Improper input validation
A string exploit is a security exploit involving handling of string data in computer software.[1][2][3]
Examples include:
- Unchecked user input or Improper input validation[4]
- Format string attack
- Buffer overflow
- Cross-site scripting
- Directory traversal
- SQL injection
- Asciiz exploit[5]
References
- ^ Erickson, Jon (2008). Hacking: the art of exploitation. No Starch Press Series. Safari Books Online. ISBN 9781593271442.
{{cite book}}: Unknown parameter|Edition=ignored (|edition=suggested) (help) - ^ "SecurityFocus penetration: The Building of an exploit string" (PDF). derkeiler.com. February 27, 2003. Retrieved February 22, 2011.
- ^
Thanassis Avgerinos, Sang Kil Cha, Brent Lim Tze Hao, and David Brumley (2010). "AEG: Automatic Exploit Generation" (PDF). Pittsburgh: ece.cmu.edu. Retrieved February 22, 2011.
The exploit string can be directly fed into the vulnerable application...
{{cite web}}: CS1 maint: multiple names: authors list (link) - ^ "CWE-20: Improper Input Validation". Common Weakness Enumeration. MITRE. December 13, 2010.
{{cite web}}:|access-date=requires|url=(help); Missing or empty|url=(help) - ^ "Network security advisories article: Mod_Security ASCIIZ byte POST bypass Vulnerability". Emagined Security. July 15, 2008. Retrieved February 22, 2011.