ColdFusion Application Security: The Next Step

Comments

Wonderful slide!!

Posted By: Toronto Printing On: 04/26/10 11:53 AM

Fabulous slide!!

Posted By: Kelowna Real Estate On: 07/19/10 11:41 AM

Thanks for sharing this wonderful post

Posted By: braindump On: 10/07/10 12:18 AM

Very nice and helpful information has been given in this article. I must say that this is a great post. I loved reading it slide six.

Posted By: cheap hosting On: 11/22/10 8:38 AM

I really loved reading your blog. It was very well authored and easy to understand. I also found your posts very interesting. In fact after reading, I had showed it to my friend and he enjoyed it well!

<a rel="new tab" href="http://www.locations4business.com/europe/uk/features-and-news/">locations4business.com</a>

Posted By: locations4business.com On: 12/08/10 4:19 AM

Thanks for the nice blog. It was very useful for me. Keep sharing such ideas in the future as well. This was actually what I was looking for, and I am glad to came here! Thanks for sharing the such information with us.

Posted By: Windows 7 Ultimate Key On: 12/15/10 12:04 AM

Thanks for the nice blog. It was very useful for me. Keep sharing such ideas in the future as well. This was actually what I was looking for, and I am glad to came here! Thanks for sharing the such information with us.

Posted By: Windows 7 Ultimate Key On: 12/15/10 12:04 AM

Share your Slide-Six presentations both live and virtually right from your desktop. ... nice article Thanks

Posted By: 11 kv lightning arresters On: 12/26/10 3:39 AM

wow!Thank this meaningful and helpful post !And I like to share Cheap DVD

Posted By: DVD Movie On: 12/26/10 7:23 AM

Fabulous slide!! Thanks

Posted By: porno On: 12/31/10 7:31 PM

Fabulous slide!!

Posted By: seks izle On: 01/03/11 5:16 AM

I find html too complicated, so its really nice of you to post this as I have been looking for html code for setting up a calendar.

Posted By: Office 2010 On: 01/19/11 11:51 PM

Great presentation about the next step in ColdFusion Application Security. I find this very informative and very useful. Thank you for sharing this with us. You did an awesome job.

Posted By: Ginault Watches On: 01/28/11 2:23 AM

Internet Marketing Services by SEO Company India WebCyberDesign. Get top ranking in just $200 with online branding with social media marketing.Our services are link building, pay per click advertising.

Posted By: SEO Services india On: 01/30/11 12:44 AM

I impressed greatly that the way you have written such great article. I got many reference about this topic but your one is wonderful. When I started to read article I was thinking about the way you present such great topic. By the way could you please post more article on such topic ? I really appreciate it. Thanks man!

Posted By: software development India On: 01/30/11 12:52 AM

The quality of Escort Service offered by Delhi Escorts makes us different from all other escort agencies in Delhi. Just call us at 0 9990495490 and start availing the services.http://highprofileescort.com/delhi-escorts.htm

Posted By: Escorts in Delhi On: 01/31/11 4:39 AM

I was very pleased to find this site.I wanted to thank you for this great read!! I definitely enjoying every little bit of it and I have you bookmarked to check out new stuff you post.

Posted By: Chennai Escorts On: 01/31/11 4:39 AM

We are a group of volunteers and starting a new initiative in a community. Your blog provided us valuable information to work on.

Posted By: Mumbai Escorts On: 01/31/11 4:40 AM

Just read your post and would like to thank you for maintaining such a cool blog.

Posted By: Gurgaon Escorts On: 01/31/11 4:41 AM

What a wonderful piece of information Admiring the time and effort you put into your blog and detailed information you offer! I will bookmark your blog and have my children check up here often. Thumbs up!

Posted By: opdrachten On: 02/06/11 4:06 AM

Interesting post and I really like your take on the issue. I now have a clear idea on what this matter is all about. Thank you so much.

Posted By: aquacel On: 02/11/11 11:12 AM

thanks for posting such a nice info. i will bookmark this post.

Posted By: las vegas website design On: 02/11/11 3:31 PM

After reading the article, I feel that I need more information on the topic. Can you suggest some resources please?, Excellent post!

Posted By: Thomas Sabo On: 02/22/11 8:48 AM

Thanks for this read mate. Well, this is my first visit to your blog! But I admire the precious time and effort you put into it, especially into interesting articles you share here!

Posted By: Banner Design On: 02/24/11 3:29 AM

good ppt well explained

Posted By: intranet 2.0 On: 03/04/11 4:45 AM

Send Flowers to anyone any time any where through our services

Posted By: flowers chinese On: 03/15/11 5:38 AM

These frames are constructed from several different materials including metal and plastic for various needs. Rectangular-shaped Armani prescription Ray Ban Sunglasses squeeze in a sophisticated expect to your personality. Made from style and functionality under consideration, Armani Ray Ban Wayfarer Sunglasses have lenses providing exceptional vision clarity and comfort to the eyes.

Posted By: Ray Ban Sale On: 03/19/11 3:53 AM

Ray Ban 2140 Sunglasses wearers require style and comfort for their prescription glasses in equal measure. Thanks to the gradual development of the sheer numbers of the designer Ray Ban 2113 glasses, they already have their wishes fulfilled.

Posted By: Ray Ban Sale On: 03/19/11 3:54 AM

iFOUND FORM
GOOGLE

Posted By: Ray Ban On: 03/19/11 3:56 AM

good day

Posted By: Ray Ban Aviators On: 03/19/11 3:59 AM

Thanks for admin.nice sharing.very nice..

