title: Escrow: A large-scale web vulnerability assessment tool

authors: Delamore, Baden

abstract: The reliance on Web applications has increased rapidly over the years. At the same time, the quantity and impact of application security vulnerabilities have grown as well. Amongst these vulnerabilities, SQL Injection has been classified as the most common, dangerous and prevalent web application flaw. In this paper, we propose Escrow, a large-scale SQL Injection detection tool with an exploitation module that is light-weight, fast and platform-independent. Escrow uses a custom search implementation together with a static code analysis module to find potential target web applications. Additionally, it provides a simple to use graphical user interface (GUI) to navigate through a vulnerable remote database. Escrow is implementation-agnostic, i.e. It can perform analysis on any web application regardless of the server-side implementation (PHP, ASP, etc.). Using our tool, we discovered that it is indeed possible to identify and exploit at least 100 databases per 100 minutes, without prior knowledge of their underlying implementation. We observed that for each query sent, we can scan and detect dozens of vulnerable web applications in a short space of time, while providing a means for exploitation. Finally, we provide recommendations for developers to defend against SQL injection and emphasise the need for proactive assessment and defensive coding practices.

text: Escrow: A large-scale web vulnerability assessment tool The reliance on Web applications has increased rapidly over the years. At the same time, the quantity and impact of application security vulnerabilities have grown as well. Amongst these vulnerabilities, SQL Injection has been classified as the most common, dangerous and prevalent web application flaw. In this paper, we propose Escrow, a large-scale SQL Injection detection tool with an exploitation module that is light-weight, fast and platform-independent. Escrow uses a custom search implementation together with a static code analysis module to find potential target web applications. Additionally, it provides a simple to use graphical user interface (GUI) to navigate through a vulnerable remote database. Escrow is implementation-agnostic, i.e. It can perform analysis on any web application regardless of the server-side implementation (PHP, ASP, etc.). Using our tool, we discovered that it is indeed possible to identify and exploit at least 100 databases per 100 minutes, without prior knowledge of their underlying implementation. We observed that for each query sent, we can scan and detect dozens of vulnerable web applications in a short space of time, while providing a means for exploitation. Finally, we provide recommendations for developers to defend against SQL injection and emphasise the need for proactive assessment and defensive coding practices.

year: 2015-01-15

title: Surface hydrologic modeling and GIS: a case study of the Kaimai Hydropower project catchment, New Zealand

authors: Choudhry, Sohail Afzal

abstract: The recent trend towards spatial hydrologic modeling is due to advances in the field of geographic information systems (GIS). Spatially distributed models take into account the spatial variability within the catchment and allow users to define parameters for each sub-watershed or river section depending on the availability of the data. A study was conducted at the Kaimai Hydropower catchment, Tauranga, to identify the potential advantages and disadvantages of spatial hydrologic modeling for use in surface runoff estimation while emphasizing the importance of GIS data quality and discussing the latest developments in the field of GIS. This study has developed a number of techniques to improve the usefulness of GIS for surface hydrologic modeling. A black box runoff model was also developed in order to evaluate the effectiveness of spatial surface hydrologic model as an inflow prediction tool.

The Kaimai Hydropower scheme is a small storage-constrained scheme and it is very important that such schemes optimize their available water resources in the present competitive electricity marketing environment. River inflow forecasts are an important part of optimizing hydropower schemes. A black box type inflow prediction model was developed and used as an input to the Kaimai Hydropower scheduling software (HYMAX). HYMAX results indicated a 7% improvement in the operation of the hydropower scheme when HYMAX results were compared with the control room operation. 

It is also important for the management of any hydropower scheme to see any impact of landuse change on their river resources. The Kaimai Hydropower catchment has undergone a landuse change from native bush to pinus radiata in several parts of the catchment since 1982. The analysis of electrical power output as a proxy for catchment water yield could not detect any reduction in annual or seasonal water yield. A slight increase in the water yield in winter and spring seasons after landuse change is attributed to the incremental nature of the landuse change. 

