Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: C# Exceptions
From: "3 shool" <3shool () gmail com>
Date: Fri, 25 Aug 2006 15:39:24 -0700

Correct, MiTM is the larger perspective where someone could sit in
between and tamper data to cause exceptions.

How easy/feasible would it be for an attaker to run malicious code on
the application by causing access violation?

Can he/she get SYSTEM level access or run commands as SYSTEM such as
adding an user by doing this malicious access violations?

Are the other exceptions like Null Reference or Invalid Operation
serious? Can they be converted to an Access Violation?

On 8/25/06, Krpata, Tyler <tkrpata () bjs com> wrote:
It seems like you're saying that the application makes requests and
receives replies from a web service, and that you were able to crash the
application by sending invalid replies? In this case, maybe an attacker
that was able to launch a man in the middle attack could exploit the
application that way.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]