Posted By: Cnc Freze On: 03/19/11 7:02 PM

kllkk wowowowow

Posted By: gucci outlet On: 03/20/11 11:42 PM

Good Work. I am very happy to read this article. Thanks for the great blog.

Posted By: buy viagra On: 04/19/11 8:56 AM

Definitely happy to see your write-up, I incredibly considerably to like and agree with your point of view. Thank you for sharing. At the identical time,i appreciate most powerful pram incredibly a great deal .Welcome to have a take a look at my world wide web internet site and blog articles.Hope we can turn into exceptional buddies, and exchange and to assist 1 an additional! Thanks!

Posted By: déshydrateur On: 04/21/11 4:17 AM

amatör sikiş izlemek istiyorsan sende gel türkçe sikiş üzerine kurulu site porno izle sert sikiş izle porno nedir sikişmek nasıl oluyor öğren cahil kalma

Posted By: sikiş izle On: 04/22/11 9:43 AM

Greetings from Australia... We need more slides about Singapore and South Africa especially!

Posted By: viagra south africa On: 06/10/11 3:06 PM

Thanks for help me, by sharing this and i will share this to my friends and keep it up!

Posted By: uae information On: 07/13/11 3:49 AM

This is what I need to know very much and I appreciate you to sharing this with us and I hope you will always sharing useful information like this with us. Thanks for help!

Posted By: flowers delivery china On: 07/15/11 12:39 AM

Thanks for help!

Posted By: Delhi Escorts On: 07/19/11 3:48 AM

Very nice and helpful information has been given in this article

Posted By: Mumbai Escorts On: 07/19/11 3:50 AM

Interesting read!!! Your website is fantastic with informative content which i like to add to my favourites.

Posted By: Air Jordans For Cheap On: 08/11/11 5:05 AM

We created our Pune Night Queens to offer an exceptional level of service unsurpassed worldwide

Posted By: Escorts in Pune On: 08/13/11 7:57 AM

<a href="http://www.nityaarora.com/mumbai_escorts.html"> Mumbai Independent escorts </a> are identical across prostitutes, however, in price. <a href="http://www.nityaarora.com/mumbai_escorts.html">Mumbai Escorts</a> are not prostitutes, and much less affordable. There are thousands of difficulties popular among prostitutes, as well as escort lady, leading to be the requirements that the offer and the exceptional approach really the issue.

Posted By: Mumbai Escorts On: 08/17/11 5:09 AM

Escorts in Delhi,Delhi Escorts,Escorts in Gurgaon,Gurgaon Escorts,Delhi Escort Service,Gurgaon Escort
Service,Escort Service In Delhi,Escort Service In Gurgaon

Posted By: Gurgaon Escorts On: 08/19/11 6:00 AM

Apple Escorts providing their services to Royal personalities, Realy our services are best in Escort profession.we have high

class girls who are well qualified and very fluent in English and in other languages.

Posted By: Mumbai Escorts On: 08/19/11 6:24 AM

Escorts Queen providing their services to Royal personalities, Realy our services are best in Escort profession.we have high

class girls who are well qualified and very fluent in English and in other languages.

Posted By: Jaipur Escorts On: 08/19/11 6:32 AM

Thanks for allowing to to reply to your post, very informative. Keep up the good work and Visit my website please. Thx

Posted By: Jaipur Escorts On: 08/19/11 6:34 AM

Thanks for allowing to to reply to your post, very informative. Keep up the good work and Visit my website please. Thx

Posted By: Mumbai Escorts On: 08/19/11 6:37 AM

We Provide Model and VIP Call Call Girls in Bangalore Like = Model,Escort Service in Bangalore,Russian Call Girls,

House wife, Celebrity, VIP Call Call Girls If you are in looking Call Girl in Bangalore .

Posted By: Bangalore Escorts On: 08/19/11 6:38 AM

Escorts in Delhi,Delhi Escorts,Escorts in Gurgaon,Gurgaon Escorts,Delhi Escort Service,Gurgaon Escort
Service,Escort Service In Delhi,Escort Service In Gurgaon

Posted By: Gurgaon Escorts On: 08/20/11 8:09 AM

It was very well authored and easy to understand. I also found your posts very interesting. In fact after reading, I had showed it to my friend and he enjoyed it well!

Posted By: ugg bailey button triplet On: 08/23/11 4:15 AM

I am agree with your all the views and really your article is nice and helpful..

Posted By: Delhi Escorts On: 09/10/11 1:50 AM

A person come to the farthest places a write our own path.chong

Posted By: nike high dunks On: 09/10/11 4:09 AM

good

Posted By: seo On: 09/10/11 5:20 PM

Dissertation research methodology chapter writing is of immense significance for the reason that it reveals how profoundly you have made the research for your papers. Find out the tips to write a dissertation methodology chapter.

Posted By: Dissertation methodology On: 09/15/11 7:48 AM

thanks you gods

Posted By: Sohbet odaLari On: 09/20/11 5:34 PM

thanks you ood byee

Posted By: Sohbet SiteLeri On: 09/20/11 5:36 PM

thanks you turkdiyari

Posted By: Avrupa Sohbet On: 09/20/11 5:40 PM

Very nice presentation of the post, I was suggested this blog by means of my bro. Thanks

Posted By: Download Games On: 09/24/11 2:17 PM

Gurgaon Escorts,Escorts In Gurgaon

Posted By: Gurgaon Escorts On: 09/26/11 6:40 AM

Now you are in the city of dreams “pune” by giving us a call and meeting one of the famous escorts in India.

