHFWO\LQWRWKH+70/RXWSXWHDV\1RZWKDWZHNQRZWKHUHVDWDEOHFDOOHG8VHUZHFRXOGGRVRPHWKLQJOLNHWKLV
KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G XQLRQDOOVHOHFWSDVVZRUGIURP>XVHU@
64/6HUYHUJHWVDELWXSSLW\LIWKHWDEOHQDPHRIXVHULVQRWHQFORVHGLQVTXDUHEUDFNHWVJLYHQWKHZRUGKDVRWKHUPHDQLQJVLQWKH'%VHQVH5HJDUGOHVVKHUHVZKDWWKDWJLYHVXV
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
2IFRXUVHWKH81,21$//VWDWHPHQWRQO\ZRUNVZKHQWKHILUVW6(/(&7VWDWHPHQWKDVWKHVDPHQXPEHURIFROXPQVDVWKHVHFRQG7KDWVHDVLO\GLVFRYHUDEOHWKRXJK\RXMXVWWU\JRLQJZLWKDELWRIXQLRQDOOVHOHFWDWKHQLIWKDWIDLOVXQLRQDOOVHOHFWDEDQGVRRQ%DVLFDOO\\RXUHMXVWJXHVVLQJWKHQXPEHURIFROXPQVXQWLOWKLQJVZRUN
:HFRXOGJRRQDQGRQGRZQWKLVSDWKDQGSXOOEDFNDOOVRUWVRIRWKHUGDWDOHWVPRYHRQWRWKHQH[WDWWDFNWKRXJK7KHUHDUHWLPHVZKHQDXQLRQEDVHGDWWDFNLVQWJRLQJWRSOD\EDOOHLWKHUGXHWRVDQLWLVDWLRQRIWKHLQSXWRUKRZWKHGDWDLVDSSHQGHGWRWKHTXHU\RUHYHQKRZWKHUHVXOWVHWLVGLVSOD\HGWRWKHSDJH7RJHWDURXQGWKDWZHUHJRLQJWRQHHGWRJHWDELWPRUHFUHDWLYH
/HWVWU\DQRWKHUSDWWHUQZKDWLIZHGLGWKLV
KWWSZLGJHWVKRSFRPZLGJHW"LG RU[
+DQJRQWKDWVQRWYDOLG64/V\QWD[WKH[ SLHFHZRQWFRPSXWHDWOHDVWQRWXQOHVVWKHUHVDFROXPQFDOOHG[VRZRQWLWMXVWWKURZDQH[FHSWLRQ"3UHFLVHO\LQIDFWLWPHDQV\RXOOVHHDQH[FHSWLRQOLNHWKLV
7KLVDQ$631(7HUURUDQGRWKHUIUDPHZRUNVKDYHVLPLODUSDUDGLJPVEXWWKHLPSRUWDQWWKLQJLVWKDWWKHHUURUPHVVDJHLVGLVFORVLQJLQIRUPDWLRQDERXWWKHLQWHUQDOLPSOHPHQWDWLRQQDPHO\WKDWWKHUHLVQRFROXPQFDOOHG[:K\LVWKLVLPSRUWDQW",WVIXQGDPHQWDOO\LPSRUWDQWEHFDXVHRQFH\RXHVWDEOLVKWKDWDQDSSLVOHDNLQJ64/H[FHSWLRQV\RXFDQGRWKLQJVOLNHWKLV
KWWSZLGJHWVKRSFRPZLGJHW"LG FRQYHUWLQWVHOHFWWRSQDPHIURPV\VREMHFWVZKHUHLG VHOHFWWRSLGIURPVHOHFWWRSLGIURPV\VREMHFWVZKHUH[W\SH XRUGHUE\LGVTRUGHUE\LG'(6&
7KDWVDORWWRDEVRUEDQG,OOFRPHEDFNWRLWLQPRUHGHWDLOWKHLPSRUWDQWWKLQJLVWKRXJKWKDWLWZLOO\LHOGWKLVUHVXOWLQWKHEURZVHU
Making the app squeal: Error-based injection
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
