Unexpected expected exception: think different about web-related vulnerabilities

No ratings

Presented at ZeroNights 2014 by

Ivan Novikov

This talk reviews the logic and design vulnerabilities of web applications which exist because of incorrect code exception processing and non-atomicity of operations. Conceptually, the attacks which exploit such vulnerabilities resemble race conditions. The important difference is that the attacker does not try and guess a certain target system condition but rather provokes it intentionally, so that the very attack vector affecting the system makes sure the target condition appears. Classic race conditions can also be exploited this way, but sometimes it is the only way.