Posted By: Pune Escorts Service On: 09/29/11 1:51 AM

gurgaon escorts,escorts in gurgaon

Posted By: Gurgaon Escorts On: 09/29/11 4:15 AM

Excellent post. I want to thank you for this informative read, I really appreciate sharing this great post.

Posted By: Mumbai Escorts On: 10/04/11 7:51 AM

I'm happy I found this blog! From time to time students want to cognitive the keys of productive literary essays composing. Your first-class knowledge about this good post can become a proper basis for such people. Thanks.

Posted By: Burberry Bags On: 10/13/11 4:07 AM

Every time I see a really good article I do a few things:1.Share it with all the relevant friends.2.save it in all of the favorite social sharing sites.3.Make sure to return to the blog where I read the post.After reading this post I am seriously concidering doing all 3!

Posted By: Houston Home Security On: 10/17/11 5:17 AM

We understand the different tastes of the customers about entertainment with Delhi Escorts alone. Our all Delhi escorts girls will accompany you for full night and satisfy you.

Posted By: Delhi escorts On: 10/19/11 12:05 AM

Truly impressive and nice information,it is good material to read this post increases my knowledge.

Posted By: Adira Asuransi Kendaraan Terbaik Indonesia On: 10/19/11 2:26 PM

Gurgaon Escorts,Escorts In Gurgaon,Independent Escorts In Gurgaon,Female Escorts In Gurgaon

Posted By: Gurgaon Escorts On: 10/22/11 3:59 AM

Gurgaon Escorts,Escorts In Gurgaon

Posted By: Gurgaon Escorts On: 10/22/11 4:01 AM


A knowledge, a growth, a good article can make a person to enhance the taste, thank you for sharing, I will carefully read the product to make themselves rich!

Posted By: Wholesale cheap jerseys On: 10/25/11 10:15 PM

but both stars, passers-by or fashion trend sweeping the world like the boots for several years, and is not the slightest sign of fever, MM are almost a pair of manpower, and this probably It looks lovely and warm for comfort. UGG sheepskin coat is no longer only, gold sequins brought style and comfort can easily make you a single step brilliance, party wear this pair of UGG, I do not know the wind is not quite pull it ? In recent years, knitting has begun vigorously attacking, a variety of colors and height, so your boots do have a shoe cupboard? If you do not act now!

Posted By: ugg bailey button clearance On: 10/27/11 2:52 AM

including Sharon Stone, Cindy Crawford, Jessica Simpson, Mak. Sellers line, nearly 20 Hollywood stars to play their artistic talent, as UGG Australia design "unique" snow boots, become a fashion story. Russian gymnastics star Nastya Liukin UGG boots are designed for the Russian style. Robert Ferre of UGG boots and a jungle atmosphere rugged

Posted By: ugg boots for women On: 11/01/11 11:53 PM

it can be called Hyun! Blink of an eye, from wearing short-sleeved jackets to wear the season into the season, the sudden cold weather, a lot of MM first thought

Posted By: uggs boots sale On: 11/05/11 4:07 AM

Blog post is really helps for my study; in fact I like This blog a lot.Nice attempt thanks,

Posted By: Dissertation Service On: 11/10/11 2:40 AM

This is a nice site. Good fresh, informative articles and beautiful interface.

Posted By: Delhi Escorts On: 11/12/11 1:49 AM

By the time, I started feeling some pain in my abs due to too much giggling, she started massaging my calf. That felt so good since I could relax and concentrate on her massage.

Posted By: London Reflexology On: 11/17/11 1:46 PM

This is a really quality post.Very attractive post.....

Posted By: Gurgaon Escorts On: 11/18/11 12:07 AM

UGG BOOTS Australia footwear for the 2011 winter classic knit adds a new section of the woven texture, the Bailey family elevated to coin a new level, and a strong return to the Mongolian sheepskin.

Posted By: cheap ugg boots for women On: 11/22/11 1:48 AM

All I can say is keep it up. This blog is so necessary in a time when everyone just wants to talk about how many people someones cheated on their wife with. I mean, thanks for bringing intelligence back to the web, its been sorely missed. Great stuff. Please keep it coming!

Posted By: Mesothelioma Chemotherapy Drugs On: 11/22/11 2:40 AM

This is a nice blog. Good clean UI and nice informative blogs. I will be coming back in a bit, thanks for the great post. I admire what you have done here.

Posted By: salons On: 11/22/11 11:58 AM

love the part where you say you are doing this to give back but I would assume by all the comments that is working for you as well. Do you have any more info on this

Posted By: spas On: 11/22/11 11:59 AM

J'ai pensé qu'il allait y avoir une certaine message ennuyeux, mais c'est vraimentcompensé pour mon temps. Je vais poster un lien vers cette page sur mon blog. Je suis sûr que mes visiteurs trouveront que très utile

Posted By: Lancel On: 11/23/11 2:03 AM

Preparation of wool-like sweet heart-shaped ring designed to catch the warm heart of the sewing machine, creating a warm, pleasant favor the appearance of soft sweet temperament show girls ~ ~ side of the bow strap balls, the balls whistling round , with the pace and move, you can go out with a one-piece dress dating Oh! for the first time with a delicate lace design Jihua, so sweet-degree snow boots instantly soared. Side of the cross-strap design is overflowing with romantic atmosphere, the wooden beads on the bow adds a sweet, exotic wind ~ Leopard is hard to resist the temptation to every girl, leopard flange design very personal yo ~! But also can turn up, as the boots to wear, can be used with different styles of clothes, super practical ~ ~ super-popular style snow boots, anti-folded soft touch furry, warm and lovely - feels good boots can also be do not fold into the real take plain boots - at least once to create a winter feel warm and lovely look ~ point of round one daughter's lovely to wear on the show look easy! Wool in the footsteps of the design so nice and warm - all winter to play a big bear national wind fall and winter fashion sense - is to buy the Department of weight fur furry boots!! Easy to show a strong personal sense of style, full of casual fashion CHECK ~ Tyrolean pattern, full of warmth ~ cute rabbit fur ball is the focus of tall shoes woven leather texture design, it is a love of the unique charm!

