Attack Patterns

Prev don't be afraid of buying books Next

Attack Patterns Attack Pattern: Make the Client Invisible 150 Attack Pattern: Target Programs That Write to Privileged OS Resources 152 Attack Pattern: Use a User-Supplied Configuration File to Run Commands That Elevate Privilege 153 Attack Pattern: Make Use of Configuration File Search Paths 156 Attack Pattern: Direct Access to Executable Files 162 Attack Pattern: Embedding Scripts within Scripts 164 Attack Pattern: Leverage Executable Code in Nonexecutable Files 165 Attack Pattern: Argument Injection 169 Attack Pattern: Command Delimiters 172 Attack Pattern: Multiple Parsers and Double Escapes 173 Attack Pattern: User-Supplied Variable Passed to File System Calls 185 Attack Pattern: Postfix NULL Terminator 186 Attack Pattern: Postfix, Null Terminate, and Backslash 186 Attack Pattern: Relative Path Traversal 187 Attack Pattern: Client-Controlled Environment Variables 189 Attack Pattern: User-Supplied Global Variables (DEBUG=1, PHP Globals, and So Forth) 190 Attack Pattern: Session ID, Resource ID, and Blind Trust 192 Attack Pattern: Analog In-Band Switching Signals (aka "Blue Boxing") 205 Attack Pattern Fragment: Manipulating Terminal Devices 210 Attack Pattern: Simple Script Injection 214 Attack Pattern: Embedding Script in Nonscript Elements 215 Attack Pattern: XSS in HTTP Headers 216 Attack Pattern: HTTP Query Strings 216 Attack Pattern: User-Controlled Filename 217 Attack Pattern: Passing Local Filenames to Functions That Expect a URL 225 Attack Pattern: Meta-characters in E-mail Header 226 Attack Pattern: File System Function Injection, Content Based 229 Attack Pattern: Client-side Injection, Buffer Overflow 231 Attack Pattern: Cause Web Server Misclassification 263 Attack Pattern: Alternate Encoding the Leading Ghost Characters 267 Attack Pattern: Using Slashes in Alternate Encoding 268 Attack Pattern: Using Escaped Slashes in Alternate Encoding 270 Attack Pattern: Unicode Encoding 271 Attack Pattern: UTF-8 Encoding 273 Attack Pattern: URL Encoding 273 Attack Pattern: Alternative IP Addresses 274 Attack Pattern: Slashes and URL Encoding Combined 274 Attack Pattern: Web Logs 275 Attack Pattern: Overflow Binary Resource File 293 Attack Pattern: Overflow Variables and Tags 294 Attack Pattern: Overflow Symbolic Links 294 Attack Pattern: MIME Conversion 295 Attack Pattern: HTTP Cookies 295 Attack Pattern: Filter Failure through Buffer Overflow 296 Attack Pattern: Buffer Overflow with Environment Variables 297 Attack Pattern: Buffer Overflow in an API Call 297 Attack Pattern: Buffer Overflow in Local Command-Line Utilities 297 Attack Pattern: Parameter Expansion 298 Attack Pattern: String Format Overflow in syslog() 324

	Amazon