The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws



Download 5,76 Mb.
Pdf ko'rish
bet868/875
Sana01.01.2022
Hajmi5,76 Mb.
#293004
1   ...   864   865   866   867   868   869   870   871   ...   875
Bog'liq
3794 1008 4334

520

Chapter 14 



Exploiting Information Disclosure

70779c14.qxd:WileyRed  9/14/07  3:14 PM  Page 520



521

Compiled software that runs in a native execution environment has histori-

cally been plagued by vulnerabilities like buffer overflows and format string

bugs. The majority of web applications are written using languages and plat-

forms that run in a managed execution environment in which these classic vul-

nerabilities do not arise. One of the most significant advantages of languages

such as C# and Java is that programmers do not need to worry about the kind

of buffer management and pointer arithmetic problems that have affected soft-

ware developed in native languages such as C and C++, and have given rise to

the majority of critical bugs found in that software.

Nevertheless, you may occasionally encounter web applications that are

written in native code, and many applications written primarily using man-

aged code contain portions of native code or call out to external components

that run in an unmanaged context. Unless you know for certain that your tar-

get application does not contain any native code, it is worth performing some

basic tests designed to uncover any classic vulnerabilities that may exist.

Web applications that run on hardware devices such as printers and

switches very commonly contain some native code. Other likely targets

include any page or script whose name includes possible indicators of native

code, such as 

dll

or 


exe

, and any functionality known to call out to legacy

external components, such as logging mechanisms. If you believe that the

application you are attacking contains substantial amounts of native code,

then it may be desirable to test every piece of user-supplied data processed by


Download 5,76 Mb.

Do'stlaringiz bilan baham:
1   ...   864   865   866   867   868   869   870   871   ...   875




Ma'lumotlar bazasi mualliflik huquqi bilan himoyalangan ©hozir.org 2024
ma'muriyatiga murojaat qiling

kiriting | ro'yxatdan o'tish
    Bosh sahifa
юртда тантана
Боғда битган
Бугун юртда
Эшитганлар жилманглар
Эшитмадим деманглар
битган бодомлар
Yangiariq tumani
qitish marakazi
Raqamli texnologiyalar
ilishida muhokamadan
tasdiqqa tavsiya
tavsiya etilgan
iqtisodiyot kafedrasi
steiermarkischen landesregierung
asarlaringizni yuboring
o'zingizning asarlaringizni
Iltimos faqat
faqat o'zingizning
steierm rkischen
landesregierung fachabteilung
rkischen landesregierung
hamshira loyihasi
loyihasi mavsum
faolyatining oqibatlari
asosiy adabiyotlar
fakulteti ahborot
ahborot havfsizligi
havfsizligi kafedrasi
fanidan bo’yicha
fakulteti iqtisodiyot
boshqaruv fakulteti
chiqarishda boshqaruv
ishlab chiqarishda
iqtisodiyot fakultet
multiservis tarmoqlari
fanidan asosiy
Uzbek fanidan
mavzulari potok
asosidagi multiservis
'aliyyil a'ziym
billahil 'aliyyil
illaa billahil
quvvata illaa
falah' deganida
Kompyuter savodxonligi
bo’yicha mustaqil
'alal falah'
Hayya 'alal
'alas soloh
Hayya 'alas
mavsum boyicha


yuklab olish