Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

YouTube

Sandboxes: Understanding and Exploiting Application Security Limitations

OWASP Foundation via YouTube

Overview

Explore the vulnerabilities and attack surfaces of application sandboxes in this 58-minute OWASP Foundation conference talk. Delve into the decomposition of popular sandboxes like Google Chrome, Adobe ReaderX, and Sandboxie from a pen-tester's perspective. Examine the limitations and implementation details of various sandbox technologies, and witness live demonstrations of sandbox breakout techniques using kernel and user mode exploits. Gain insights into potential malware strategies and lesser-known exploit vectors. Cover topics including sandbox types, OS internals, object integrity levels, syscall filters, user mode exploits, LPC ports, and defense-in-depth strategies. Enhance your understanding of application security and the importance of robust sandbox implementations in thwarting potential attacks.

Syllabus

Introduction
Agenda
What is a sandbox
Types of sandbox
OS internals
Type A Sandbox
Type B Sandbox
Master vs Slave
Object Integrity Levels
Resistance to malicious slaves
Adobe Reader
Chrome
Chrome Browser
Pinkie Pie
syscall filter
how it works
exploit
serious problem
user mode exploits
LPC ports
Adobe Reader vs Chrome
PDF brute force
CS RSS vulnerability
CS RSS exploit
Defense indepth
Conclusion

Taught by

OWASP Foundation

Reviews

Start your review of Sandboxes: Understanding and Exploiting Application Security Limitations

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Someone learning on their laptop while sitting on the floor.