Software Vulnerability Guide

In today's market, secure software is a must for consumers. Many developers, however, are not familiar with the techniques needed to produce secure code or detect existing vulnerabilities. The Software Vulnerability Guide helps developers and testers better understand the underlying security flaws in software and provides an easy-to-use reference for security bugs. Most of these bugs (and the viruses, worms, and exploits that derive from them) start out as programmer mistakes. With this guide, professional programmers and testers will learn how to find, fix, and prevent these vulnerabilities before their software reaches the market. Detailed explanations and examples are provided for each of the vulnerabilities, as well as a summary sheet that can be referenced quickly. Tools that make it easier to recognize and prevent vulnerabilities are also explored, and source code snippets, commentary, and techniques are provided in easy-to-read sidebars. This guide is a must have for today's software developers.

Herbert Thompson (Melbourne Beach, FL) is the Director of Security Technology at Security Innovation LLC and serves on the graduate faculty of the Florida Institute for Technology Scott Chase (Melbourne, FL) is Security Architect at SI Government Solutions, where he manages key research projects for the US government

Acknowledgments	p. xiii
Introduction	p. 1
A Call to Action	p. 3
Security as a Call to Action for Developers	p. 4
Why Care about Security	p. 6
Thinking Differently about Security	p. 8
Entering the Era of Software Security	p. 9
Why We Wrote This Book and Why You Should Read It	p. 10
How This Book Is Structured	p. 13
Who We Are	p. 17
References	p. 18
Security Background	p. 19
Hacker versus Cracker versus Attacker: The Language of Computer Security	p. 20
Legal and Ethical Issues Surrounding Computer Security	p. 23
Federal Laws Related to Illegal Computer Use	p. 23
Ethical Reporting of Security Vulnerabilities	p. 26
Networking Basics	p. 26
Networking References	p. 35
References	p. 36
Some Useful Tools	p. 37
Security Scanners	p. 38
Comprehensive Scanning Tools	p. 38
Nmap and Network Scanners	p. 41
Packet Sniffing and Spoofing	p. 42
Hacking and Cracking Tools	p. 44
Password Crackers	p. 45
Packet Generation and Replay	p. 45
Network Fuzzing	p. 46
Web Site Test Tools	p. 47
Reverse Engineering Tools	p. 47
Source and Binary Scanners	p. 48
Specialty Editors	p. 49
API and System Monitors	p. 49
Disassemblers	p. 50
Using Debuggers for Security Testing	p. 50
Commercial Tools	p. 53
Retina	p. 53
AppScan	p. 53
WebProxy	p. 53
Holodeck	p. 53
For More Information	p. 55
System-Level Attacks	p. 57
Problems with Permissions	p. 59
The Bell-Lapadula Model	p. 60
Description	p. 62
Finding Programs with the Supervisor Bit Set	p. 64
Attacking Supervisor Mode Programs by Finding Side-Effect Functionality	p. 64
Attacking Supervisor Mode Programs by Exploiting a Buffer Overrun	p. 67
Windows: Not Immune From, but Less Prone to, Escalation of Privilege	p. 68
Fixing This Vulnerability	p. 69
The setuid() and seteuid() System Calls	p. 69
Summary Sheet-Running with Elevated Privilege	p. 70
References	p. 71
Permitting Default or Weak Passwords	p. 73
Finding Default and Weak Passwords	p. 75
Building a Password Cracker	p. 76
Using a Dictionary Helper	p. 78
Writing the Main Crack Routine	p. 80
Putting It Together	p. 83
Fixing This Vulnerability	p. 83
Summary Sheet-Permitting Default of Weak Passwords	p. 85
References	p. 86
Shells, Scripts, and Macros	p. 87
Description	p. 88
Embedded Script Languages and Command Interpreters	p. 89
Document Markup	p. 90
JavaScript	p. 90
Safe for Scripting ActiveX Controls	p. 91
Database Stored Procedures	p. 91
Macro Expansion in Logs and Messages	p. 91
Fixing This Problem	p. 92
Summary Sheet-Shells, Scripts, and Macros	p. 93
References	p. 94
Dynamic Linking and Loading	p. 95
Finding This Vulnerability	p. 100
Fixing This Vulnerability	p. 101
Explicit Linking and Loading of a DLL	p. 102
Summary Sheet-Dynamic Linking and Loading	p. 103
References	p. 104
Data Parsing	p. 105
Buffer Overflow Vulnerabilities	p. 107
Stack Overflows	p. 109
Exploiting Stack Overflows	p. 113
