王峰不太愿意提子允和周晨晨的那种关系，结果还是触碰了，唉，别人的情网也法力无边。但事已至此，不好过分，作为好朋友，关键的时候怎么也该撑场子。那去就是，为了弟兄哪怕被王秀粘上四辈子也心甘，但你注意，我的灯泡很亮，菲利普2500瓦，够亮吧？我是它两个亮。没事，我本身光明正大，而且身上还背着发电机的。你老弟可要当心，别因为短路把身体给烧糊了。没事，那我就可以在烈火中永生了。《Y滋味》显文具店里中午放学后，四人汇聚到校门口边上的文具店里。显然两位女士没想到王峰会来，吃了一小惊。这又给了王秀展示厉害的机会，尽管香港六合彩平日与王峰不大熟，此时却搞得像三十年的老相识。哟，你也来啦？好啊，人多热闹。说完侧过脸坏笑着看子允，只不过赵大财主又要多破费了。子允跟王峰相视一笑，对香港六合彩说，如果钱不够，留下你给老板的儿子做童养媳。去，去，去，把晨晨留下差不多。哎，正经点儿，去哪吃饭？王秀向每个人扫一遍，一句话问了三个人。去麦当劳。王峰说。麦当劳吧。周晨晨跟道。我随便。子允的声音显得很突出。三个人很配合，被王秀这么一问，同时说出自己的想法。哎，香港六合彩两搞什么？回答得这么整齐？赵子允你可要小心了，王峰和晨晨很默契，强有力的竞争对手喔。王秀这句话很具煽动性，把王峰和晨晨弄得满脸通红。子允被牵其中，也红着脸不知看哪好。王秀，你说什么呀。周晨晨扯着香港六合彩的衣角小声责怪。就是，你这是挑拨香港六合彩兄弟感情，小心吃饭时王峰送你蹲厕所。子允趁机乱中添乱。打破混乱最好的方法就是让事情更混乱，子允一直这么认为。好，我同意，让香港六合彩吃不了兜着走。王峰扬起还在红着的脸，而且是在厕所吃不了兜着走。谈到厕所，女人最不好接招，王秀毫无还手之力，跟着傻笑。一般来说，一对一开损的时候不容易分出伯仲，如果二对一，那个一可就难有招架之力。假使三对一，那一的日子估计只有撕下脸自嘲一番才能逃过此劫。好了，既然两人都要去麦当劳，那香港六合彩抓紧时间吧，中午时间可不充裕。显然，子允对王秀的话很不在心，惦记着找机会用三对一的架式让香港六合彩乖巧一下嘴。到了麦当劳，子允和王峰主动担当起点餐任务，问清两位女生的需要后一起来到柜台排队点餐。周晨晨选了个靠窗的四人位子，然后单手托腮望着窗外卖红薯的老太太发呆。王秀则叽叽喳喳说终于敲诈到子允了。这头，子允正窃笑着王秀嘴大胃小，原以为香港六合彩真会让自己大把挥银，想不到香港六合彩只要了两对(又鸟)翅和一包大薯条，连饮料都是子允过意不去死活让香港六合彩要的。

1. The Art of Finding Flaws – Techniques for Finding Vulnerabilities in Custom Software Jeff Williams CEO, Aspect Security Chair, OWASP Foundation [email_address] 410-707-1487

2. The Future Ingredients: Sun Java 1.5 runtime, Sun J2EE 1.2.2, Jakarta log4j 1.5, Jakarta Commons 2.1, Jakarta Struts 2.0, Harold XOM 1.1rc4, Hunter JDOMv1 Software Facts Modules 155 Modules from Libraries 120 % Vulnerability* * % Vulnerability values are based on typical use scenarios for this product. Your Vulnerability Values may be higher or lower depending on your software security needs: Cross Site Scripting 22 65 % SQL Injection 2 Buffer Overflow 5 Total Security Mechanisms 3 Encryption 3 Authentication 15 95 % Modularity .035 Cyclomatic Complexity 323 Access Control 3 Input Validation 233 Logging 33 Expected Number of Users 15 Typical Roles per Instance 4 Reflected 12 Stored 10 Cross Site Scripting Less Than 10 5 Reflected Less Than 10 5 Stored Less Than 10 5 SQL Injection Less Than 20 2 Buffer Overflow Less Than 20 2 Security Mechanisms 10 14 Encryption 3 15 Usage Intranet Internet

7. SQL Injection Illustrated Firewall Hardened OS Web Server App Server Firewall Databases Legacy Systems Web Services Directories Human Resrcs Billing Custom Code APPLICATION ATTACK Network Layer Application Layer Accounts Finance Administration Transactions Communication Knowledge Mgmt E-Commerce Bus. Functions HTTP request  SQL query  DB Table  HTTP response  “ SELECT * FROM users WHERE user=‘ ’ OR 1=1-- ’ AND pass=‘password’” 1. Application presents a login form to the attacker 2. Attacker sends an attack in the form data 3. Application forwards attack to the database in a SQL query Successful Login “ Welcome, Alice” 4. Database runs query containing attack and sends results to application 5. Application thinks login worked and sends welcome page

12. Security Analysis Techniques Find Vulnerabilities Using the Running Application Find Vulnerabilities Using the Source Code Automated Vulnerability Scanning Automated Static Code Analysis Manual Penetration Testing Manual Code Review Combining All Four Techniques is Most Effective

20. Q&A A Q & Q U E S T I O N S A N S W E R S