4 Months Access with OnDemand Content + Special Offers Available Now: iPad mini, Surface Go 2, or $300 Off

Reading Room

Subscribe to SANS Newsletters

Join the SANS Community to receive the latest curated cyber security news, vulnerabilities and mitigations, training opportunities, and our webcast schedule.






Web Application Security

Featuring 4 Papers as of March 9, 2020

  • Uninitialized Memory Disclosures in Web Applications by Balint Varga-Perke - March 9, 2020 

    Since modern web applications are implemented in memory-safe languages, vulnerabilities arising from erroneous memory handling are often overlooked during web application testing. Recent research however shows that some memory-unsafe parsers are still popular members of the software supply chain, reanimating old bug classes. Disclosure of uninitialized memory is one of these bug classes that poses unique challenges for black- and white-box testing and vulnerability research as well. This paper will give an overview on the bug class and public cases of such vulnerabilities affecting web applications. Challenges, and possible approaches of black-box detection will be discussed in detail. Since the processing model of the affected software has a determining effect on the impact of memory disclosures, the effect of the vulnerabilities will be assessed against multiple application platforms.

  • View All Web Application Security Papers

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

All papers are copyrighted. No re-posting or distribution of papers is permitted.

SANS.edu Graduate Student Research - This paper was created by a SANS Technology Institute student as part of the graduate program curriculum.