Use Netbeans to create two different unique and complete demonstrations of insec

Question

Use Netbeans to create two different unique and complete demonstrations of insecure interaction between components such as SQL Injection, Command Line Injection, Cross-Site Scripting, Unrestricted Upload of File with Dangerous Type, Cross-Site Request Forgery (CSRF), or URL Redirection to Untrusted Site. You will demonstrate and describe how to fix each of the problems. Therefore a total of four code samples will be created. Two will have insecure interaction between components and two will have the issues fixed. Assignment Details Select 2 CWE/SANS Top 25 vulnerabilities under the category of Insecure Interaction between Components. Review and try the existing examples in links in the classroom. Use Netbeans to experiment. Work in multiple languages where possible. Using Netbeans, create your own unique, full example for each of the 2 vulnerabilities in this category. Demonstrate for each of the two applications they are vulnerable to this attack. You need to show explicitly the attack you use and demonstrate the impact of the vulnerability. The demonstration should occur through screen shots and detailed walkthrough of the steps you performed. Finally, using the information in the CWE/SANS Top 25 vulnerabilities, fix the issues in each of the two examples you created in step 2. Document the vulnerabilities and describe specifically how the issues were corrected.

Explanation / Answer

example for command line injection :

The following code is a wrapper around the UNIX command cat which prints the contents of a file to standard output.

It is also injectable:

=========== save this as catHack.cpp ========

========

create a text file : dummy.txt

with some dummy text.

Now run the below command :

the output would even contain the ls output which is a hack to your system.

--------------------------------------------------------------

SQL Injection : php

the below piece is to paginate your result with a passed offset from the user slected input.

<?php

$query  = "SELECT id, name FROM inventory ORDER BY price OFFSET $argv[0];";
$result = pg_query($conn, $query);

?>

now simply pass this a input of :

100;insert into user (name,password) values('test','test');

if user table exists in the db with columns name and password this user would gain access or get registered.

Related Questions

Navigate

• Browse (All)
• Browse U
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.