$QGWKHUHZHKDYHLWZHYHQRZGLVFRYHUHGWKDWWKHUHLVDWDEOHLQWKHGDWDEDVHFDOOHG:LGJHW
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
,QWKHVFUHHQDERYH,GDOUHDG\EHHQDEOHWRGLVFRYHUWKDWWKHUHZDVDWDEOHFDOOHG8VHUDQGDFROXPQFDOOHG3DVVZRUGDOO,QHHGHGWRGRZDVVHOHFWRXWRIWKDWWDEOHDQGDJDLQ\RXFDQHQXPHUDWHWKURXJKDOOUHFRUGVRQHE\RQHZLWKQHVWHGVHOHFWVWDWHPHQWVDQGFDXVHDQH[FHSWLRQE\DWWHPSWLQJWRFRQYHUWWKHVWULQJWRDQLQW\RXFDQDOZD\VDSSHQGDQDOSKDFKDUWRWKHGDWDLILWUHDOO\LVDQLQWWKHQDWWHPSWWRFRQYHUWWKHZKROHORWWRDQLQWZKLFKZLOOFDXVHDQH[FHSWLRQ,I\RXZDQWWRJHWDVHQVHRIMXVWKRZHDV\WKLVFDQEH,UHFRUGHGDOLWWOHYLGHRODVW\HDUZKHUH,WHDFKP\\HDUROGWRDXWRPDWHWKLVZLWK+DYLMZKLFKXVHVWKHWHFKQLTXH
%XWWKHUHVDSUREOHPZLWKDOOWKLVLWZDVRQO\SRVVLEOHEHFDXVHWKHDSSZDVDELWQDXJKW\DQGH[SRVHGLQWHUQDOHUURUPHVVDJHVWRWKHJHQHUDOSXEOLF,QIDFWWKHDSSTXLWHOLWHUDOO\WROGXVWKHQDPHVRIWKHWDEOHVDQGFROXPQVDQGWKHQGLVFORVHGWKHGDWDZKHQZHDVNHGWKHULJKWTXHVWLRQVEXWZKDWKDSSHQVZKHQLWGRHVQW",PHDQZKDWKDSSHQVZKHQWKHDSSLVFRUUHFWO\FRQILJXUHGVRDVQRWWROHDNWKHGHWDLOVRILQWHUQDOH[FHSWLRQV"
7KLVLVZKHUHZHJHWLQWREOLQG64/LQMHFWLRQZKLFKLVWKHJHQXLQHO\LQWHUHVWLQJVWXII
,QWKHH[DPSOHVDERYHDQGLQGHHGLQPDQ\SUHFHGHQWVRIVXFFHVVIXOLQMHFWLRQDWWDFNVWKHDWWDFNVDUHGHSHQGHQWRQWKHYXOQHUDEOHDSSH[SOLFLWO\GLVFORVLQJLQWHUQDOGHWDLOVHLWKHUE\MRLQLQJWDEOHVDQGUHWXUQLQJWKHGDWDWRWKH8,RUE\UDLVLQJH[FHSWLRQVWKDWEXEEOHXSWRWKHEURZVHU/HDNLQJRILQWHUQDOLPSOHPHQWDWLRQVLVDOZD\VDEDGWKLQJDQGDV\RXVDZHDUOLHUVHFXULW\PLVFRQILJXUDWLRQVVXFKDVWKLVFDQEHOHYHUDJHGWRGLVFORVHPRUHWKDQMXVWWKHDSSOLFDWLRQVWUXFWXUH\RXFDQDFWXDOO\SXOOGDWDRXWWKURXJKWKLVFKDQQHODVZHOO
$FRUUHFWO\FRQILJXUHGDSSVKRXOGUHWXUQDPHVVDJHPRUHDNLQWRWKLVRQHKHUHZKHQDQXQKDQGOHGH[FHSWLRQRFFXUV
7KLVLVWKHGHIDXOWHUURUSDJHIURPDEUDQGQHZ$631(7DSSZLWKFXVWRPHUURUVFRQILJXUHGEXWDJDLQVLPLODU
Hacking blind
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