The use of GIS in the field of hydrology contains many hidden errors and the user must be aware of the quality of the data before its use. Different types of GIS errors such as generalization, rasterizing error, sink artifacts (and their impacts on the surface hydrologic modeling) were studied and solutions proposed. The digital elevation model is the basic digital data set to be used in surface hydrologic modeling using GIS. A technique was developed to build a hydrologically sound digital elevation model, and this was then applied to develop a surface runoff model using the curve number (CN) approach of excess rainfall estimation within the GIS framework. The unit hydrograph was used to translate the time distribution of excess rainfall into a runoff hydrograph, and routed at the watershed outlet using the Muskingum method. However, the CN method failed in the study area because the region has a high infiltration rate coupled with deep percolation through joints and cracks. The subsurface geology, rather than land surface characteristics, were the dominant factor here, so surface classification methods such as CN could not support predicting quickflow volumes. 

A map-based surface water flow simulation model, which is based on Geographic Information System (GIS) and object oriented programming (OOP), was evaluated after making necessary changes in its original code and applied to the study area to see its applicability as an inflow prediction tool. The selection of this model was based on its strength in addressing GIS and hydrologic modeling, as an integrated field in the area of runoff prediction involving time series data. The model gave a good match when compared with both observed and black box predicted inflows. It proved to be a good strategic management tool for planning purposes, but at present has limited use as an operational tool because of greater computational requirements involved. However, the map-based model is a good addition in the field of integrated spatial hydrologic modeling using GIS. It also solves many of the basic problems such as feature oriented map operations, dynamic segmentation of an arc, and spatial time series database development, which until recently were not possible in a GIS environment. 

This study shows the effective use of black box and GIS techniques by applying them to the study area, and demonstrates the integrated surface hydrologic modeling using ARC/INFO GIS and OOP in an ARCVIEW GIS environment. The importance of the GIS data quality for hydrologic applications is explained by studying the different types of GIS errors, and techniques were developed to handle the errors to improve the quality of the digital data. This study has also addressed new developments in surface hydrologic modeling within a GIS framework; and hopefully some of the solutions presented here will be of value to future work in spatial hydrology and related fields.

text: Surface hydrologic modeling and GIS: a case study of the Kaimai Hydropower project catchment, New Zealand The recent trend towards spatial hydrologic modeling is due to advances in the field of geographic information systems (GIS). Spatially distributed models take into account the spatial variability within the catchment and allow users to define parameters for each sub-watershed or river section depending on the availability of the data. A study was conducted at the Kaimai Hydropower catchment, Tauranga, to identify the potential advantages and disadvantages of spatial hydrologic modeling for use in surface runoff estimation while emphasizing the importance of GIS data quality and discussing the latest developments in the field of GIS. This study has developed a number of techniques to improve the usefulness of GIS for surface hydrologic modeling. A black box runoff model was also developed in order to evaluate the effectiveness of spatial surface hydrologic model as an inflow prediction tool.

The Kaimai Hydropower scheme is a small storage-constrained scheme and it is very important that such schemes optimize their available water resources in the present competitive electricity marketing environment. River inflow forecasts are an important part of optimizing hydropower schemes. A black box type inflow prediction model was developed and used as an input to the Kaimai Hydropower scheduling software (HYMAX). HYMAX results indicated a 7% improvement in the operation of the hydropower scheme when HYMAX results were compared with the control room operation. 

It is also important for the management of any hydropower scheme to see any impact of landuse change on their river resources. The Kaimai Hydropower catchment has undergone a landuse change from native bush to pinus radiata in several parts of the catchment since 1982. The analysis of electrical power output as a proxy for catchment water yield could not detect any reduction in annual or seasonal water yield. A slight increase in the water yield in winter and spring seasons after landuse change is attributed to the incremental nature of the landuse change. 

