A look at the MS-SQL worm

A look at the MS-SQL worm

Posted Feb 1, 2003 7:40 UTC (Sat) by goonie (subscriber, #4252)
In reply to: A look at the MS-SQL worm by JoeBuck
Parent article: A look at the MS-SQL worm

The point is that, for security testing, debuggers are no good, as you can only run a debugger with an input that you have thought of. An attacker will construct an input you never thought of to try to break your code.

Two possible approaches:

1. get other peoplpe to think up inputs - seperate the programmers and the testers, in other words. This is a very basic software engineering practice.
2. Develop systematic methods for generating test cases to break your software (in the specific case of security testing, break into your software). The state of the art in this area is somewhat primitive.

---

(Log in to post comments)