7KLVLVWKHGHIDXOWHUURUSDJHIURPDEUDQGQHZ$631(7DSSZLWKFXVWRPHUURUVFRQILJXUHGEXWDJDLQVLPLODUSDUDGLJPVH[LVWLQRWKHUWHFKQRORJ\VWDFNV1RZWKLVSDJHLVH[DFWO\WKHVDPHDVWKHHDUOLHURQHVWKDWVKRZHGWKHLQWHUQDO64/H[FHSWLRQVEXWUDWKHUWKDQOHWWLQJWKHPEXEEOHXSWRWKH8,WKH\UHEHLQJKLGGHQDQGDIULHQGO\HUURUPHVVDJHVKRZQLQVWHDG$VVXPLQJZHDOVRFRXOGQWH[SORLWDXQLRQEDVHGDWWDFNWKH64/LULVNLVHQWLUHO\JRQHULJKW"1RWTXLWH
%OLQG64/LUHOLHVRQXVJHWWLQJDORWPRUHLPSOLFLWRULQRWKHUZRUGVGUDZLQJRXUFRQFOXVLRQVEDVHGRQRWKHUREVHUYDWLRQVZHFDQPDNHDERXWWKHEHKDYLRXURIWKHDSSWKDWDUHQWTXLWHDVGLUHFWDVWHOOLQJXVWDEOHQDPHVRUVKRZLQJFROXPQGDWDGLUHFWO\LQWKHEURZVHUE\ZD\RIXQLRQVRUXQKDQGOHGH[FHSWLRQV2IFRXUVHWKLVQRZEHJVWKHTXHVWLRQKRZFDQZHPDNHWKHDSSEHKDYHLQDQREVHUYDEOHIDVKLRQVXFKWKDWLWGLVFORVHVWKHLQIRUPDWLRQZHKDGHDUOLHUZLWKRXWH[SOLFLWO\WHOOLQJXV"
:HUHJRLQJWRORRNDWWZRDSSURDFKHVKHUHERROHDQEDVHGDQGWLPHEDVHG
7KLVDOOFRPHVGRZQWRDVNLQJWKHULJKWTXHVWLRQVRIWKHDSS(DUOLHURQZHFRXOGH[SOLFLWO\DVNTXHVWLRQVVXFKDV:KDWWDEOHVGR\RXKDYHRU:KDWFROXPQVGR\RXKDYHLQHDFKWDEOHDQGWKHGDWDEDVHZRXOGH[SOLFLWO\WHOOXV1RZZHQHHGWRDVNDOLWWOHELWGLIIHUHQWO\IRUH[DPSOHOLNHWKLV
KWWSZLGJHWVKRSFRPZLGJHW"LG DQG
&OHDUO\WKLVHTXLYDOHQF\WHVWFDQQHYHUEHWUXHRQHZLOOQHYHUEHHTXDOWRWZR+RZDQDSSDWULVNRILQMHFWLRQUHVSRQGVWRWKLVUHTXHVWLVWKHFRUQHUVWRQHRIEOLQG64/LDQGLWFDQKDSSHQLQRQHRIWZRGLIIHUHQWZD\V
)LUVWO\LWPLJKWMXVWWKURZDQH[FHSWLRQLIQRUHFRUGLVUHWXUQHG2IWHQGHYHORSHUVZLOODVVXPHWKDWDUHFRUGUHIHUUHGWRLQDTXHU\VWULQJH[LVWVEHFDXVHLWVXVXDOO\WKHDSSLWVHOIWKDWKDVSURYLGHGWKHOLQNEDVHGRQSXOOLQJLWRXWRIWKHGDWDEDVHRQDQRWKHUSDJH:KHQWKHUHVQRUHFRUGUHWXUQHGWKLQJVEUHDN6HFRQGO\WKHDSSPLJKWQRWWKURZDQH[FHSWLRQEXWWKHQLWDOVRZRQWGLVSOD\DUHFRUGHLWKHUEHFDXVHWKHHTXLYDOHQF\LVIDOVH(LWKHUZD\WKHDSSLVLPSOLFLWO\WHOOLQJXVWKDWQRUHFRUGVZHUHUHWXUQHGIURPWKHGDWDEDVH
1RZOHWVWU\WKLV