Posted By: uggs for cheap On: 11/24/11 3:35 AM

In recent years, UGG its thick, soft, casual nature made people of all ages around the world, it allows you to enjoy a super comfortable in the winter warmth, and look really cute bulky. Wound on the fabric and patent leather boots, snow boots zipper decoration that is full of stylish and unique, decorative fur boots along and add more warmth with the subsection ugly doll series pattern is more lovely. Snow boots super cute romantic style with brown pants, a warm winter is definitely the protagonist! Not look bloated. Lovely sweet dress most admired, snow boots with different suture material stitching and three-dimensional design, coordinate colors Dachu popular for this year, full sense of style. The length and width of stitching sweaters piercing sense of personality and lovely, warm snow boots with leggings have a sense of self. Has a fairy-tale plush fur, furry snow boots, super cute romantic, warm, winter is definitely the protagonist. Matte black down jacket with a red hat fabric piercing hot emotion, black snow boots with the overall coordination of feeling full. Knitted coat and take the nation a sense of style sweater piercing sweet, soft snow boots to wear clothing with a romantic atmosphere. Black snow boots with fur decoration please dull sense of black, lovely full degree! Red and white stripes and a long sweater with a white scarf to wear clothing in a lazy fashion sense, with snow boots, very cute!

Posted By: cheap ugg boots On: 11/28/11 9:57 PM

So nice and beautiful post.

Posted By: letrozole buy     On: 11/29/11 6:12 AM

This is a nice post. Good fresh, informative articles and beautiful interface.

Posted By: Delhi Escorts On: 11/30/11 12:16 AM

This is a nice post.

Posted By: Gurgaon Escorts On: 11/30/11 12:25 AM

Buy high quality CCTV camera, CCTV DVR, IP Camera, IP DVR, security camera and surveillance camera online with competitive price and fast worldwide shipping.

Posted By: CCTV Camera On: 11/30/11 1:30 AM

Leading American designer and maker of luxury lifestyle handbags and accessories.Large market in Europe and Canada,UK,USA etc.Welcom to Order!

Posted By: Coach outlet store online On: 12/02/11 2:27 AM

Great. This is truly the next step

Posted By: Piumini moncler italia On: 12/02/11 9:57 AM

India's No .1 trusted school admission portal offering online school application form, admission dates, admission criteria, contact details and other information of The Little Kingdom Nursery, New Friends Colony, New Delhi for all the parents desirous to know admission details of The Little Kingdom Nursery, New Delhi for their child's admission.

Posted By: The Little Kingdom Nursery New Friends Colony On: 12/03/11 2:53 AM

I have searched the net and I should say I've not come across an article like this which is so easy to understand and learn

Posted By: louis vuitton On: 12/05/11 9:33 PM

Once the very idea of shopping came in our own imagination it's nearly impossible that many of us overlook the ugg boots salebecause of their multi added benefits. New types arrived in ugg boots sale plus the are listed below. The new varieties of ugg boots are usually ugg highkoo boots, ugg mega boots, ugg dusk boots, ugg bailey control key boots, ugg payton boots, ugg saline boots, ugg elsy boots, ugg stripe cable connection knit, ugg sundane boots along with ugg youngsters boots. Most of these boots contain numerous shapes and colours as well as varities so are turned out to be hence positive for everybody.

Posted By: ugg boots On: 12/06/11 12:44 AM

The boots of a dress, a feeling; seemingly plain, but it is hidden edge. Simple shapes, gentle senses, as if invisible magic, a kind of existence can not be ignored.

Posted By: cheap ugg boots On: 12/07/11 12:56 AM

Thanks for that good & important information.

Posted By: Delhi Escorts On: 12/07/11 2:15 AM

An interesting discussion is worth comment.glad i came across your post, very informative indeed.

Posted By: شات On: 12/09/11 12:02 PM

Saints-Jersey-Shop.com Shop featuring Sports Apparel and Fan Gear
An New Orleans Saints fan? Then our New Orleans Saints shop can help you make your dream come true. Here you can find New Orleans Saints jerseys you want with all kinds of styles and colors. It's easy to get, just click your mouse. Here you can choose many types of Saints jerseys, such as authentic jerseys, premier jerseys, and replica jerseys, they are all of high quality. They are made of high-quality polyester two-way stretch pique fabric and has solid mesh inserts for ventilation. You can also see many jerseys of hot players such as Drew Brees, Jonathan Vilma and so on; you can choose what you like best from them. They are all free shipping and not tax.


