Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Info about attack trees
From: Gage Bystrom <themadichib0d () gmail com>
Date: Mon, 28 May 2012 10:27:46 -0700

Never read any of his pieces on attack trees. That being said, and
having read over it, I believe it to be infeasible to make an attack
tree against any modern system, even with only the scope of web
applications. There are simply a vast majority of possible start
points, and what leafs that may exist all depend on what information
you gather. As in, while building an attack tree you might have to add
leaves as you attack the application. Such a final attack tree would
be amazingly complex.

If OP wants to go for that then that's his choice, but to be frank I
believe there are more productive uses of someone's time.

On Mon, May 28, 2012 at 7:20 AM, Peter Dawson <slash.pd () gmail com> wrote:
==> "there are no such thing as an attack tree."

Eh ??   Seems that Schneier was blowing smoke up in the air with his
thoughts on attack trees !!

Anyhoot, here's another good old linky Military Operations Research V10, N2,
2005, http://www.innovativedecisions.com/documents/Buckshaw-Parnelletal.pdf

/pd
On Fri, May 25, 2012 at 9:46 AM, Daniel Hadfield <dan () pingsweep co uk>
wrote:

You can create an XSS with a SQLi

If you can output on the page, you can inject HTML/JS with that variable


On 25/05/2012 09:58, Federico De Meo wrote:
Hello everybody, I'm new to this maling-list and to security in general.
I'm here to learn and I'm starting with a question :)

I'm looking for some informations about attack trees usage in web
application analysis.

For my master thesis I decided to study the usage of this formalism in
order to reppresent attacks to a web applications.
I need a lot of use cases from which to start learning common attacks
which can help building a proper tree.

From where can I start?

I've already read the OWASP top 10 vulnerabilities an I'm familiar with
XSS, SQLi, ecc. however I've no clue on how to combine them together in
order to perform the steps needed to attack a system. I'm looking for some
examples and maybe to some famous attacks from which I can understand which
steps are performed and how commons vulnerabilities can being combined
together. Any help is really appreciated.


-------------------
Federico.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault