8/10/2019 Corina Aionitoaie Improper Output Handling

1/23

mproper Output Handling

Corina Aionioaie

25.11.2014

8/10/2019 Corina Aionitoaie Improper Output Handling

2/23

Agenda

Improper Output Handling

1. What is it?

2. Tpes

!. What does it lead to ?

4. Where "an ou #ind it?5. Atta"$s and %eports

&. 'i(liograph

8/10/2019 Corina Aionitoaie Improper Output Handling

3/23

8/10/2019 Corina Aionitoaie Improper Output Handling

4/23

8/10/2019 Corina Aionitoaie Improper Output Handling

5/23

What does it lead to ?

Improper Output Handling

Content poo#ing

Crossite "ripting

HTT %esponse plitting

HTT %esponse muggling

3A Ine"tion

O Commanding

%outing etour

oap Arra A(use

6%3 %edire"tor

783 Ine"tion

79uer Ine"tion

7ath Ine"tion

8ail Command Ine"tion

:ull Ine"tion

93 Ine"tion

8/10/2019 Corina Aionitoaie Improper Output Handling

6/23

Where "an ou #ind it ?

Improper Output Handling

an*here data lea,es an appli"ation (oundar lea,es one "onte;t< enters another

appli"ations passing data to other appli"ations ,ia = *e( ser,i"es so"$ets "ommand line en,ironmental ,aria(les

passing data (et*een tiers *ithin an appli"ation ar"hite"ture data(ase dire"tor ser,er HT83/>a,a"ript interpreter -(ro*ser

operating sstem

8/10/2019 Corina Aionitoaie Improper Output Handling

7/23

Where "an ou #ind it ?

Improper Output Handling

epending on *here it is pla"ed< se,eral atta"$s "an (e put in pla"e=

nside HTT Headers

atta"$s against HTT headers

)+

ine"tion o# C%/3 in order to "hange the HTT message stru"ture

)+

a(use (oth "lients -e.g. (ro*sers< and ser,ers -appli"ation ser,ers