7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

7XHVGD\-XO\

7KLVFRQWHQWLVQRZDYDLODEOHLQWKH3OXUDOVLJKWFRXUVH(WKLFDO+DFNLQJ64/,QMHFWLRQ

3XWRQ\RXUEODFNKDWVIRONVLWVWLPHWROHDUQVRPHJHQXLQHO\LQWHUHVWLQJWKLQJVDERXW64/LQMHFWLRQ1RZUHPHPEHU\DOOSOD\QLFHZLWKWKHELWVDQGSLHFHV\RXUHDERXWWRUHDGRN"

64/LQMHFWLRQLVDSDUWLFXODUO\LQWHUHVWLQJULVNIRUDIHZGLIIHUHQWUHDVRQV

,WVJHWWLQJLQFUHDVLQJO\KDUGHUWRZULWHYXOQHUDEOHFRGHGXHWRIUDPHZRUNVWKDWDXWRPDWLFDOO\SDUDPHWHULVHLQSXWV\HWZHVWLOOZULWHEDGFRGH

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

7KHHQWLUH85/SUREDEO\ORRNHGVRPHWKLQJOLNHWKLV

3UHWW\EDVLFVWXIIZKHUHLWVWDUWVWRJHWLQWHUHVWLQJLVZKHQ\RXFDQPDQLSXODWHWKHGDWDLQWKH85/VXFKWKDWLWFKDQJHVWKHYDOXHSDVVHGWRWKHTXHU\2NFKDQJLQJWRZLOOJLYH\RXDGLIIHUHQWZLGJHWDQGWKDWVWREHH[SHFWHGEXWZKDWLI\RXGLGWKLV

KWWSZLGJHWVKRSFRPZLGJHW"LG RU

7KDWPLJKWWKHQSHUVLVWWKURXJKWRWKHGDWDEDVHVHUYHUOLNHVR

:KDWWKLVWHOOVXVLVWKDWWKHGDWDLVQRWEHLQJVDQLWLVHGLQWKHH[DPSOHVDERYHWKH,'VKRXOGFOHDUO\EHDQLQWHJHU\HWWKHYDOXH25 KDVEHHQDFFHSWHG0RUHLPSRUWDQWO\WKRXJKEHFDXVHWKLVGDWDKDVVLPSO\EHHQDSSHQGHGWRWKHTXHU\LWKDVEHHQDEOHWRFKDQJHWKHIXQFWLRQRIWKHVWDWHPHQW5DWKHUWKDQMXVWVHOHFWLQJDVLQJOHUHFRUGWKLVTXHU\ZLOOQRZVHOHFWDOOUHFRUGVDVWKH VWDWHPHQWZLOODOZD\VEHWUXH$OWHUQDWLYHO\ZHFRXOGIRUFHWKHSDJHWRUHWXUQQRUHFRUGVE\FKDQJLQJRU WRDQG DVLWZLOODOZD\VEHIDOVHKHQFHQRUHVXOWV%HWZHHQWKHVHWZRDOWHUQDWLYHVZHFDQHDVLO\DVVHVVLIWKHDSSLVDWULVNRIDQLQMHFWLRQDWWDFN

7KLVLVWKHHVVHQFHRI64/LQMHFWLRQPDQLSXODWLQJTXHU\H[HFXWLRQZLWKXQWUXVWHGGDWDDQGLWKDSSHQVZKHQGHYHORSHUVGRWKLQJVOLNHWKLV

TXHU\ 6(/(&7)520:LGJHW:+(5(,' 5HTXHVW4XHU\6WULQJ>,'@([HFXWHWKHTXHU\

2IFRXUVHZKDWWKH\VKRXOGEHGRLQJLVSDUDPHWHULVLQJWKHXQWUXVWHGGDWDEXW,PQRWJRLQJWRJRLQWRWKDWKHUHUHIHUEDFNWRSDUWRQHRIP\2:$63VHULHVIRUPRUHLQIRRQPLWLJDWLRQLQVWHDG,ZDQWWRWDONPRUHDERXWH[SORLWLQJ64/L

