web| security four, trying to control the Web site host
Some attacks exploit vulnerabilities in software running on a Web server to allow the server to execute an attacker's code. A notorious method of attack is to write a large amount of data to the cache to crash the cache. The following excerpt of a section of C + + code is vulnerable to this attack because it has no bounds checking.
void Byyourcommand (char* pszdata)
{char szbuffer[255];
strcpy (Szbuffer, pszdata); ...}
What happens if the strcpy () procedure is executed to overflow the stack? Figure 4 shows you the situation after the system stack overflowed. If an attacker writes too much data in the cache, it overrides the function call record. This is a data structure that contains registers that hold the entry code for the function, as well as the return address of the function. If the attacker's code overwrites the return address of the function, the attacker could execute any code on your computer.
Figure 4 by causing the cache to overflow, the attacker loads the attack code into memory,
Replace the return address of the function to execute the attack code
How does an attacker transplant his attack code onto your computer? The method he uses is to write code into the data cache, and the string that passes the example function can easily infect a hacker program such as a Trojan horse. There are a number of articles that have been introduced to this type of attack.
Hackers know that a vulnerable function (for example, the function cited above) is often invoked by code that responds to user input. An attacker sends an impossible long string to the server. If the cache overflows, the thread that handles his request will crash. The message prompted by an attacker to get an HTTP timeout indicates that the request thread has been corrupted.
How do you stop your Web site's applications from being exploited? First, add the latest security patches to the system software. Then, check the program code written using languages that allow direct access to memory (for example, C, C + +, and Delphi) to see if there are any security vulnerabilities.
Checking the code can give you endless confidence because you can find an application that is not easily attacked by a cache overflow. If you want to avoid such problems completely, you can only write code without using a language that accesses memory directly. You can use scripting languages (for example, JavaScript, Perl) or use explanatory language (such as Java). If you write code in a secure language, your Web site's operators can be freed from a security attack such as a cache overflow every day.
In addition, you should not blindly believe that all kinds of security technologies, although manufacturers in order to promote their products and make a good security quality commitment, but you know that there is no technology to ensure that your web is not subject to attack. So you need a certain amount of time and energy to study and discover the shortcomings of the web, and then find a way to solve the problem.
The security of the Web is very complex and wide-ranging, and in this article we discuss how to avoid the destruction and theft of Web applications and web data by preventing unauthorized users from unauthorized access to Web applications and improving the security of the Web site, from an external attack perspective.
