Penetration Testing mailing list archives
Re: Application security eval - methodology
From: Gamble <a629w () unb ca>
Date: Mon, 28 May 2001 15:54:20 -0300 (ADT)
Has anyone published a framework for evaluating the security impact of an application (that is, a "black box", a binary provided by a vendor)?
While I am not aware of a paper which talks about evaluating the security impact of a binary, there are a few good papers out there which talk about reverse engineering Windows binaries looking for common security holes (ie: buffer overflows and format string attacks). Check out: HalVar Flake's presentation at the Blackhat conference called "Finding holes in closed-source software" at http://www.blackhat.com/html/bh-europe-00/bh-europe-00-speakers.html and also Dark Spyrit's paper in Phrack 55 called "Win32 Buffer Overflows (Location, Exploitation and prevention". you can find it at http://www.blinky-lights.org/phrack/phrack55/P55-15 Cheers, -- Jamie
Current thread:
- Application security eval - methodology Léon (May 28)
- Re: Application security eval - methodology Gamble (May 28)