Sources and Sinks - Code Review Basics

  Рет қаралды 47,492

LiveOverflow

LiveOverflow

Күн бұрын

A very basic concept of security code audits is the sources/sinks. Everybody develops an intuition for it, but I still wanted to talk about it, because it would have helped me when I started out.
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow
=[ 📄 P.S. ]=
All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

Пікірлер: 48
@philippetrov4881
@philippetrov4881 6 жыл бұрын
Learning about "sources and sinks" is a good starting point for understanding the need of using design patterns to achieve secure programming. Great video and good explanation!
@AaronSilber
@AaronSilber 6 жыл бұрын
This is a great explanation. I frequently find myself grepping for potentially unsafe functions when cleaning hacked WordPress sites. Almost nobody has a legitimate use for PHP exec, shell_exec, passthru, or eval, yet almost every packed PHP web shell I've encountered uses some variant for decoding and exploitation.
@justanormalperson
@justanormalperson 6 жыл бұрын
these videos are so useful for learning new stuff
@Weasel_Squeezer
@Weasel_Squeezer 6 жыл бұрын
"sources" and "sinks" are also common terminology in stream processing among other software engineering related things.
@celivalg
@celivalg 5 жыл бұрын
a good example is pulseaudio
@fosatech
@fosatech 6 жыл бұрын
Great video! Thanks again
@taba1950
@taba1950 6 жыл бұрын
In electronics and control they are used to explain if the device is connected between the controller/processor and ground or Vcc
@Joshverd
@Joshverd 6 жыл бұрын
Very interesting. I do this a lot and never knew the name of the method! 🤔
@Gelio1234
@Gelio1234 6 жыл бұрын
By the way, innerHTML is not a function, but a property on DOM elements
@LiveOverflow
@LiveOverflow 6 жыл бұрын
oooops.
@Gelio1234
@Gelio1234 6 жыл бұрын
No worries, I just wanted to mention that :) I believe you have an awesome channel and I have learned a lot. Don't take this as nitpicking :)
@FahadAlQallaf
@FahadAlQallaf 6 жыл бұрын
Great video, thanks .
@flTobi
@flTobi 6 жыл бұрын
Meinem Schlafrythmus gefällt das
@domaincontroller
@domaincontroller 3 жыл бұрын
Excellent !
@punitdarji1871
@punitdarji1871 6 жыл бұрын
Such a great video...
@martinp.4797
@martinp.4797 6 жыл бұрын
Backwards > all !!! When you were young and you got the game with multiple wire and 1 solution, I just followed from the end the wire to know the solution !
@emmsthefemms
@emmsthefemms 3 жыл бұрын
i like to think of the sinks as consumers of the data generated from sources. e.g. event listeners
@yuyuko_s75
@yuyuko_s75 6 жыл бұрын
Hold shift right when the linux OS starts to get into grub, then go into advanced options, then recovery mode and go into the terminal as root. Then you have access to all the files and rm -rf / does not require a sudo, but there's no gui.
@yuyuko_s75
@yuyuko_s75 6 жыл бұрын
I'm a local server guy, I use Ubuntu because it's nice to use with my server.
@floriandaler5327
@floriandaler5327 6 жыл бұрын
Lassigamer Three things: Idk which Version of Ubuntu u use, but with 16.04 you get prompted the root password when booting into recovery mode for a shell . Second, rm -rf / doesn't work for known reasons, you have to pass --no-preserve-root to delete / . Third, if someone has physical acess to a PC with a malicious intent, you are clearly fucked. In GRUB, the attacker could add init=/bin/bash to the Kernel cmd line, and voilà, you are booting straight into a root Shell. Or He could use a live CD / remove the HDD to add a backdoor / change the root pwd or add other privileged users, 2nd of which might be less obvious. PS: sry for my Bad spelling, i'm from Germany and only 16 y/o
@IIAOPSW
@IIAOPSW 6 жыл бұрын
Just use the Divergence Theorem
@begrateful3405
@begrateful3405 4 жыл бұрын
wäre dann die IF anweisung mit exit ein Sanitizers. Muss nächste Woche präsentation über Code tainting halten
@Himanshu-yb9kz
@Himanshu-yb9kz 6 жыл бұрын
Where i can get the starting tone?
@MrJvdAli
@MrJvdAli Жыл бұрын
today I got an interview call and after an introduction they asked my experience in java after that they asked "and sunk security "where i replied "I am not familiar with that term " and that's it . I rejected . but my point to comment here is this topic/term "sunk security" so common in IT?, please someone guide me , i am getting curious to understand this topic which i never encounter in my past but everybody know about this . is this come under testing category in software field. did i understand correctly ?
@abiralshrestha2998
@abiralshrestha2998 6 жыл бұрын
4:28 ... i heard echo