2NVRWKDWEDFNJURXQGFRYHUVKRZWRGHPRQVWUDWHWKDWDULVNLVSUHVHQWEXWZKDWFDQ\RXQRZGRZLWKLW"/HWVVWDUWH[SORULQJVRPHFRPPRQLQMHFWLRQSDWWHUQV

/HWVWDNHDQH[DPSOHZKHUHZHH[SHFWDVHWRIUHFRUGVWREHUHWXUQHGWRWKHSDJHLQWKLVFDVHLWVDOLVWRIZLGJHWVRI7\SH,GRQD85/OLNHWKLV

KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G

Joining the dots: Union query-based injection

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G

7KHUHVXOWRQWKHSDJHWKHQORRNVOLNHVR

:HGH[SHFWWKDWTXHU\WRORRNVRPHWKLQJOLNHWKLVRQFHLWKLWVWKHGDWDEDVH

%XWLIZHFDQDSSO\ZKDW,YHRXWOLQHGDERYHQDPHO\WKDWZHPLJKWEHDEOHWRMXVWDSSHQG64/WRWKHGDWDLQWKHTXHU\VWULQJZHPLJKWEHDEOHWRGRVRPHWKLQJOLNHWKLV

KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G XQLRQDOOVHOHFWQDPHIURPV\VREMHFWVZKHUH[W\SH X

:KLFKZRXOGWKHQFUHDWHD64/TXHU\OLNHVR

1RZNHHSLQPLQGWKDWWKHV\VREMHFWVWDEOHLVWKHRQHWKDWOLVWVDOOWKHREMHFWVLQWKHGDWDEDVHDQGLQWKLVFDVHZHUHILOWHULQJWKDWOLVWE\[W\SHXRULQRWKHUZRUGVXVHUWDEOHV:KHQDQLQMHFWLRQULVNLVSUHVHQWWKDWZRXOGPHDQWKHIROORZLQJRXWSXW

7KLVLVZKDWVUHIHUUHGWRDVDXQLRQTXHU\EDVHGLQMHFWLRQDWWDFNDVZHYHVLPSO\DSSHQGHGDQDGGLWLRQDOUHVXOWVHWWRWKHRULJLQDODQGLWVPDGHLWVZD\RXWGLUHFWO\LQWRWKH+70/RXWSXWHDV\1RZWKDWZHNQRZWKHUHVDWDEOHFDOOHG8VHUZHFRXOGGRVRPHWKLQJOLNHWKLV

KWWSZLGJHWVKRSFRP:LGJHWV"7\SH,G XQLRQDOOVHOHFWSDVVZRUGIURP>XVHU@

64/6HUYHUJHWVDELWXSSLW\LIWKHWDEOHQDPHRIXVHULVQRWHQFORVHGLQVTXDUHEUDFNHWVJLYHQWKHZRUGKDVRWKHUPHDQLQJVLQWKH'%VHQVH5HJDUGOHVVKHUHVZKDWWKDWJLYHVXV

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

2IFRXUVHWKH81,21$//VWDWHPHQWRQO\ZRUNVZKHQWKHILUVW6(/(&7VWDWHPHQWKDVWKHVDPHQXPEHURIFROXPQVDVWKHVHFRQG7KDWVHDVLO\GLVFRYHUDEOHWKRXJK\RXMXVWWU\JRLQJZLWKDELWRIXQLRQDOOVHOHFWDWKHQLIWKDWIDLOVXQLRQDOOVHOHFWDEDQGVRRQ%DVLFDOO\\RXUHMXVWJXHVVLQJWKHQXPEHURIFROXPQVXQWLOWKLQJVZRUN

