BCP on SQL server and how to export metadata like table headers

A known limitation using "bcp" utility in SQL Server (2k5,2k8,2012) is that there is no way to include meta-data (say header names) to any exported table. There are some trick you can do to overcome such problem.
The basic idea is to create two ascii files, one with the header and one with the data. Then, you can create the final file that is the result of the concatenation of the above. Note the trick that is used in order to get a string that contains the columns of the respected table with the use of the global temp table.
I hope that this solution (that is indeed not very elegant) will help any friend facing the same problem.

Hunting asp.net Authentication and Session Ghosts

Asp.net handles the features of user authentication and user session in two different ways that sometimes may produce ghosts (bugs difficult to find) in our web applications.

The default forms authentication time is 20 mins. Session timeout is extended (to another 20 mins) for every request made to the server.
The default session time is 30 mins. When sliding expiration is true (that is the default), authentication timeout is extended for every request made to the server only after the first half of the total authentication time. The extension time is another 30 mins.

Authorization Attacks using Session hijacking

Abstract
Most of authorization methods are based on the user, password pair, provided by the user. The stateless nature of the Internet requires the server to remember every user that has logged in. Web applications create a unique session for every user. This session is stored somewhere on the server, usually in the database and on users' box via cookies or GET/POST variables. How possible is, for a malicious user, to use these cookies for impersonation? In this article we will try to explore some methods that used very often by malicious people in order to impersonate users. We are not trying to find a totally new world, but to uncover, or better, to formulate, the most recent methods used against current web applications that allow malicious attackers to believe that they are successful. Cookie attacks formulation, Session Prediction, Cross Site Request Forgery and
Session Fixation are methods that will be described with real examples.

Antivirus Hiding

There are a lot of choices when we want to pen test an application.

• We can create a specific program to do this.
• We can use an existing one.
• We can modify (or... fork) an existing.

 Maybe, the ideal is to create your own program for attack, but again, this, has some drawbacks:

• You don't have to reinvent the wheel.

Deadlines and cost make such approach impossible.