Posted By: saints Jersey On: 12/13/11 8:16 PM

Actuellement, à travers les rues, vous pouvez souvent voir les deux hommes adultes ainsi que des femmes qui vont porter un sac à main. Par conséquent, tout au long de nombreuses de la foule, comment faut-il vous montrer distincts? Réponse dans le sacLongchamp. Longchamp pas cher conserver offre la mieux adaptée, étiquette de prixcoupe-gorge, utilisant une alimentation appropriés relatifs à la promesse pour tous ceuxsacs Longchamp Cher Pas, l'activité rapidement.

Posted By: Sac Longchamp On: 12/14/11 2:27 AM

Even if coach factory you invested on a colorful bag you have to choose the right occasion. But sometimes I just want to buy a soft color bag a magenta one.With guaranteed product quality, all products from coach factory outlet online are tested using precision electronic instruments before packing and delivery to clients. There will be good discount in order to back the support of majority of customers. Welcome to buy.

Posted By: coach factory On: 12/14/11 7:35 PM

coach outlet sells products which are excellent in quality and reasonable in price. All customers can easily pick up their favorite Coach briefcase, wallets, shoes, hats, scarf, jewelry and sunglasses.coach factory online provides people many coach goods. If you wish to snatch the coach handbag, then this best method is made for that you like for coach discount.

Posted By: coach outlet On: 12/14/11 7:50 PM

A coach factory tote could offer you those. Well, here are the four reasons why a it is a great buy. Some of the features you'll find in a Coach tote.coach factory stores is always packed and busy everyday. But you can shop on their website anytime, and you don't feel so pressured to grab everything you like before someone else does.

Posted By: coach factory On: 12/14/11 7:53 PM

its constant search for durable products

Posted By: cheap ugg boots On: 12/14/11 8:32 PM

that really a great topic, i just like it

Posted By: ETA7750 On: 12/15/11 2:06 AM

White hoodie, tight jeans and pink T-her body a perfect embodiment of good. but there is a problem, simply wrapped in a sheepskin in the foot on the beach and not walking on the road, he must come up with a more practical approach. In a surfing competition, when he finally came up with an idea to add a sheepskin shoes, ugg snow boots, was born.

Posted By: cheap ugg boots On: 12/18/11 8:15 PM

Agréable modèle Vintage nostalgiques peut être la peine de commencer à chauffer versla coutume, le style de 7 jours, bacs ainsi que add-ons veulent passer hommage en vue de précédentes années. Dernièrement, la France actuelle LANCEL fabricant traditionnela publié un certain nombre de bardage, que ce soit la modestie rationnelle, dynamiquede couleur jaune sac LANCEL couture; ou même l'excitation folle du Léopard LANCELlongues fourre-tout, le style élégant avec des composants d'époque, de sorte que lenuméro d'un des paquets très intéressant, ayant un vin de couleur rouge croco basébundle LANCEL couture, c'est l'atmosphère respectable, si vous êtes le MILF, aprèsqu'un certain nombre de low-key style de la bourse classique est la meilleure option.

Posted By: Lance On: 12/20/11 2:12 AM

Popular winter snow boots camel, its sales volume after the black line, tan lines with other cool colors of the lack of a warm feeling, so with any effect of cold and warm tones of the costumes are great, for example, with this navy blue long coat there is a kind of ice slightly monotonous overall warming effect, so that the color degree more rich and full. With several classic snow boots, many colors are used camel, camel is more of a wild snow boots, if you are still hesitant to buy what color snow boots, buy a camel must be true.

Posted By: new uggs 2011 On: 12/21/11 10:54 PM

Thats post shows off your thinking really clever you are?and that kind of post i have naver seen it before.thanks for sharing.I am very impressed with your thought. keep it up..

Posted By: custom dissertation On: 12/22/11 6:32 AM

old winter, snow boots to buy trousers with double insurance can protect the back of people's legs foolproof. Perhaps the legs do not have much confidence in the girls and not try to Hanhan snow boots

Posted By: cheap ugg boots for women On: 12/23/11 3:13 AM

thanks for sharing.

Posted By: Egitim On: 12/24/11 3:19 AM

great work, thank you

Posted By: Egitim On: 12/24/11 3:23 AM

I bought your cookbook and have been trying the various recipes for 3 weeks. What a difference in my vitality, health and waistline. I have also noticed a sharp decrease in sugar and caffeine cravings…and my waistline! Yah!

Posted By: meal for diet On: 12/24/11 2:38 PM

Thank you
I was pleased to be here

Posted By: شات On: 12/24/11 3:32 PM

Thank u so much dude for sharing your wonderful experiences with all of us.i am gonna come back again looking for some updates.Thanks.

Posted By: meal for diet On: 12/24/11 4:03 PM

Because the issue is a wonderful and unique and deserves thanks and follow through this new location and beautiful

Posted By: العاب بنات On: 12/25/11 3:35 PM

I read this post, Good blog for youngsters, because his take quality free knowledge on internet, thanks for wonderful sharing,

Posted By: graduate dissertation On: 12/26/11 12:08 AM

Coach Factory Outlet

Posted By: Coach Factory Outlet On: 12/28/11 3:54 AM

Concepteur ralph lauren dump sa première visite en Chine some sort of apporté beaucoup d'inspiration dans le dernier automne et l'hiver 2011 Big apple Vogue Full week défilé de manner, plein d'éléments de marque http://www.vetementpoloralphlaure2012.net de l'éolienne de Chine orientale. De soie lisse, mélanger de velours rouge, de Chinois, vert émeraude, jade, corail accessoires fabrique des vêtements avec des saveurs furthermore chinoise et occidentale. Dirigeant chinois, are generally broderie dragon, s'habiller, for example utilisé directement sur le défilé de manner s'avère être devenu une tache lumineuse.