:HFRXOGJRRQDQGRQGRZQWKLVSDWKDQGSXOOEDFNDOOVRUWVRIRWKHUGDWDOHWVPRYHRQWRWKHQH[WDWWDFNWKRXJK7KHUHDUHWLPHVZKHQDXQLRQEDVHGDWWDFNLVQWJRLQJWRSOD\EDOOHLWKHUGXHWRVDQLWLVDWLRQRIWKHLQSXWRUKRZWKHGDWDLVDSSHQGHGWRWKHTXHU\RUHYHQKRZWKHUHVXOWVHWLVGLVSOD\HGWRWKHSDJH7RJHWDURXQGWKDWZHUHJRLQJWRQHHGWRJHWDELWPRUHFUHDWLYH

/HWVWU\DQRWKHUSDWWHUQZKDWLIZHGLGWKLV

KWWSZLGJHWVKRSFRPZLGJHW"LG RU[

+DQJRQWKDWVQRWYDOLG64/V\QWD[WKH[ SLHFHZRQWFRPSXWHDWOHDVWQRWXQOHVVWKHUHVDFROXPQFDOOHG[VRZRQWLWMXVWWKURZDQH[FHSWLRQ"3UHFLVHO\LQIDFWLWPHDQV\RXOOVHHDQH[FHSWLRQOLNHWKLV

7KLVDQ$631(7HUURUDQGRWKHUIUDPHZRUNVKDYHVLPLODUSDUDGLJPVEXWWKHLPSRUWDQWWKLQJLVWKDWWKHHUURUPHVVDJHLVGLVFORVLQJLQIRUPDWLRQDERXWWKHLQWHUQDOLPSOHPHQWDWLRQQDPHO\WKDWWKHUHLVQRFROXPQFDOOHG[:K\LVWKLVLPSRUWDQW",WVIXQGDPHQWDOO\LPSRUWDQWEHFDXVHRQFH\RXHVWDEOLVKWKDWDQDSSLVOHDNLQJ64/H[FHSWLRQV\RXFDQGRWKLQJVOLNHWKLV

KWWSZLGJHWVKRSFRPZLGJHW"LG FRQYHUWLQWVHOHFWWRSQDPHIURPV\VREMHFWVZKHUHLG VHOHFWWRSLGIURPVHOHFWWRSLGIURPV\VREMHFWVZKHUH[W\SH XRUGHUE\LGVTRUGHUE\LG'(6&

7KDWVDORWWRDEVRUEDQG,OOFRPHEDFNWRLWLQPRUHGHWDLOWKHLPSRUWDQWWKLQJLVWKRXJKWKDWLWZLOO\LHOGWKLVUHVXOWLQWKHEURZVHU

Making the app squeal: Error-based injection

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

$QGWKHUHZHKDYHLWZHYHQRZGLVFRYHUHGWKDWWKHUHLVDWDEOHLQWKHGDWDEDVHFDOOHG:LGJHW

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

,QWKHVFUHHQDERYH,GDOUHDG\EHHQDEOHWRGLVFRYHUWKDWWKHUHZDVDWDEOHFDOOHG8VHUDQGDFROXPQFDOOHG3DVVZRUGDOO,QHHGHGWRGRZDVVHOHFWRXWRIWKDWWDEOHDQGDJDLQ\RXFDQHQXPHUDWHWKURXJKDOOUHFRUGVRQHE\RQHZLWKQHVWHGVHOHFWVWDWHPHQWVDQGFDXVHDQH[FHSWLRQE\DWWHPSWLQJWRFRQYHUWWKHVWULQJWRDQLQW\RXFDQDOZD\VDSSHQGDQDOSKDFKDUWRWKHGDWDLILWUHDOO\LVDQLQWWKHQDWWHPSWWRFRQYHUWWKHZKROHORWWRDQLQWZKLFKZLOOFDXVHDQH[FHSWLRQ,I\RXZDQWWRJHWDVHQVHRIMXVWKRZHDV\WKLVFDQEH,UHFRUGHGDOLWWOHYLGHRODVW\HDUZKHUH,WHDFKP\\HDUROGWRDXWRPDWHWKLVZLWK+DYLMZKLFKXVHVWKHWHFKQLTXH

