security attacks cs 795. buffer overflow problem buffer overflow analysis of buffer overflow attacks
TRANSCRIPT
Security Attacks
CS 795
Buffer Overflow Problem
• Buffer overflow
• Analysis of Buffer Overflow Attacks
General Guidelines
For all user input, follow these guidelines:• Use validation controls whenever possible to limit user input to
acceptable values.• Always be sure that the value of the IsValid property is true
before running your server code. A value of false means that one or more validation controls have failed a validation check.
• Always perform server-side validation even if the browser is also performing client-side validation, to guard against users bypassing client-side validation. Do not use only client-side validation logic.
• Always re-validate user input in the business layer of your application. Do not rely on the calling process to provide safe data.
SQL Injection AttacksA SQL injection attack attempts to compromise your database (and
potentially the computer on which the database is running) by creating SQL commands that are executed instead of, or in addition to, the commands that you have built into your application.
• Stop SQL Injection Attacks Before They Stop You • SQL Injection attacks: Are you safe?• Manipulating Microsoft SQL Server Using SQL Injection To avoid SQL injection attacks, follow these guidelines:
* Do not create SQL commands by concatenating strings together, especially strings that include input from users. Instead, use parameterized queries or stored procedures.* If you are creating a parameterized query, use parameter objects to establish the values for the parameters.
Script Injection Attack
• Script injection A script injection attack attempts to send executable script to your application with the intent of having other users run it. A typical script injection attack sends script to a page that stores the script in a database, so that another user who views the data inadvertently runs the code.
• Securing Data Access
Script InjectionTo avoid script injection attacks, follow these guidelines:
* Encode user input with the HtmlEncode method, which turns HTML into its text representation (for example, <b> becomes <b>), and helps prevent the markup from being executed in a browser.* When using parameter objects to pass user input to a query, add handlers for the data source control's pre-query events and perform the encoding in those events. For example, handle the SqlDataSource control's Inserting event, and in the event, encode the parameter value before the query is executed.* If you are using the GridView control with bound fields, set the BoundField object's HtmlEncode property to true. This causes the GridView control to encode user input when the row is in edit mode.* For controls that can be put into edit mode, it is recommended that you use templates. For example, the GridView, DetailsView, FormView, DataList, and Login controls can display editable text boxes. However, except for the GridView control (see the previous point), the controls do not automatically validate or HTML-encode the user input. Therefore, it is recommended that you create templates for these controls, and in the template, include an input control such as a TextBox control and add a validation control. In addition, when extracting the value of the control, you should encode it.
Cross-site Scripting Attack
• http://www.acunetix.com/websitesecurity/xss.htm• http://www.cgisecurity.com/xss-faq.html• http://www.imperva.com/resources/glossary/
cross_site_scripting.html
• Cross-Site Scripting Vulnerabilities • Cross site scripting / XSS - How to find & fix it
