Resource Injection - Revision history

Andrew Smith at 19:59, 6 October 2015

2015-10-06T19:59:20Z

2015-10-05T19:38:16Z

Grammar, condensing sentences to be more clear

2015-10-05T19:34:38Z

2015-10-05T19:34:17Z

2015-10-05T19:30:57Z

2011-12-08T23:17:49Z

Add to Injection subcategory

2009-04-23T11:49:05Z

2009-04-07T22:49:31Z

2009-02-18T13:47:34Z

‎References: simplify SRD URL. Remove unnecessary <br> marks.

2009-02-16T20:37:04Z

← Older revision		Revision as of 19:59, 6 October 2015
Line 12:		Line 12:

	The resource injection attack differs from [[Path Manipulation]] as resource injection focuses on accessing resources other than the local filesystem, while [[Path Manipulation]] focuses on accessing the local filesystem.<br>		The resource injection attack differs from [[Path Manipulation]] as resource injection focuses on accessing resources other than the local filesystem, while [[Path Manipulation]] focuses on accessing the local filesystem.<br>
−
−	~~== Risk Factors==~~
−	~~TBD~~

	==Examples ==		==Examples ==

@@ Line 7: / Line 7: @@
 ==Description==
-This attack consists of changing resource identifiers used by an application in order to perform a malicious task. When an application permits a user input to define a resource, like a file name or port number, this data can be manipulated to execute or access different resources.
+This attack consists of changing resource identifiers used by an application in order to perform a malicious task. When an application defines a resource type or location based on user input, such as a file name or port number, this data can be manipulated to execute or access different resources.
 <br>
-In order to be properly executed, the attacker must have the possibility to specify a resource identifier through the  application form and the application must permit its execution.
+The resource type affected by user input indicates the content type that may be exposed. For example, an application that permits input of special characters like period, slash, and backslash is risky when used in conjunction with methods that interact with the filesystem.
 The resource injection attack differs from [[Path Manipulation]] as resource injection focuses on accessing resources other than the local filesystem, while [[Path Manipulation]] focuses on accessing the local filesystem.<br>

@@ Line 60: / Line 60: @@
   ...
-===Example 5===
+===Example 4===
 This example shows a resource injection attack focused on obtaining Microsoft Windows SMB hashes from a remote server:

@@ Line 59: / Line 59: @@
   WPG_DOCLOAD.download_file(filename);
   ...
 ==Related [[Threat Agents]]==
@@ Line 79: / Line 84: @@
 * http://samate.nist.gov/SRD/view_testcase.php?tID=1734
 * http://cwe.mitre.org/data/definitions/99.html
 * http://capec.mitre.org/data/index.html#Definition
 * http://www.fortifysoftware.com/vulncat/

@@ Line 13: / Line 13: @@
 The resource type affected by user input indicates the content type that may be exposed. For example, an application that permits input of special characters like period, slash, and backslash is risky when used in methods that interact with the file system.
-The resource injection attack focuses on accessing other resources than the local filesystem, which is different attack technique known as a [[Path Manipulation]] attack.<br>
+The resource injection attack differs from [[Path Manipulation]] as resource injection focuses on accessing resources other than the local filesystem, while [[Path Manipulation]] focuses on accessing the local filesystem.<br>
 == Risk Factors==

← Older revision		Revision as of 11:49, 23 April 2009
Line 3:		Line 3:
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]

		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

	==Description==		==Description==

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]
 ==Description==

@@ Line 75: / Line 75: @@
 ==References==
-* http://samate.nist.gov/SRD/view_testcase.php?login=Guest&tID=1734 <br>
+* http://samate.nist.gov/SRD/view_testcase.php?tID=1734
-* http://cwe.mitre.org/data/definitions/99.html <br>
+* http://cwe.mitre.org/data/definitions/99.html
-* http://capec.mitre.org/data/index.html#Definition <br>
+* http://capec.mitre.org/data/index.html#Definition
-* http://www.fortifysoftware.com/vulncat/ <br>
+* http://www.fortifysoftware.com/vulncat/
 * G. Hoglund and G. McGraw. Exploiting Software. Addison-Wesley, 2004.