%XWWKHUHVDSUREOHPZLWKDOOWKLVLWZDVRQO\SRVVLEOHEHFDXVHWKHDSSZDVDELWQDXJKW\DQGH[SRVHGLQWHUQDOHUURUPHVVDJHVWRWKHJHQHUDOSXEOLF,QIDFWWKHDSSTXLWHOLWHUDOO\WROGXVWKHQDPHVRIWKHWDEOHVDQGFROXPQVDQGWKHQGLVFORVHGWKHGDWDZKHQZHDVNHGWKHULJKWTXHVWLRQVEXWZKDWKDSSHQVZKHQLWGRHVQW",PHDQZKDWKDSSHQVZKHQWKHDSSLVFRUUHFWO\FRQILJXUHGVRDVQRWWROHDNWKHGHWDLOVRILQWHUQDOH[FHSWLRQV"

7KLVLVZKHUHZHJHWLQWREOLQG64/LQMHFWLRQZKLFKLVWKHJHQXLQHO\LQWHUHVWLQJVWXII

,QWKHH[DPSOHVDERYHDQGLQGHHGLQPDQ\SUHFHGHQWVRIVXFFHVVIXOLQMHFWLRQDWWDFNVWKHDWWDFNVDUHGHSHQGHQWRQWKHYXOQHUDEOHDSSH[SOLFLWO\GLVFORVLQJLQWHUQDOGHWDLOVHLWKHUE\MRLQLQJWDEOHVDQGUHWXUQLQJWKHGDWDWRWKH8,RUE\UDLVLQJH[FHSWLRQVWKDWEXEEOHXSWRWKHEURZVHU/HDNLQJRILQWHUQDOLPSOHPHQWDWLRQVLVDOZD\VDEDGWKLQJDQGDV\RXVDZHDUOLHUVHFXULW\PLVFRQILJXUDWLRQVVXFKDVWKLVFDQEHOHYHUDJHGWRGLVFORVHPRUHWKDQMXVWWKHDSSOLFDWLRQVWUXFWXUH\RXFDQDFWXDOO\SXOOGDWDRXWWKURXJKWKLVFKDQQHODVZHOO

$FRUUHFWO\FRQILJXUHGDSSVKRXOGUHWXUQDPHVVDJHPRUHDNLQWRWKLVRQHKHUHZKHQDQXQKDQGOHGH[FHSWLRQRFFXUV

7KLVLVWKHGHIDXOWHUURUSDJHIURPDEUDQGQHZ$631(7DSSZLWKFXVWRPHUURUVFRQILJXUHGEXWDJDLQVLPLODU

Hacking blind

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

7KLVLVWKHGHIDXOWHUURUSDJHIURPDEUDQGQHZ$631(7DSSZLWKFXVWRPHUURUVFRQILJXUHGEXWDJDLQVLPLODUSDUDGLJPVH[LVWLQRWKHUWHFKQRORJ\VWDFNV1RZWKLVSDJHLVH[DFWO\WKHVDPHDVWKHHDUOLHURQHVWKDWVKRZHGWKHLQWHUQDO64/H[FHSWLRQVEXWUDWKHUWKDQOHWWLQJWKHPEXEEOHXSWRWKH8,WKH\UHEHLQJKLGGHQDQGDIULHQGO\HUURUPHVVDJHVKRZQLQVWHDG$VVXPLQJZHDOVRFRXOGQWH[SORLWDXQLRQEDVHGDWWDFNWKH64/LULVNLVHQWLUHO\JRQHULJKW"1RWTXLWH

%OLQG64/LUHOLHVRQXVJHWWLQJDORWPRUHLPSOLFLWRULQRWKHUZRUGVGUDZLQJRXUFRQFOXVLRQVEDVHGRQRWKHUREVHUYDWLRQVZHFDQPDNHDERXWWKHEHKDYLRXURIWKHDSSWKDWDUHQWTXLWHDVGLUHFWDVWHOOLQJXVWDEOHQDPHVRUVKRZLQJFROXPQGDWDGLUHFWO\LQWKHEURZVHUE\ZD\RIXQLRQVRUXQKDQGOHGH[FHSWLRQV2IFRXUVHWKLVQRZEHJVWKHTXHVWLRQKRZFDQZHPDNHWKHDSSEHKDYHLQDQREVHUYDEOHIDVKLRQVXFKWKDWLWGLVFORVHVWKHLQIRUPDWLRQZHKDGHDUOLHUZLWKRXWH[SOLFLWO\WHOOLQJXV"

