Web_programming

Code injection
در زبان c تکنیکی است از آن در مشکل امنیتی اخیر whatapps بهره گرفت اند.
یک توضیح ساده درباره آن
در زبان c اندیس ارایه ها چک نمیشود. بنابراین میتوان یک کد مخرب را درون بخش از حافظه قرار داد و با تغییر بخشی از حافظه که عمل jump را انجام میدهد کد مخرب را اجرا کرد !

252 viewsedited 18:23

Web_programming

For example, when a function is called the program (code inserted by the compiler) must store the address of the instruction to return to. So if this is the 32 bit word just before the beginning of the stack, one could do:




void foo() {
  int array[5]; 
  int var = 0; 
  int var2 = 0; // read in user input 
  printf("Enter index and value to write:"); 
  scanf("%i", var); 
  scanf("%i", var2); 
// malicious user might set var to -1 and var2 to an address to execute 
// if say the 32-bit value before the stack variables is the instruction to // return to 
  array[var] = var2
 // return now goes to malicious code 
}

284 viewsedited 18:26

Web_programming

یعنی در انتهای این تابع یک دستور return وجود دارد که توسط کامپایلر به یک آدرس که این تابع را فراخوانی کرده است بر میگردد ما با تغییر این بخش از حافظه به کد مخرب پرش میکنیم و کد را اجرا میکنیم!

296 viewsedited 18:32

Web_programming

یک مثال برای Buffer Overflow Attack

https://www.thegeekstuff.com/2013/06/buffer-overflow/?utm_source=feedly

Thegeekstuff

Buffer Overflow Attack Explained with a C Program Example

Buffer overflow attacks have been there for a long time. It still exists today partly because of programmers carelessness while writing a code. The reason I said ‘partly’ because sometimes a well written code can be exploited with buffer overflow attacks…

359 viewsedited 03:24

Web_programming

http://animista.net/

Animista - On-Demand CSS Animations Library

Animista is a CSS animation library and a place where you can play with a collection of ready-made CSS animations and download only those you will use.

466 views08:06

Web_programming

https://gist.github.com/danallison/3ec9d5314788b337b682

Gist

download string as text file

download string as text file. GitHub Gist: instantly share code, notes, and snippets.

255 views18:43

Web_programming

با دقت مطالعه کنید :)

https://dhavalkapil.com/blogs/Buffer-Overflow-Exploit/

#buffer_overflow

https://dhavalkapil.com

Buffer Overflow Exploit

Exploiting the buffer overflow vulnerability

322 viewsedited 18:48

Web_programming

In web development, a #polyfill is code that implements a feature on web browsers that do not support the feature. Most often, it refers to a JavaScript library that implements an HTML5 web standard, either an established standard (supported by some browsers) on older browsers, or a proposed standard (not supported by any browsers) on existing browsers. Formally, "a polyfill is a shim for a browser API"

https://en.wikipedia.org/wiki/Polyfill_(programming)

Wikipedia

Polyfill (programming)

code that implements a feature on web browsers that do not support the feature

308 views06:51

Web_programming

The Page #Visibility API is useful for the Web application to know whether it is currently displayed on the front or not, especially to stop resource-intensive UI animations or data refreshing when it is not needed. On the mobile devices, the primary reason for that is to reduce the battery usage.

https://whatwebcando.today/foreground-detection.html

WhatWebCanDo

What Web Can Do Today: Foreground Detection

Can I rely on the Web Platform features to build my app? An overview of the device integration HTML5 APIs.

273 views12:24

Web_programming