Git-Mirrors/sec-pentesting-toolkit
1
0
Fork 0
mirror of https://github.com/autistic-symposium/sec-pentesting-toolkit.git synced 2025-05-02 06:46:07 -04:00
Code Issues Projects Releases Packages Wiki Activity

memory exploits

Browse source
This commit is contained in:
bt3gl 2014-11-20 13:20:19 -05:00
parent 37268762e1
commit 943728662f
2 changed files with 181 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
Pen_Testing/threat_modeling.md → Pen_Testing/README.md
View file

@ -1,4 +1,17 @@
# Threat Modeling (Design Review)
## Auditing Code
* Initial value assigments (failure to asign initial values can lead to vulnerabilities).
* Memory corruption (see Memory_Exploits folder).
* Static analysis tools:
- commercial: Fortify, Klockwork, Coverity
- free: LLVM Clang Static Analyzer, FindBugs (Java), RATS
----
## Threat Modeling (Design Review)
1. Information Collection:
* Assets
@ -37,3 +50,4 @@
* Checked build: an binary with no source code but with debugging information.
* Source black box: black box and fuzz testing (example: web applications). Example: auditing a web server with entry point at TCP port 80, you use a HTTP protocol fuzzer.
----