Posted By: ralph lauren On: 12/29/11 2:37 AM

I would like to thank you for the efforts you have made while writing this post. I am hoping for the best work of the same from you in future.

Posted By: seattle dentist On: 01/03/12 5:07 AM

It was great reading your article! Keep up the good work..

Posted By: العاب أولاد On: 01/08/12 11:44 AM

This specific escort agency had become formed in just 1996. It really is had then looked after rigorously with the handling of a meaningful duo connected with top 6 men

Posted By: escorte On: 01/10/12 4:25 PM

This model, driven by the Hollywood star, swept the globe. C. classic reproduction. UGG rely on these two models 5815,5825, popular for decades. These two models have UGG 70% once the point of market share, while pushing the other style is mediocre, UGG according to the material, pattern properties to re-introduce a similar style to another paragraph number for sale. D.2009 years, UGG develop their own style, with leather LOGO pattern.

Posted By: uggs boots sale On: 01/11/12 9:43 PM

Did you know about Freelance writing job service? I wanted to tell that your ideas connecting to this good post is supreme! Thank you very much for creating it!

Posted By: Austin Custom Home Builder On: 01/12/12 9:10 AM

I am impressed by the way you covered this topic. It is not often I come across a blog with captivating articles like yours. I will note your feed to keep up to date with your approaching updates.Just striking and do uphold up the good work.                  

Posted By: Flatshare On: 01/16/12 12:32 AM

I am really impressed by reading this article. In future, you should be giving information about it more. I must have to praise you for this extra ordinary piece of work.

Posted By: valentines day flower delivery canada On: 01/18/12 6:30 AM

There are many reasons to further your education. Sadly, many people allow the business of their lives to keep them away from ever doing so. If you have had that itch to get back to school to further your education and want to once again start hitting the books, then you might want to consider going after an online degree.

Posted By: Law Essay On: 01/21/12 2:26 AM

Add Comment

Comments have been closed.

Transcript

no image

Slide Text

Slide Notes


PATTERNS IN ENTERPRISE DEVELOPMENT


ColdFusion Application Security: The Next Step
Jason Dean
www.12robots.com

no notes exist for this slide

Who am I


Who I am
Web Application Developer with the Minnesota Department of Health (MDH)‏
User Group Manager of the MDH CFUG
Web Development Blogger (http://www.12robots.com)
Veteran of the U.S. Coast Guard

no notes exist for this slide

The Basic Threats


The Next Steps
Request Forgeries
Password Security
Cookie Misuse/Exploits
Session Management

no notes exist for this slide

Slide 4


Request Forgeries

A request forgery, also sometimes called a Cross-Site (or On-Site) Request Forgery(XSRF), is an attack that is perpetrated against the user of a site who has authenticated access to that site The user is unwittingly tricked into performing actions on a site through hidden code displayed to them and, therefore, executed in their browser The hacker is writing a check and you're cashing it for him, without knowing it

That was confusing as hell


That was confusing

How about an Example? Delete page/function single parameter PageID Admin Only All is good, right?

Slide 6


Request Forgeries

One morning, Bob (one of our administrators) gets an email from Kay in accounting. It has a link to a bad joke on a Joke-of-the-Day site Bob finishes the joke, chuckles politely and deletes the email About 5 minutes later, the phone starts ringing. The company website is down WHAT HAPPENED?? The email Bob received wasn't from Kay in accounting It was from a Hacker who spoofed Kay's email address The link the hacker sent, did go to a Joke-of-the-Day pages, but the hacker left a comment for the joke and in his comment he placed the line:

Slide 7


Request Forgeries
So What Happened?

no notes exist for this slide

Slide 8


Request Forgeries

no notes exist for this slide

Slide 9


So what can we do about it?
The receiving action page/method probably:
Receives the request
Checks to make sure the user is authorized
Confirms that the ID is valid
Performs the action

So let's say we have a form that looks like this: Assume that it has other appropriate security to ensure only administrators have access The page or function this POSTs to is likely vulnerable to the forgery attack we just looked at

How do we fix it


How do we fix it?

Create a UUID (or GUID) Add that UUID to the form and the user session We can then check the result in the action page/method to confirm that it came from the right place

Slide 11


How do we fix it?
Action Page/Method

Another option is to ask for a second verification. Prompt “Are you sure?” Maybe even require them to enter their password again

Slide 12


Request Forgeries
Question?

no notes exist for this slide

Slide 13


Password Security

How do we get a secure password? Does every site need a “super” secure password? Password Best Practices Password Salting and Hashing Password Strength Function “Forgot My Password” Best Practices

Achieving a Secure Password


Achieving a Secure Password

alphabetical and numeric characters uppercase and lowercase letters special characters at least 7 or 8 characters long be changed every [Insert period of time here]. never contain the username or be a date

Have the password security scheme fit the website


Password Security Right for the Site

Do you need a $20,000 safe? Does every site need a “super” secure password? It is a judgment call, get the input of the people to whom data belongs There is no reason not to allow a strong password At a minimum, set a decent minimum length and require some alphas and some numerics Best Practices Don't set a minimum length above 8 character Where possible, use SSL Load the login form using SSL (although it only needs to POST to SSL)‏ Don't send Login credentials on th URL string (except for Web Services, and then, only over SSL)‏ Never store passwords in clear text Create an audit log of login attempts If you lock a user out after a certain number of login attempts, do not use a cookie or tie it to the user session, do it in the database

