Exploitation: Buffer Overflow, SQL injection, Adobe files Source:

Buffer Overflows n Integer Overflow Vulnerabilities – insufficient input validation, not a buffer overflow – errors in integer operations may cause the integer to overflowinteger to overflow – may represent the size of a packet or length of a stringsize of a packet or length of a string – exploits take advantage of integer overflow indirectly indirectly – a few actual examples.examples. n Stack-based Buffer Overflows – Buffer overflows are the result of a buffer receiving data that are larger than the allocate space. Buffer overflows – Stack-based overflows are the most common because are the easiest to exploit (see the examples in the link).Stack-based overflows – Modern compilers (e.g. MS Visual C ) use a technique known as stack cookies to prevent use of invalid return addresses, but not enough. stack cookies – Data Execution Prevention (DEP) of modern processors can be used to make the stack area non executable. Data Execution Prevention

SQL Injection n Concept “attacks that result from failing to validate input including portions of SQL statements in a web form entry field in an attempt to pass a newly formed rogue SQL command to the database.”attacks n Description and examples – PHP manual on SQL injection with examples, see also OWASP. PHP manualOWASP – Imperva video demonstration of SQL injection Imperva video – SQL Injection Cheat Sheet: code for MySQL, MS SQL, Oracle SQL Injection Cheat Sheet: n Scanning and mitigation – Business scanners and free scan tool Business scannersscan tool – Mitigation: sanitation, PHP mysql escape function and validation. Mitigationsanitation, PHP mysql escape function validation. – References: more in validation, MS library, ASSIST, parse tree validation.more in validationMS libraryASSISTparse tree validation.

Adobe files (pdf) n Why pdf files are a security issue?pdf – Most if not all machines have a pdf reader (some are vulnerable) – Attackers use pdf files to deliver malicious code because: users download them, and so do, automatically. browsers. – Malicious pdf files contain JavaScript, but some execute code even without JavaScript. n The pdf file structure: objects with text, streams, etc – Graphical representations: overview, Stevens, Parker, details.overviewStevensParker, details. – To run a JavaScript use <</Type/Action …. JS <</Open/Action << JS … Example of non-malicious use of JavaScript in pdf files.JavaScript Example – Stevens tools to parse and create JavaScript in a pdf file.tools to parse and create n Mitigating and/or reducing the risks of malicious pdf files – Disable JavaScript in the pdf reader, make browser open pdf files in the pdf reader. – Use Stevens tool to check for JavaScript in files you mistrust.