.HHSLQJLQPLQGWKDWWKLVHQWLUHEORFNUHSODFHVMXVWWKHTXHU\VWULQJYDOXHVRLQVWHDGRI"LG LWEHFRPHV"LG DQGLWVDFWXDOO\RQO\DPLQRUYDULDWLRQRQWKHHDUOLHUUHTXHVWVLQWHQGHGWRUHWULHYHWDEOHQDPHV,QIDFWWKHPDLQGLIIHUHQWLVWKDWUDWKHUWKDQDWWHPSWLQJWRFDXVHDQH[FHSWLRQE\FRQYHUWLQJDVWULQJWRDQLQWHJHULWVQRZDQHTXLYDOHQF\WHVWWRVHHLIWKHILUVWFKDUDFWHURIWKHWDEOHQDPHLVDQDZHUHDVVXPLQJDFDVHLQVHQVLWLYHFROODWLRQKHUH,IWKLVUHTXHVWJLYHVXVWKHVDPHUHVXOWDV"LG WKHQLWFRQILUPVWKDWWKHILUVWWDEOHLQV\VREMHFWVGRHVLQGHHGEHJLQZLWKDQDDVWKHHTXLYDOHQF\KDVKHOGWUXH,ILWJLYHVXVRQHRIWKHHDUOLHUPHQWLRQHGWZRVFHQDULRVDQHUURURUVKRZVQRUHFRUGWKHQZHNQRZWKDWWKHWDEOHGRHVQWEHJLQZLWKDQDDVQRUHFRUGKDVEHHQUHWXUQHG
1RZDOORIWKDWRQO\JLYHVXVWKHILUVWFKDUDFWHURIWKHWDEOHQDPHIURPV\VREMHFWVZKHQ\RXZDQWWKHVHFRQG
Ask, and you shall be told: Boolean-based injection
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
1RZDOORIWKDWRQO\JLYHVXVWKHILUVWFKDUDFWHURIWKHWDEOHQDPHIURPV\VREMHFWVZKHQ\RXZDQWWKHVHFRQGFKDUDFWHUWKHQWKHVXEVWULQJVWDWHPHQWQHHGVWRSURJUHVVWRWKHQH[WSRVLWLRQ
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
KWWSZLGJHWVKRSFRP:LGJHWV"2UGHU%\ 1DPH
,QWKLVFDVHLWVSUHWW\IDLUWRDVVXPHWKDWWKHTXHU\ZLOOWUDQVODWHWKURXJKWRVRPHWKLQJOLNHWKLV
&OHDUO\ZHFDQWMXVWVWDUWLQJDGGLQJFRQGLWLRQVGLUHFWO\LQWRWKH25'(5%
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
GLIIHUHQWFRPELQDWLRQVRIGDWDEDVHDSSIUDPHZRUNDQGZHEVHUYHUQRWWRPHQWLRQDZKROHJDPXWRIGHIHQFHVVXFKDVZHEDSSOLFDWLRQILUHZDOOV$QH[DPSOHRIZKHUHWKLQJVFDQJHWWULFN\LVLI\RXQHHGWRUHVRUWWRDWLPHEDVHGDWWDFN\HWWKHGDWDEDVHGRHVQWVXSSRUWDGHOD\IHDWXUHIRUH[DPSOHDQ$FFHVVGDWDEDVH\HVVRPHSHRSOHDFWXDOO\GRSXWWKHVHEHKLQGZHEVLWHV2QHDSSURDFKKHUHLVWRXVHZKDWVUHIHUUHGWRDVKHDY\TXHULHVRULQRWKHUZRUGVTXHULHVZKLFKE\WKHLUYHU\QDWXUHZLOOFDXVHDUHVSRQVHWREHVORZ
7KHRWKHUWKLQJZRUWKPHQWLRQLQJDERXW64/LLVWKDWWZRUHDOO\VLJQLILFDQWIDFWRUVSOD\DUROHLQWKHVXFFHVVDQDWWDFNHUKDVH[SORLWLQJWKHULVN7KHILUVWLVLQSXWVDQLWLVDWLRQLQWHUPVRIZKDWFKDUDFWHUVWKHDSSZLOODFWXDOO\DFFHSWDQGSDVVWKURXJKWRWKHGDWDEDVH2IWHQZHOOVHHYHU\SLHFHPHDODSSURDFKHVZKHUHIRUH[DPSOHDQJOHEUDFNHWVDQGTXRWHVDUHVWULSSHGEXWHYHU\WKLQJHOVHLVDOORZHG:KHQWKLVVWDUWVKDSSHQLQJWKHDWWDFNHUQHHGVWRJHWFUHDWLYHLQWHUPVRIKRZWKH\VWUXFWXUHWKHTXHU\