Slide 16


Password Hashing

From Wikipedia: "... a Cryptographic Hash Function is a transformation that takes an input and returns a fixed-size string, which is called the hash value. A hash is a One-Way Transformation A strong enough hash is virtually impossible to reverse A strong enough hash will have very few collisions We do it to transform a user's password into an irreversible string so that even if it becomes compromised, it cannot be used to determine the password

Hashing Example


Hashing Example
<cfset val1 = "Jason" />
<cfset val2 = "CFML" />
<cfset val3 = "jQuery is Awesome!!!" />

<cfset hash1 = Hash(val1,"MD5") />
<cfset hash2 = Hash(val2,"MD5") />
<cfset hash3 = Hash(val3,"MD5") />

<cfoutput>#hash1#</cfoutput><br />
<cfoutput>#hash2#</cfoutput><br />
<cfoutput>#hash3#</cfoutput><br />

no notes exist for this slide

Slide 18


Hashing Example
472D46CB829018F9DBD65FB8479A49BB
C2AF2111FF9C02C4EEE016CBCDF0D033
21AB8E7B12BA1793AB5156022492A5CD

MD5 Hash is not strong enough MD5 is fine for examples, but in the real world, MD5 is weak So what are the other options?

Slide 19


Stronger Hashing Example
In our previous example we had:
<cfset hash1 = Hash(val1,"MD5") />
<cfset hash2 = Hash(val2,"MD5") />
<cfset hash3 = Hash(val3,"MD5") />
Now let's add:
<cfset hash1 = Hash(val1,"SHA-256") />
<cfset hash2 = Hash(val2,"SHA-256") />
<cfset hash3 = Hash(val3,"SHA-256") />
<cfset hash1 = Hash(val1,"SHA-512") />
<cfset hash2 = Hash(val2,"SHA-512") />
<cfset hash3 = Hash(val3,"SHA-512") />

So let's compare the algorithms

Stronger Hashing Example MD5 Result


MD5 Result
472D46CB829018F9DBD65FB8479A49BB
CBD672C9AAF85A22968C7BCF9FF90EED
10F1C46CAF873486E530570E7A298BBB

no notes exist for this slide

Stronger Hashing Example SHA256 Result


SHA-256 Result

7FA8A6E9FDE2F4E1DFE6FB029AF47C9633D4B7A616A42C3B2889C5226A20238D

ECB12086B0B57E445BED6C67EF6EB6C4F5A23360264646F9EF76E3E667987142

440CA7EEBEE13499DB9C01537442579C7E3B63C5F76F1B0A16DE18DDA7E7704E

no notes exist for this slide

Stronger Hashing Example SHA512 Result


SHA-512 Result

27166A235CD42FB7E5A45CB89F542760373DCDC779E1697DB283013718904201D4D05537E63FD3815B596511C8704C50791C7BA3C504CAB516E622BDC6EC09C9

8C205EA4105BE9D89D44E84B4D00BCD52A84476180FEE63D99300AB4B23F2C30B77D6F7FD64D1B902F9BE85373D7394103EA58EDA174AD45892FDE0A56F0EF04

791FEDFCA713F52A42DDA68704213F5D8F5BC85953F385DF8D7835A7B32FBFD16047C213883D46DC0834DB7A6F2549EAF7AB8CF264C8A6C9082A2D0B5A420FFD

no notes exist for this slide

Hashing


Hashing
Question?

A specific string will ALWAYS result in the same hash value Collisions occur when two values have the same Hash value Strong hashing algorithms are going to have fewer collisions The longer the hash value, the less likely you will have collisions. COMMON QUESTION So if hashes aren't reversible, how can we tell if the user entered the correct password? When the user enters their password, while logging in, we hash it and compare the result to the hash that we stored in the database. Since a hash cannot be reversed, even if the DB becomes compromised, the information cannot be used to obtain password, nor can it be used to login using the hash instead of a password

Slide 24


Password Salting

What is Salting? Why we need salting We need salting because people make stupid password We also need passwords because hackers are smart If our passwords becomes compromised, and the passwords are hashed, then the hacker will start looking for like values If the hacker finds two hashed values that are exactly the same then that value is either a common dictionary word, a name, a date, or a stupid password The brute force attack on that user can then commence Salting ensures that no two hashes in our database ever have the same value, even if they are the same password Salting is the process of adding a random string of characters to the end of a user's password before hashing it. Each password would get its own salt hence eliminating the problem of two like passwords having the same hash value.

Password Salting Example


Salting Example
<cfset val1 = "Password1" />
<cfset val2 = "Password1" />

<cfset hash1 = Hash(val1, "MD5") />
<cfset hash2 = Hash(val2, "MD5") />
<cfset hash1Salted = Hash(val1 & "salt1", "MD5") />
<cfset hash2Salted = Hash(val2 & "salt2", "MD5") />

<cfoutput>Value 1 Hashed: #hash1#</cfoutput><br />
<cfoutput>Value 2 Hashed: #hash2#</cfoutput><br />
<br />
<cfoutput>Value 1 Salted and Hashed: #hash1Salted#</cfoutput><br />
<cfoutput>Value 2 Salted and Hashed: #hash2Salted#</cfoutput><br />

no notes exist for this slide

Password Salting Example Output


Salting Example Output
Value 1 Hashed: 2AC9CB7DC02B3C0083EB70898E549B63
Value 2 Hashed: 2AC9CB7DC02B3C0083EB70898E549B63
Value 1 Salted and Hashed: BAD4613B67109FD512580E3E67511652
Value 2 Salted and Hashed: 3BB315CF3BA97066614C79832C939098

Notice the hash without salting is identical between the two values But, once you add a salt, the two values are very different Of course, we need to store the salt that we use for each value so that when we hash the user input, we can append the salt

Forgot My Password Best Practices


Password Hashing and Salting
Question?