Heap Overflows	p. 116
Exploiting Buffer Overflows: Beyond the Stack	p. 122
Finding This Vulnerability	p. 127
White-Box Testing Techniques and Tools	p. 128
Black-Box Testing Techniques and Tools	p. 128
Fixing This Vulnerability	p. 130
Summary Sheet-Buffer Overflows	p. 131
Endnotes	p. 132
References	p. 132
Proprietary Formats and Protocols	p. 133
Description	p. 134
Same Data, Many Formats	p. 135
Using "Fuzzing" to Find Vulnerabilities in File Formats and Protocols	p. 138
Preventing Problems with Proprietary Formats and Protocols	p. 147
Summary Sheet-Proprietary Formats and Protocols	p. 148
Format String Vulnerabilities	p. 151
The Format Family	p. 156
Exploiting Format String Vulnerabilities	p. 158
Finding This Vulnerability	p. 168
Fixing This Vulnerability	p. 169
Summary Sheet-Format String Vulnerabilities	p. 170
References	p. 171
Integer Overflow Vulnerabilities	p. 173
Exploiting Integer Overflow Vulnerabilities	p. 179
Finding This Vulnerability	p. 179
Fixing This Vulnerability	p. 181
Summary Sheet-Integer Overflows	p. 182
References	p. 183
Information Disclosure	p. 185
Storing Passwords in Plain Text	p. 187
Finding This Vulnerability	p. 188
Fixing This Vulnerability	p. 196
Using the Unix Password Hashing Functions	p. 197
Using CryptCreateHash and CryptHashData in Windows	p. 198
Summary Sheet-Storing Passwords in Plain Text	p. 198
References	p. 200
Creating Temporary Files	p. 201
Finding This Vulnerability	p. 206
Fixing This Vulnerability	p. 207
Summary Sheet-Creating Temporary Files	p. 207
References	p. 209
Leaving Things in Memory	p. 211
Description	p. 212
Finding Exposed Data in Memory	p. 214
Fixing This Problem	p. 221
Summary Sheet-Leaving Things in Memory	p. 221
Endnote	p. 222
References	p. 222
The Swap File and Incomplete Deletes	p. 223
Using a Disk Editor to Find Confidential Data Fragments	p. 226
Fixing This Problem	p. 230
Summary Sheet-The Swap File and Incomplete Deletes	p. 232
On the Wire	p. 235
Spoofing and Man-in-the-Middle Attacks	p. 237
Finding Spoofing and Man-in-the-Middle Attacks	p. 238
Connection Hijacking	p. 240
Name Server Cache Poisoning	p. 247
Spoofing at the Application Level	p. 250
Other Kinds of Man-in-the-Middle Attacks: DHCP and 802.11	p. 252
Preventing Spoofing and Man-in-the-Middle Attacks	p. 252
Summary Sheet-Spoofing and Man-in-the-Middle Attacks	p. 252
References	p. 254
Volunteering Too Much Information	p. 255
Finding This Vulnerability	p. 260
Fixing This Vulnerability	p. 261
Summary Sheet-Revealing Too Much Information	p. 263
Web Sites	p. 265
Cross-Site Scripting	p. 267
Finding Cross-Site Scripting Vulnerabilities	p. 271
Fixing This Vulnerability	p. 274
Preventing More Advanced Cross-Site Scripting Vulnerabilities	p. 275
HTML-Encoding Output	p. 275
Summary Sheet-Cross-Site Scripting	p. 276
Forceful Browsing	p. 277
Description	p. 278
Finding Forceful Browsing Vulnerabilities	p. 281
Building a Forceful Browsing Test Tool	p. 283
Preventing Forceful Browsing	p. 295
Summary Sheet-Forceful Browsing	p. 295
Parameter Tampering, Cookie Poisoning, and Hidden Field Manipulation	p. 297
Cookie Values	p. 301
Form Data	p. 302
Query Strings	p. 306
HTTP Header Tampering	p. 306
Finding This Vulnerability	p. 307
Fixing This Vulnerability	p. 308
Summary Sheet-Parameter Tampering, Cookie Poisoning, and Hidden Field Manipulation	p. 309
References	p. 310
SQL Injection Vulnerabilities	p. 311
Exploiting Sites Through SQL Injection	p. 316
Finding This Vulnerability	p. 319
Index.html	p. 320
Process.asp	p. 321
Fixing This Vulnerability	p. 322
Process.asp	p. 322
Summary Sheet-SQL Injection	p. 323
References	p. 324
Additional Browser Security Issues	p. 325
The Domain Security Model	p. 326
Unsafe ActiveX Controls	p. 328
Spoofing of URLs in the Browser	p. 329
MIME Type Spoofing	p. 330
Uncommon URL Schemes	p. 330
Browser Helper Objects	p. 331
Summary Sheet-Additional Browser Security Issues	p. 331
Conclusion	p. 333
Conclusion	p. 335
Learning from Vulnerabilities	p. 338
Where to Go Next	p. 338
References	p. 339
About the CD-ROM	p. 341
Open Source Software Licenses	p. 343
Index	p. 349
Table of Contents provided by Ingram. All Rights Reserved.

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.