Exposure Insecure Deserialization XML External Entities (XXE) Using Components with Known Vulnerabilities Broken Access Control Insufficient Logging&Monitoring
using (SqlConnection conn = new SqlConnection(connString)) { conn.Open(); SqlCommand cmd = new SqlCommand("SELECT Count(*) FROM Products WHERE ProdID=@pid", conn); SqlParameter prm = new SqlParameter("@pid", SqlDbType.VarChar, 50); prm.Value = Request.QueryString["pid"]; cmd.Parameters.Add(prm); int recCount = (int)cmd.ExecuteScalar(); }
{ //Always use a SecureRandom generator SecureRandom sr = SecureRandom.getInstance("SHA1PRNG"); //Create array for salt byte[] salt = new byte[16]; //Get a random salt sr.nextBytes(salt); //return salt return salt; }
[ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM "http://127.0.0.1:8888/test.txt" >]> <xml> <stuff>This is my Stuff</stuff> </xml> 開 Port 8888，啟動 python SimpleHTTPServer ，可以遠端傳送 http 請求
reader = new XmlTextReader(stream); reader.ProhibitDtd = true; //NEEDED because the default is FALSE!! Python： from lxml import etree xmlData = etree.parse(xmlSource,etree.XMLParser(resolve_entities=False))
code on Github http://blogs.360.cn/post/eos-node-remote-code-execution-vulnerability.html The Story of an EOS Chain Remote Code Execution Bug 全球最大男性交友網站
Web Assembly Sample Code ： libraries/chain/webassembly/binaryen.cpp (Line 78) Function binaryen_runtime::instantiate_module The Story of an EOS Chain Remote Code Execution Bug Out-of-Bounds Write Here • Useless checking here: assert doesn't work in release build • Copy-pasted code from WebAssembly project wasm-js.cpp • No code review & misunderstanding the scope of asser
Web Assembly Sample Code ： libraries/chain/webassembly/binaryen.cpp (Line 78) Function binaryen_runtime::instantiate_module The Story of an EOS Chain Remote Code Execution Bug Out-of-Bounds Write Here • Useless checking here: assert doesn't work in release build • Copy-pasted code from WebAssembly project wasm-js.cpp • No code review & misunderstanding the scope of asser
resized before written The valid value of the module->table.initial is 0~1024 The offset is a signed int32 read from WASM file By manipulate the fields of WASM file, we could overwrite memory behind the table vector
taka_aki
mizdra
takapy
tagomoris
oracle4engineer
sansan33
tanimuyk
devops_vtj
subroh0508
ks91
thekraken
eileencodes
mfonobong
katarinadahlin
tmiket
asonas
kneath
inesmontani
hatefulcrawdad
bcantrill
addyosmani
codingconduct
![Sample Code .NET – C# ： string connString = WebConfigurationManager.ConnectionStrings["myConn"].ConnectionString;](https://files.speakerdeck.com/presentations/059b6b23d95f466d951d7f8f76962e30/slide_147.jpg){kind=link}
![IIS 關閉不安全的設定 以修改機碼的方式，關閉SSL： 執行機碼設定(regedit.exe) 找到路徑 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Cont rol\SecurityProviders\SCHANNEL\Protocols\SSL2.0] 在SSL2.0資料夾上按右鍵→新增→機碼，然後輸入「Server」 接著在剛剛建立Server的資料夾下按右鍵→新增→DWORD(32 位元)值，然後輸入「Enabled」](https://files.speakerdeck.com/presentations/059b6b23d95f466d951d7f8f76962e30/slide_186.jpg){kind=link}
![Java Secure Hashing https://howtodoinjava.com/security/how-to-generate-secure-password-hash-md5-sha-pbkdf2-bcrypt-examples/ private static byte[] getSalt() throws NoSuchAlgorithmException](https://files.speakerdeck.com/presentations/059b6b23d95f466d951d7f8f76962e30/slide_191.jpg){kind=link}
![白名單過濾 限定檔案名稱及副檔名只限定出現數字及大小寫字母 [0-9],[a-zA-Z] 使用Hard Code 副檔名，限制能下載的檔案類型 <?php Include($_GET['file'].'.jpg');](https://files.speakerdeck.com/presentations/059b6b23d95f466d951d7f8f76962e30/slide_207.jpg){kind=link}