Never have your “Forgot My Password” function e-mail the users password (If you are hashing password you won't be able to anyway)‏ Either reset the users password and email them the new password or send the user a temporary URL that can be used for them to reset the password Force the user to change their password after they first log in after a reset Keep a log of the last X hashes of the users password so they cannot reset their password to something that have used previously (Within reason)‏ Make sure your Change Password functionality uses the same strength and hashing functions as your initial password set up Iterate your hashes 1000 times or more to slow down brute forcing and rainbow table attacks Do not login a user from the “Forgot My Password” section. Always make them go through their e-mail.

Slide 28


Session Management

What is a Session? Session Tokens Session Persistence Session Hi-Jacking Session Fixation Session Hi-Jack through XSS Brute-Force Session Hi-Jack Session Token Best Practices

Slide 29


What is a session?

Since the World Wide Web is stateless, we need sessions to persist data Session Management is a way to create statefulness in a stateless environment Each client is assigned a session token, used from request to request Information that is stored on the server can be provided to the client that provides the correct token After initial authentication, session management takes over and persists that authentication from request to request If the session token can be compromised then whoever gains access to a valid session token can impersonate the user to whom that token belongs That's called Session Hi-Jacking and all a hacker needs to accomplish a session hi-jacking is the session token How can the session token become compromised? Physical Access to a machine Sessions Fixation XSS Social Engineering Brute-Force Guessing

Slide 30


Session Token Types
ColdFusion

no notes exist for this slide

Slide 31


Session Persistence
Sessions can be persisted in 3 ways
In the URL String
http://www.12robots.com/mypage.cfm?CFID=2&CFTOKEN=10666880
In POST request

In a Cookie

Sessions can be persisted in 3 ways Passing in a URL (Tough to maintain) Developer has to remember to always pass the URL string End user can easily lose their session by messing with the URL Session Token will be logged by the web server Passing in POST requests (Very difficult to maintain) EVERY request from page to page needs to be a <form> Even Navigation Using a Token Cookie (Easy to do, easy to maintain, easier to secure) End user would have a hard time screwing it up Does require that your end users have cookies enabled

Slide 32


Manipulating CF Token Cookies

This solves three problems 1. Sessions token cookies are made SECURE (Only use this in SSL) 2. Makes session token cookies HTTPOnly (Does not afffect Ajax XMLHTTPRequest calls) 3. Makes cookies Session-Only (Non-persistent)

Slide 33


Manipulating JEE Token Cookies

This solves three problems 1. Sessions token cookies are made SECURE (Only use this in SSL) 2. Makes session token cookies HTTPOnly (Does not afffect Ajax XMLHTTPRequest calls) 3. Makes cookies Session-Only (Non-persistent)

Slide 34


Session Logout (ColdFusion)

This solves three problems 1. Sessions token cookies are made SECURE (Only use this in SSL) 2. Makes session token cookies HTTPOnly (Does not afffect Ajax XMLHTTPRequest calls) 3. Makes cookies Session-Only (Non-persistent)

Slide 35


Session Logout (J2EE)

This solves three problems 1. Sessions token cookies are made SECURE (Only use this in SSL) 2. Makes session token cookies HTTPOnly (Does not afffect Ajax XMLHTTPRequest calls) 3. Makes cookies Session-Only (Non-persistent)

Slide 36


Session Management
Question?

no notes exist for this slide

Cookie Security


Cookie Security

Do cookies store any important data? Should they?

Slide 38


Cookie Parameters
Name
Value
Expires
Path
Domain
Secure
HTTPOnly

<cfcookie secure=”true”

Slide 39


Cookie Domain and Path
www.awesomebloggers.com
12robots.awesomebloggers.com
domain=”.awesomebloggers.com”
hacker.awesomebloggers.com
domain=”.12robots.awesomebloggers.com”
www.awesomebloggers.com/12robots
Path=”/”
www.awesomeblogers.com/hacker
path=”/12robots”

Security Concerns with Path and Domain Parameters Path and Domain are often overlooked as a security concern. That can be bad So what's wrong with leaving the defaults for Path and Domain? Let's say you had an awesome website for bloggers. When a new blogger signs up, they get their own subdomain. 12robots.awesomebloggers.com When any blogger logs in they could get a cookie for domain=”.awesomecfbloggers.com” if we leave it as the default. Whenever a blogger from that site goes to another blog on that site, their site cookies are sent to it. A malicious user could create a new account called hacker.awesomecfbloggers.com Then invite the other bloggers on the same site. When the other bloggers visit, if they have current cookies for awesomecfbloggers.com, they will automatically be sent to the hacker site. The hacker can log those visits Then the hacker can use those sessionid values for session hijacking. The same thing applies to the Path value in the cookie: awesomebloggers.com/12robots

Slide 40


Setting the HTTPOnly Flag

Use to specify when a cookie can be accessed If set the cookie can only be used in HTTP transactions This prevent a JavaScript exploit from being used to access the cookie Stops many XSS attacks that would result in session hijacking

Questions


Questions?
Please ask your questions now
Comments?
Jason Dean
jason@12robots.com
http://www.12robots.com

no notes exist for this slide