SBDA âsame bug, different appâ - Security Assessment

More documents

Recommendations

Info

Some Common Vector Tests • Long Filename / Path name Anywhere a filename is used should be tested with a long filename or path • Long Parameter Any parameters or parameter names should be checked • Large Post / Chunked Encoding Sending of a large amount of data • String Manipulation Any obvious text strings should be tested • Length Value Manipulation Any obvious user supplied values should be tested Copyright Security-Assessment.com 2005
Some Common Test Methods • Fuzzing Create packets/files with injected arbitrary data • Manual Inspection Inspecting packets/files for vector avenues Reviewing RFC and packet formats for vector avenues • Reverse Engineering Debuggers and disassemblers • Automated Analysis Search files for [length]string pairs • Vector Automation Attempt some or all vectors against a target • Target Automation Attempt one vector against multiple targets Copyright Security-Assessment.com 2005
Page 1 and 2: SBDA “same bug, different app”
Page 3 and 4: SBDA - What It’s Not • Not The
Page 5 and 6: SBDA - The Conception • I Wanted
Page 7 and 8: How Can This Be Applied To Research
Page 9 and 10: The SBDA Advantage • Gives Resear
Page 11 and 12: The AV / Archive SBDA (in reverse)
Page 13: Packet vs File • Both Are Data Bo
Page 17 and 18: SDBA Theory In Practice • Some Ex
Page 19 and 20: The Long Value SBDA • Length Valu
Page 21 and 22: The Long Import SBDA • Jan, 2005
Page 23 and 24: The URL Handler SBDA • Mar 09, 20
Page 25 and 26: SBDA To The Test • Quick File Bas
Page 27 and 28: 2 nd Generation Vulnerabilities •
Page 29 and 30: Wrap Up • Same Bug, Different App

SBDA âsame bug, different appâ - Security Assessment

Create successful ePaper yourself

Delete template?

Save as template?

SBDA âsame bug, different appâ - Security Assessment