Surviving OpenHack IV: Yes, You Can Do It With Microsoft Technology

No ratings

Presented at BlackHatWindows 2003 by

Steve Riley

Timothy Bollefer

In October 2002 Microsoft participated in eWeek's OpenHack IV competition, an online contest designed to test enterprise security by exposing systems to the real-world rigors of the Web. Microsoft developed its sample application using the .NET Framework and XML web services and hosted it on Windows 2000 AS, IIS 5.0, and SQL Server 2000. The system withstood over 82,500 attacks and emerged unscathed. Attempted breaches included cross-site scripting attacks, dynamic web page source disclosure, web page defacement, posting malicious SQL commands to the database, and credit card number theft. This session will explain how the system was built and configured and will walk through the steps you can use to similarly secure your own systems.