:HUHJRLQJWRORRNDWWZRDSSURDFKHVKHUHERROHDQEDVHGDQGWLPHEDVHG

7KLVDOOFRPHVGRZQWRDVNLQJWKHULJKWTXHVWLRQVRIWKHDSS(DUOLHURQZHFRXOGH[SOLFLWO\DVNTXHVWLRQVVXFKDV:KDWWDEOHVGR\RXKDYHRU:KDWFROXPQVGR\RXKDYHLQHDFKWDEOHDQGWKHGDWDEDVHZRXOGH[SOLFLWO\WHOOXV1RZZHQHHGWRDVNDOLWWOHELWGLIIHUHQWO\IRUH[DPSOHOLNHWKLV

KWWSZLGJHWVKRSFRPZLGJHW"LG DQG

&OHDUO\WKLVHTXLYDOHQF\WHVWFDQQHYHUEHWUXHRQHZLOOQHYHUEHHTXDOWRWZR+RZDQDSSDWULVNRILQMHFWLRQUHVSRQGVWRWKLVUHTXHVWLVWKHFRUQHUVWRQHRIEOLQG64/LDQGLWFDQKDSSHQLQRQHRIWZRGLIIHUHQWZD\V

)LUVWO\LWPLJKWMXVWWKURZDQH[FHSWLRQLIQRUHFRUGLVUHWXUQHG2IWHQGHYHORSHUVZLOODVVXPHWKDWDUHFRUGUHIHUUHGWRLQDTXHU\VWULQJH[LVWVEHFDXVHLWVXVXDOO\WKHDSSLWVHOIWKDWKDVSURYLGHGWKHOLQNEDVHGRQSXOOLQJLWRXWRIWKHGDWDEDVHRQDQRWKHUSDJH:KHQWKHUHVQRUHFRUGUHWXUQHGWKLQJVEUHDN6HFRQGO\WKHDSSPLJKWQRWWKURZDQH[FHSWLRQEXWWKHQLWDOVRZRQWGLVSOD\DUHFRUGHLWKHUEHFDXVHWKHHTXLYDOHQF\LVIDOVH(LWKHUZD\WKHDSSLVLPSOLFLWO\WHOOLQJXVWKDWQRUHFRUGVZHUHUHWXUQHGIURPWKHGDWDEDVH

1RZOHWVWU\WKLV

.HHSLQJLQPLQGWKDWWKLVHQWLUHEORFNUHSODFHVMXVWWKHTXHU\VWULQJYDOXHVRLQVWHDGRI"LG LWEHFRPHV"LG DQGLWVDFWXDOO\RQO\DPLQRUYDULDWLRQRQWKHHDUOLHUUHTXHVWVLQWHQGHGWRUHWULHYHWDEOHQDPHV,QIDFWWKHPDLQGLIIHUHQWLVWKDWUDWKHUWKDQDWWHPSWLQJWRFDXVHDQH[FHSWLRQE\FRQYHUWLQJDVWULQJWRDQLQWHJHULWVQRZDQHTXLYDOHQF\WHVWWRVHHLIWKHILUVWFKDUDFWHURIWKHWDEOHQDPHLVDQDZHUHDVVXPLQJDFDVHLQVHQVLWLYHFROODWLRQKHUH,IWKLVUHTXHVWJLYHVXVWKHVDPHUHVXOWDV"LG WKHQLWFRQILUPVWKDWWKHILUVWWDEOHLQV\VREMHFWVGRHVLQGHHGEHJLQZLWKDQDDVWKHHTXLYDOHQF\KDVKHOGWUXH,ILWJLYHVXVRQHRIWKHHDUOLHUPHQWLRQHGWZRVFHQDULRVDQHUURURUVKRZVQRUHFRUGWKHQZHNQRZWKDWWKHWDEOHGRHVQWEHJLQZLWKDQDDVQRUHFRUGKDVEHHQUHWXUQHG

