4.0

147
Web Application Penetration Testing
overwriting the instruction pointer, similar results can also be
obtained by overwriting other variables and structures, like Exception
Handlers, which are located on the stack.
On opening the executable with the supplied arguments and
continuing execution the following results are obtained.
How to Test
Black Box testing
The key to testing an application for stack overflow vulnerabilities
is supplying overly large input data as compared to what is
expected. However, subjecting the application to arbitrarily large
data is not sufficient. It becomes necessary to inspect the application’s
execution flow and responses to ascertain whether an
overflow has actually been triggered or not. Therefore, the steps
required to locate and validate stack overflows would be to attach
a debugger to the target application or process, generate
malformed input for the application, subject the application to
malformed input, and inspect responses in a debugger. The debugger
allows the tester to view the execution flow and the state
of the registers when the vulnerability gets triggered.
On the other hand, a more passive form of testing can be employed,
which involves inspecting assembly code of the application
by using disassemblers. In this case, various sections are
scanned for signatures of vulnerable assembly fragments. This
is often termed as reverse engineering and is a tedious process.
As a simple example, consider the following technique employed
while testing an executable “sample.exe” for stack overflows:
#include
int main(int argc, char *argv[])
{
char buff[20];
printf(“copying into buffer”);
strcpy(buff,argv[1]);
return 0;
}
File sample.exe is launched in a debugger, in our case OllyDbg.
As shown in the registers window of the debugger, the EIP or Extended
Instruction Pointer, which points to the next instruction
to be executed, contains the value ‘41414141’. ‘41’ is a hexadecimal
representation for the character ‘A’ and therefore the string
‘AAAA’ translates to 41414141.
This clearly demonstrates how input data can be used to overwrite
the instruction pointer with user-supplied values and control
program execution. A stack overflow can also allow overwriting
of stack-based structures like SEH (Structured Exception
Handler) to control code execution and bypass certain stack protection
mechanisms.
As mentioned previously, other methods of testing such vulnerabilities
include reverse engineering the application binaries,
which is a complex and tedious process, and using fuzzing techniques.
Gray Box testing
When reviewing code for stack overflows, it is advisable to
search for calls to insecure library functions like gets(), strcpy(),
strcat() etc which do not validate the length of source strings and
blindly copy data into fixed size buffers.
For example consider the following function:-
void log_create(int severity, char *inpt) {
Since the application is expecting command line arguments, a
large sequence of characters such as ‘A’, can be supplied in the
argument field shown above.
char b[1024];