VRWKDWWKHVHURDGEORFNVDUHDYRLGHG$QGWKDWVNLQGRIWKHVHFRQGSRLQWWKHDWWDFNHUV64/SURZHVVLVYLWDOO\LPSRUWDQW7KLVJRHVZHOOEH\RQGMXVW\RXUDYHUDJH764/VNLOOVRI6(/(&7)520WKHSURILFLHQW64/LQMHFWRUXQGHUVWDQGVQXPHURXVWULFNVWRERWKE\SDVVWKHLQSXWVDQLWLVDWLRQDQGVHOHFWGDWDIURPWKHV\VWHPLQVXFKDZD\WKDWLWFDQEHUHWULHYHGYLDWKHZHE8,)RUH[DPSOHOLWWOHWULFNVOLNHGLVFRYHULQJDFROXPQW\SHE\XVLQJDTXHU\VXFKDVWKLV
KWWSZLGJHWVKRSFRP:LGJHW"LG XQLRQVHOHFWVXPLQVWRFNIURPZLGJHW
,QWKLVFDVHHUURUEDVHGLQMHFWLRQZLOOJLYHWHOO\RXH[DFWO\ZKDWW\SHWKH,Q6WRFNFROXPQLVZKHQWKHHUURUEXEEOHVXSWRWKH8,DQGQRHUURUZLOOPHDQLWVQXPHULF
2URQFH\RXUHWRWDOO\IHGXSZLWKWKHYHU\SUHVHQFHRIWKDWGDPQHGYXOQHUDEOHVLWHVWLOOEHLQJXSWKHUHRQWKHZHEDELWRIWKLV
KWWSZLGJHWVKRSFRP:LGJHW"LG VKXWGRZQ
%XWLQMHFWLRQJRHVDORWIXUWKHUWKDQMXVWSXOOLQJGDWDRXWYLD+773IRUH[DPSOHWKHUHDUHYHFWRUVWKDWZLOOJUDQWWKHDWWDFNHUVKHOORQWKHPDFKLQH2UWDNHDQRWKHUWDQJHQWZK\ERWKHUWU\LQJWRVXFNVWXIIRXWWKURXJK+70/ZKHQ\RXPLJKWEHDEOHWRMXVWFUHDWHDORFDO64/XVHUDQGUHPRWHO\FRQQHFWXVLQJ64/6HUYHU0DQDJHPHQW6WXGLRRYHUSRUW"%XWKDQJRQ\RXGQHHGWKHDFFRXQWWKHZHEDSSLVFRQQHFWLQJXQGHUWRKDYHWKHSULYLOHJHVWRDFWXDOO\FUHDWHXVHUVLQWKHGDWDEDVHULJKW"
-
7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN
KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO
)ROORZ#WUR\KXQW
3RVWHGDW7XHVGD\-XO\7DJV 6HFXULW\ 64/,QMHFWLRQ
1HZHU3RVW 2OGHU3RVW
XQGHUVWRRGIRUZHOORYHUWKDQDGHFDGH
3HUKDSV64/LLVQRWTXLWHDVZHOOXQGHUVWRRGDVVRPHSHRSOHWKLQN
/HDYLQJFRPPHQWVLVDZHVRPHSOHDVHGR$OO,DVNLVWKDW\RXEHQLFHDQGLILQGRXEWUHDG&RPPHQWVRQWUR\KXQWFRPIRUJXLGDQFH
7KLVZRUNLVOLFHQVHGXQGHUD&UHDWLYH&RPPRQV$WWULEXWLRQ8QSRUWHG/LFHQVH,QRWKHUZRUGVVKDUHJHQHURXVO\EXWSURYLGHDWWULEXWLRQ
Copyright 2014, Troy Hunt2SLQLRQVH[SUHVVHGKHUHDUHP\RZQDQGPD\QRWUHIOHFWWKRVHRIP\HPSOR\HUP\FROOHDJXHVP\PDWHVP\ZLIHWKHGRJDQGVRRQDQGVRIRUWK8QOHVV,PTXRWLQJVRPHRQHWKH\UHP\RZQRSLQLRQVDQGPD\QRWQHFHVVDULO\EHFRKHVLYHQRUHQWHUWDLQLQJEXWKH\DWOHDVWWKH\UHRULJLQDO
Disclaimer