The use of GIS in the field of hydrology contains many hidden errors and the user must be aware of the quality of the data before its use. Different types of GIS errors such as generalization, rasterizing error, sink artifacts (and their impacts on the surface hydrologic modeling) were studied and solutions proposed. The digital elevation model is the basic digital data set to be used in surface hydrologic modeling using GIS. A technique was developed to build a hydrologically sound digital elevation model, and this was then applied to develop a surface runoff model using the curve number (CN) approach of excess rainfall estimation within the GIS framework. The unit hydrograph was used to translate the time distribution of excess rainfall into a runoff hydrograph, and routed at the watershed outlet using the Muskingum method. However, the CN method failed in the study area because the region has a high infiltration rate coupled with deep percolation through joints and cracks. The subsurface geology, rather than land surface characteristics, were the dominant factor here, so surface classification methods such as CN could not support predicting quickflow volumes. 

A map-based surface water flow simulation model, which is based on Geographic Information System (GIS) and object oriented programming (OOP), was evaluated after making necessary changes in its original code and applied to the study area to see its applicability as an inflow prediction tool. The selection of this model was based on its strength in addressing GIS and hydrologic modeling, as an integrated field in the area of runoff prediction involving time series data. The model gave a good match when compared with both observed and black box predicted inflows. It proved to be a good strategic management tool for planning purposes, but at present has limited use as an operational tool because of greater computational requirements involved. However, the map-based model is a good addition in the field of integrated spatial hydrologic modeling using GIS. It also solves many of the basic problems such as feature oriented map operations, dynamic segmentation of an arc, and spatial time series database development, which until recently were not possible in a GIS environment. 

This study shows the effective use of black box and GIS techniques by applying them to the study area, and demonstrates the integrated surface hydrologic modeling using ARC/INFO GIS and OOP in an ARCVIEW GIS environment. The importance of the GIS data quality for hydrologic applications is explained by studying the different types of GIS errors, and techniques were developed to handle the errors to improve the quality of the digital data. This study has also addressed new developments in surface hydrologic modeling within a GIS framework; and hopefully some of the solutions presented here will be of value to future work in spatial hydrology and related fields.

year: 1998

title: Interface of gender and culture

authors: Tamasese, Kiwi

subjects: Maori

abstract: I greet you in the soothing waters of the Pacific. The birth waters of Hawai’i to the North, island of the dream time, and Aotearoa, to the south. Papua New Guinea to the West and Marquesas to the East.  These islands are the gathering places of the world’s largest Continent, the Pacific. We of this continent know that her birth waters are our connection.  We also know that she is woman identified. It is no surprise therefore that from Hawai’i to the north to Aotearoa in the south the positioning of women in each of these societies bears a different story to that of the women of the continent of Europe.  This reality lived out in Hawai’i means women shared with men the ultimate leadership of peoples.  This location of women power is named Kuhinanui. Many remarkable women of Hawai’i occupied this position.  From times of peace throughout to the first clash with imposed new culture, women of Hawai’i led, bled, struggled, defied and kept the kukui of self belief burning. Genealogically Hawai’i is connected to her other sisters throughout the Pacific.  The story of Kuhinanui Liliuokalani is poignant.

text: Interface of gender and culture I greet you in the soothing waters of the Pacific. The birth waters of Hawai’i to the North, island of the dream time, and Aotearoa, to the south. Papua New Guinea to the West and Marquesas to the East.  These islands are the gathering places of the world’s largest Continent, the Pacific. We of this continent know that her birth waters are our connection.  We also know that she is woman identified. It is no surprise therefore that from Hawai’i to the north to Aotearoa in the south the positioning of women in each of these societies bears a different story to that of the women of the continent of Europe.  This reality lived out in Hawai’i means women shared with men the ultimate leadership of peoples.  This location of women power is named Kuhinanui. Many remarkable women of Hawai’i occupied this position.  From times of peace throughout to the first clash with imposed new culture, women of Hawai’i led, bled, struggled, defied and kept the kukui of self belief burning. Genealogically Hawai’i is connected to her other sisters throughout the Pacific.  The story of Kuhinanui Liliuokalani is poignant.

year: 1993