1RZDOORIWKDWRQO\JLYHVXVWKHILUVWFKDUDFWHURIWKHWDEOHQDPHIURPV\VREMHFWVZKHQ\RXZDQWWKHVHFRQG

Ask, and you shall be told: Boolean-based injection

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

1RZDOORIWKDWRQO\JLYHVXVWKHILUVWFKDUDFWHURIWKHWDEOHQDPHIURPV\VREMHFWVZKHQ\RXZDQWWKHVHFRQGFKDUDFWHUWKHQWKHVXEVWULQJVWDWHPHQWQHHGVWRSURJUHVVWRWKHQH[WSRVLWLRQ

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

KWWSZLGJHWVKRSFRP:LGJHWV"2UGHU%\ 1DPH

,QWKLVFDVHLWVSUHWW\IDLUWRDVVXPHWKDWWKHTXHU\ZLOOWUDQVODWHWKURXJKWRVRPHWKLQJOLNHWKLV

&OHDUO\ZHFDQWMXVWVWDUWLQJDGGLQJFRQGLWLRQVGLUHFWO\LQWRWKH25'(5%

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

GLIIHUHQWFRPELQDWLRQVRIGDWDEDVHDSSIUDPHZRUNDQGZHEVHUYHUQRWWRPHQWLRQDZKROHJDPXWRIGHIHQFHVVXFKDVZHEDSSOLFDWLRQILUHZDOOV$QH[DPSOHRIZKHUHWKLQJVFDQJHWWULFN\LVLI\RXQHHGWRUHVRUWWRDWLPHEDVHGDWWDFN\HWWKHGDWDEDVHGRHVQWVXSSRUWDGHOD\IHDWXUHIRUH[DPSOHDQ$FFHVVGDWDEDVH\HVVRPHSHRSOHDFWXDOO\GRSXWWKHVHEHKLQGZHEVLWHV2QHDSSURDFKKHUHLVWRXVHZKDWVUHIHUUHGWRDVKHDY\TXHULHVRULQRWKHUZRUGVTXHULHVZKLFKE\WKHLUYHU\QDWXUHZLOOFDXVHDUHVSRQVHWREHVORZ

7KHRWKHUWKLQJZRUWKPHQWLRQLQJDERXW64/LLVWKDWWZRUHDOO\VLJQLILFDQWIDFWRUVSOD\DUROHLQWKHVXFFHVVDQDWWDFNHUKDVH[SORLWLQJWKHULVN7KHILUVWLVLQSXWVDQLWLVDWLRQLQWHUPVRIZKDWFKDUDFWHUVWKHDSSZLOODFWXDOO\DFFHSWDQGSDVVWKURXJKWRWKHGDWDEDVH2IWHQZHOOVHHYHU\SLHFHPHDODSSURDFKHVZKHUHIRUH[DPSOHDQJOHEUDFNHWVDQGTXRWHVDUHVWULSSHGEXWHYHU\WKLQJHOVHLVDOORZHG:KHQWKLVVWDUWVKDSSHQLQJWKHDWWDFNHUQHHGVWRJHWFUHDWLYHLQWHUPVRIKRZWKH\VWUXFWXUHWKHTXHU\VRWKDWWKHVHURDGEORFNVDUHDYRLGHG$QGWKDWVNLQGRIWKHVHFRQGSRLQWWKHDWWDFNHUV64/SURZHVVLVYLWDOO\LPSRUWDQW7KLVJRHVZHOOEH\RQGMXVW\RXUDYHUDJH764/VNLOOVRI6(/(&7)520WKHSURILFLHQW64/LQMHFWRUXQGHUVWDQGVQXPHURXVWULFNVWRERWKE\SDVVWKHLQSXWVDQLWLVDWLRQDQGVHOHFWGDWDIURPWKHV\VWHPLQVXFKDZD\WKDWLWFDQEHUHWULHYHGYLDWKHZHE8,)RUH[DPSOHOLWWOHWULFNVOLNHGLVFRYHULQJDFROXPQW\SHE\XVLQJDTXHU\VXFKDVWKLV

