|
'''Improper input validation'''<ref name=":0">{{cite web |work=[[Common Weakness Enumeration]] |publisher=[[MITRE]] |title=CWE-20: Improper Input Validation |url=http://cwe.mitre.org/data/definitions/20.html |date=December 13, 2010 |accessdate=February 22, 2011}}</ref> or '''unchecked user input''' is a type of [[vulnerability (computing)|vulnerability]] in [[computer software]] that may be used for [[security exploit]]s.<ref name=hacking>{{cite book|title=Hacking: the art of exploitation|series=No Starch Press Series|publisher=Safari Books Online|first=Jon|last=Erickson|edition=2, illustrated|year=2008|ISBN= 978-1-59327-144-2}}</ref> This vulnerability is caused when "[t]he product does not validate or incorrectly validates input that can affect the control flow or data flow of a program."<ref name=":0" />
<!-- Please do not remove or change this AfD message until the issue is settled -->
{{Article for deletion/dated|page=String exploits|timestamp=20110219225246|year=2011|month=February|day=19|substed=yes}}
<!-- For administrator use only: {{Old AfD multi|page=String exploits|date=19 February 2011|result='''keep'''}} -->
<!-- End of AfD message, feel free to edit beyond this point -->
A '''string exploit''' is a [[security exploit]] involving handling of [[String (computer science)|string]] data in computer software.<ref name=hacking>{{cite book|title=Hacking: the art of exploitation|series=No Starch Press Series|publisher=Safari Books Online|first=Jon|last=Erickson|Edition=2, illustrated|year=2008|ISBN= 9781593271442}}</ref><ref>
{{cite web
| url = http://www.derkeiler.com/pdf/Mailing-Lists/securityfocus/pen-test/2003-02/0152.pdf
| title = SecurityFocus penetration: The Building of an exploit string
| date = February 27, 2003
| publisher = derkeiler.com
| accessdate = February 22, 2011
}}
</ref><ref>
{{cite web
| url = http://security.ece.cmu.edu/aeg/aeg-current.pdf
| title = AEG: Automatic Exploit Generation
| author = Thanassis Avgerinos, Sang Kil Cha, Brent Lim Tze Hao, and David Brumley
| date = 2010
| ___location = Pittsburgh
| publisher = ece.cmu.edu
| quote = The exploit string can be directly fed into the vulnerable application...
| accessdate = February 22, 2011
}}
</ref>
Examples include:
* Unchecked user input or Improper input validation<ref>{{cite web |work=[[Common Weakness Enumeration]] |publisher=[[MITRE]] |title=CWE-20: Improper Input Validation |date=December 13, 2010 |accessdate=February 22, 2011}}</ref>
* [[Format string attack]]
* [[Buffer overflow]]
* [[Cross-site scripting]]
* [[Directory traversal]]
* [[Null byte injection]]
* [[SQL injection]]
* [[Uncontrolled format string]]
* [[Null character|Asciiz exploit]]<ref>
{{cite web
| url = http://www.emagined.com/securityfocus-advisory/22831/mod-security-asciiz-byte-post-bypass-vulnerability
| title = Network security advisories article: Mod_Security ASCIIZ byte POST bypass Vulnerability
| date = July 15, 2008
| publisher = Emagined Security
| accessdate = February 22, 2011
}}
</ref>
== References ==
{{reflist}}
{{security-software-stub}}
{{DEFAULTSORT:String Exploits}}
[[Category:Computer security exploits]]
| 