Addon

Hacking and Securing C++

• sanitize user input
  • log injection, log poisoning, command injection, ...
  • mitigation: std::regex, basic for loop
• memory-leak -> DoS attack (https://owasp.org/www-community/vulnerabilities/Memory_leak)
  • mitigation: RAII
• buffer overflow -> arbitrary code execution
  • from stack
  • ROP
  • ROP chain
• double free memory (https://owasp.org/www-community/vulnerabilities/Doubly_freeing_memory)
• using freed memory (https://owasp.org/www-community/vulnerabilities/Using_freed_memory)

other

Use-After-Free:

Explanation: This occurs when a program continues to use a pointer after the memory it points to has been freed.

Exploitation: Attackers can use this to execute arbitrary code by reallocating the freed memory with malicious data. This is often exploited through heap spraying or carefully crafted memory management.

Double-Free:

Explanation: This happens when a program attempts to free the same memory location more than once.

Exploitation: It can lead to heap corruption and allow attackers to take control of the program's flow by manipulating the heap’s structure, enabling code execution or a denial-of-service (DoS) attack.

Format String Vulnerabilities:

Explanation: Occurs when user input is passed directly to formatted output functions (e.g., printf) without specifying a format string.

Exploitation: Attackers can read or write arbitrary memory locations by crafting input that alters the format string, enabling data leakage or arbitrary code execution.

Log Injection and Sensitive Data Exposure:

Explanation: Insufficient sanitization of user input before logging can result in attackers injecting malicious payloads or revealing sensitive application data.

Exploitation: This can result in logs containing scripts, code, or system information that might be exposed and used for further attacks.

Integer Overflow/Underflow:

Explanation: Occurs when an arithmetic operation results in a value too large or too small for the data type to handle, wrapping around to unexpected values.

Exploitation: Attackers can exploit this to bypass bounds checks or control loop behavior, potentially writing out-of-bounds and triggering a buffer overflow.

Null Pointer Dereference:

Explanation: Accessing a pointer that has not been initialized or has been set to nullptr.

Exploitation: While this often results in a crash, attackers could leverage this to cause DoS or potentially map the null page (depending on platform security measures) to execute controlled code.

Uninitialized Memory Access:

Explanation: When variables are read before being initialized, they can contain random data.

Exploitation: This can leak sensitive information from memory or introduce non-deterministic behavior. Attackers can exploit this to infer program state or inject malicious data if combined with other vulnerabilities.

Improper Exception Handling:

Explanation: If exception handling fails to catch or properly log sensitive errors, it can lead to unintentional information disclosure.

Exploitation: Attackers can crash the program in a way that dumps detailed stack traces or internal states to logs, which may include sensitive information, facilitating further attacks.

Race Conditions:

Explanation: These occur when a program’s behavior depends on the timing or sequence of uncontrollable events.

Exploitation: An attacker can exploit race conditions to access shared resources (like files or variables) in an inconsistent state, leading to data corruption, privilege escalation, or unauthorized access.

Heap-Based Buffer Overflow:

Explanation: A buffer overflow occurring on the heap rather than the stack.

Exploitation: Attackers can overwrite memory management structures in the heap, leading to arbitrary code execution or compromising other data structures.