KWWSZLGJHWVKRSFRP:LGJHW"LG XQLRQVHOHFWVXPLQVWRFNIURPZLGJHW

,QWKLVFDVHHUURUEDVHGLQMHFWLRQZLOOJLYHWHOO\RXH[DFWO\ZKDWW\SHWKH,Q6WRFNFROXPQLVZKHQWKHHUURUEXEEOHVXSWRWKH8,DQGQRHUURUZLOOPHDQLWVQXPHULF

2URQFH\RXUHWRWDOO\IHGXSZLWKWKHYHU\SUHVHQFHRIWKDWGDPQHGYXOQHUDEOHVLWHVWLOOEHLQJXSWKHUHRQWKHZHEDELWRIWKLV

KWWSZLGJHWVKRSFRP:LGJHW"LG VKXWGRZQ

%XWLQMHFWLRQJRHVDORWIXUWKHUWKDQMXVWSXOOLQJGDWDRXWYLD+773IRUH[DPSOHWKHUHDUHYHFWRUVWKDWZLOOJUDQWWKHDWWDFNHUVKHOORQWKHPDFKLQH2UWDNHDQRWKHUWDQJHQWZK\ERWKHUWU\LQJWRVXFNVWXIIRXWWKURXJK+70/ZKHQ\RXPLJKWEHDEOHWRMXVWFUHDWHDORFDO64/XVHUDQGUHPRWHO\FRQQHFWXVLQJ64/6HUYHU0DQDJHPHQW6WXGLRRYHUSRUW"%XWKDQJRQ\RXGQHHGWKHDFFRXQWWKHZHEDSSLVFRQQHFWLQJXQGHUWRKDYHWKHSULYLOHJHVWRDFWXDOO\FUHDWHXVHUVLQWKHGDWDEDVHULJKW"

7UR\+XQW(YHU\WKLQJ\RXZDQWHGWRNQRZDERXW64/LQMHFWLRQEXWZHUHDIUDLGWRDVN

KWWSZZZWUR\KXQWFRPHYHU\WKLQJ\RXZDQWHGWRNQRZDERXWVTOKWPO

)ROORZ#WUR\KXQW

3RVWHGDW7XHVGD\-XO\7DJV 6HFXULW\ 64/,QMHFWLRQ

1HZHU3RVW 2OGHU3RVW

XQGHUVWRRGIRUZHOORYHUWKDQDGHFDGH

3HUKDSV64/LLVQRWTXLWHDVZHOOXQGHUVWRRGDVVRPHSHRSOHWKLQN

/HDYLQJFRPPHQWVLVDZHVRPHSOHDVHGR$OO,DVNLVWKDW\RXEHQLFHDQGLILQGRXEWUHDG&RPPHQWVRQWUR\KXQWFRPIRUJXLGDQFH

7KLVZRUNLVOLFHQVHGXQGHUD&UHDWLYH&RPPRQV$WWULEXWLRQ8QSRUWHG/LFHQVH,QRWKHUZRUGVVKDUHJHQHURXVO\EXWSURYLGHDWWULEXWLRQ

Copyright 2014, Troy Hunt2SLQLRQVH[SUHVVHGKHUHDUHP\RZQDQGPD\QRWUHIOHFWWKRVHRIP\HPSOR\HUP\FROOHDJXHVP\PDWHVP\ZLIHWKHGRJDQGVRRQDQGVRIRUWK8QOHVV,PTXRWLQJVRPHRQHWKH\UHP\RZQRSLQLRQVDQGPD\QRWQHFHVVDULO\EHFRKHVLYHQRUHQWHUWDLQLQJEXWKH\DWOHDVWWKH\UHRULJLQDO

Disclaimer