- Hunting Security Bugs
- Dedication
- Foreword
- Introduction
- 1. General Approach to Security Testing
- 2. Using Threat Models for Security Testing
- 3. Finding Entry Points
- 4. Becoming a Malicious Client
- 6. Spoofing
- 7. Information Disclosure
- 8. Buffer Overflows and Stack and Heap Manipulation
- Understanding How Overflows Work
- Testing for Overruns: Where to Look for Cases
- Black Box (Functional) Testing
- White Box Testing
- Additional Topics
- Testing Tips
- Summary
- 9. Format String Attacks
- What Are Format Strings?
- Understanding Why Format Strings Are a Problem
- Testing for Format String Vulnerabilities
- Walkthrough: Seeing a Format String Attack in Action
- Testing Tips
- Summary
- 10. HTML Scripting Attacks
- Understanding Reflected Cross-Site Scripting Attacks Against Servers
- Understanding Persistent XSS Attacks Against Servers
- Identifying Attackable Data for Reflected and Persistent XSS Attacks
- Common Ways Programmers Try to Stop Attacks
- Understanding Reflected XSS Attacks Against Local Files
- Understanding Script Injection Attacks in the My Computer Zone
- Ways Programmers Try to Prevent HTML Scripting Attacks
- Understanding How Internet Explorer Mitigates XSS Attacks Against Local Files
- Identifying HTML Scripting Vulnerabilities
- Finding HTML Scripting Bugs Through Code Review
- Summary
- 11. XML Issues
- 12. Canonicalization Issues
- Understanding the Importance of Canonicalization Issues
- Finding Canonicalization Issues
- File-Based Canonicalization Issues
- Web-Based Canonicalization Issues
- Testing Tips
- Summary
- 13. Finding Weak Permissions
- Understanding the Importance of Permissions
- Finding Permissions Problems
- Understanding the Windows Access Control Mechanism
- Finding and Analyzing Permissions on Objects
- Recognizing Common Permissions Problems
- Determining the Accessibility of Objects
- Other Permissions Considerations
- Summary
- 14. Denial of Service Attacks
- 16. SQL Injection
- Exactly What Is SQL Injection?
- Understanding the Importance of SQL Injection
- Finding SQL Injection Issues
- Avoiding Common Mistakes About SQL Injection
- Understanding Repurposing of SQL Stored Procedures
- Recognizing Similar Injection Attacks
- Testing Tips
- Summary
- 17. Observation and Reverse Engineering
- Observation Without a Debugger or Disassembler
- Using a Debugger to Trace Program Execution and Change its Behavior
- Using a Decompiler or Disassembler to Reverse Engineer a Program
- Analyzing Security Updates
- Testing Tips
- Legal Considerations
- Summary
- 18. ActiveX Repurposing Attacks
- Understanding ActiveX Controls
- ActiveX Control Testing Walkthrough
- Clear
- ClipboardCopy
- ClipboardPaste
- InvokeRTFEditor
- How Can an Attacker Specify the Editor InvokeRTFEditor Uses?
- Can an Attacker Bypass the Prompt?
- Can an Attacker Spoof the Prompt?
- How Is the Editor Launched?
- Which Component Creates the TomCC9.tmp File?
- Where Is the TomCC9.tmp File Stored?
- Is Data from the Control Pumped into the Editor? How?
- But Wait, There Is More!
- LoadRTF
- NumChars
- RTFEditor Property
- RTFEditor PARAM
- RTFEditorOverride
- Challenge
- Testing Tips
- Summary
- 19. Additional Repurposing Attacks
- 20. Reporting Security Bugs
- A. Tools of the Trade
- B. Security Test Cases Cheat Sheet
- C.
- About the Authors
- Copyright
About the Authors
Tom Gallagher is the lead of the Microsoft® Office Security Test team, where he focuses on penetration testing, writing security testing tools, and providing security education.
Bryan Jeffries is a software engineer responsible for driving security testing on Microsoft® SharePoint® Products and Technologies.
Lawrence Landauer is a software engineer at Microsoft® where he works on coding, testing, and training projects related to security, personal productivity, and deployment.
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.