Upload
corina-aionitoaie
View
224
Download
0
Embed Size (px)
Citation preview
8/10/2019 Corina Aionitoaie Improper Output Handling
1/23
mproper Output Handling
Corina Aionioaie
25.11.2014
8/10/2019 Corina Aionitoaie Improper Output Handling
2/23
Agenda
Improper Output Handling
1. What is it?
2. Tpes
!. What does it lead to ?
4. Where "an ou #ind it?5. Atta"$s and %eports
&. 'i(liograph
8/10/2019 Corina Aionitoaie Improper Output Handling
3/23
8/10/2019 Corina Aionitoaie Improper Output Handling
4/23
8/10/2019 Corina Aionitoaie Improper Output Handling
5/23
What does it lead to ?
Improper Output Handling
Content poo#ing
Crossite "ripting
HTT %esponse plitting
HTT %esponse muggling
3A Ine"tion
O Commanding
%outing etour
oap Arra A(use
6%3 %edire"tor
783 Ine"tion
79uer Ine"tion
7ath Ine"tion
8ail Command Ine"tion
:ull Ine"tion
93 Ine"tion
8/10/2019 Corina Aionitoaie Improper Output Handling
6/23
Where "an ou #ind it ?
Improper Output Handling
an*here data lea,es an appli"ation (oundar lea,es one "onte;t< enters another
appli"ations passing data to other appli"ations ,ia = *e( ser,i"es so"$ets "ommand line en,ironmental ,aria(les
passing data (et*een tiers *ithin an appli"ation ar"hite"ture data(ase dire"tor ser,er HT83/>a,a"ript interpreter -(ro*ser
operating sstem
8/10/2019 Corina Aionitoaie Improper Output Handling
7/23
Where "an ou #ind it ?
Improper Output Handling
epending on *here it is pla"ed< se,eral atta"$s "an (e put in pla"e=
nside HTT Headers
atta"$s against HTT headers
)+
ine"tion o# C%/3 in order to "hange the HTT message stru"ture
)+
a(use (oth "lients -e.g. (ro*sers< and ser,ers -appli"ation ser,ers