@Rednesswahn
@Rednesswahn 6 жыл бұрын
#sourcesandsinks
@santypk5
@santypk5 6 жыл бұрын
Can you post the link to the github repo with sinks for domxsss?
@novaz8936
@novaz8936 6 жыл бұрын
Simple google search... that's all it took
@MrMartinZockt
@MrMartinZockt 6 жыл бұрын
Bei 0:54 habe ich die ganze Zeit überlegt was dieser schwarze Fleck bedeutet. Bis ich aus dem Vollbild raus bin und gemerkt habe, dass das "i"-Icon hinterlegt werden sollte. Aber bei einem Monitor mit 21:9 ist das Icon ausserhalb vom Video =P
@LiveOverflow
@LiveOverflow 6 жыл бұрын
Oh guter Tipp. Vllt mache ich das nicht mehr
@punitdarji1871
@punitdarji1871 6 жыл бұрын
Make a video from where person can start learnexploits like hacking, penetration testing etc
@zedd-x8171
@zedd-x8171 6 жыл бұрын
First one 💪
@tonipejic2645
@tonipejic2645 6 жыл бұрын
why is there a weird whisper at 7:18 lol and i think i've heard one before too but i've ignored it. It kinda sounds like a german word "oder" which means "or" and you've said or afterwards, and I know that you are german so maybe you've said oder instead of or and then edited it but it's still here somehow. Why am I even thinking about this xD
@tonipejic2645
@tonipejic2645 6 жыл бұрын
probably, yeah. I just like to think too much about non important things
@planktonfun1
@planktonfun1 6 жыл бұрын
what is the concept of regex, I can do it, but I can't really explain it very well to anyone
@MrAntiKnowledge
@MrAntiKnowledge 6 жыл бұрын
regex= regular expression. It's a way to filter strings which match a certain pattern. A pretty basic example: "^Hello [a-zA-Z]+\." matches if the String starts(^) with "Hello " followed by a character between a-z or A-Z *once or more*(+) and ends with a fullstop (the "\" removes the special meaning of ".") The program checks the String character by character if it matches the given expression and stops if it hits any character that does not match (String doesnt match pattern) or reaches the end of the expression (String matches pattern) It's basicly just a syntax to tell the program what kind of pattern you are looking for in the String. You can visit regex.com to play around with it and get all the special characters and short explainations what they do.
@planktonfun1
@planktonfun1 6 жыл бұрын
MrAntiKnowledge Great explanation! but I think its not enough for people to understand it clearly and completely, I might try to make a code equivalent for each regex samples, which is a lot of work. :(
@MrAntiKnowledge
@MrAntiKnowledge 6 жыл бұрын
Well it depends on who you want it to explain to and for what reason. Maybe you could try explaining it as kind of a advanced version of a wildcard (*.txt) since that seems to be something even techilliterate people are sometimes familiar with. If you audience is more techliterate you could use finite state automatons to explain it. Or are you more interested in the actual implementation of the "matching".
@planktonfun1
@planktonfun1 6 жыл бұрын
The actual implementation of matching, from quantifiers matching to lookahead captures and recursion capture, I would say the audience and tech literate programmers, they also use linux but not so much for the grep, sed and other stuff with reg expression. The reason is so that not many people interrupt me with regex questions while working. Teach a man a fish and they will eat everyday as they say.
@chasewnutpistachio
@chasewnutpistachio 5 жыл бұрын
who else come here for sink & source in plants?? 🤓
@Yotanido
@Yotanido 6 жыл бұрын
PHP has a regex match function that can execute code... The more I learn about PHP, the less I like it. It's like they are TRYING to make it insecure. I mean, come on. Or if the file passed to the PHP interpreter can't be found, just take the closest one. WTF PHP.
@arsen3783
@arsen3783 6 жыл бұрын
hi
@brian-pf5dk
@brian-pf5dk 6 жыл бұрын
4:55 komma ? that must be a german :P
@karibikals4574
@karibikals4574 3 жыл бұрын
Bruh I came here for plants
@harshakumar8970
@harshakumar8970 6 жыл бұрын
Can't wait for the "first" comments...
@zsdanix
@zsdanix 6 жыл бұрын
Not considered on topic or good, classic stackoverflow. Not letting good questions live :(
@LiveOverflow
@LiveOverflow 6 жыл бұрын
What?
@Zzznmop
@Zzznmop 6 жыл бұрын
taint analysis huh, not sure about this field.
The Curse of Cross-Origin Stylesheets - Web Security Research
19:58
LiveOverflow
Рет қаралды 100 М.
Turning bad React code into senior React code
13:10
Cosden Solutions
Рет қаралды 87 М.
That's how money comes into our family
00:14
Mamasoboliha
Рет қаралды 11 МЛН
3M❤️ #thankyou #shorts
00:16
ウエスP -Mr Uekusa- Wes-P
Рет қаралды 15 МЛН
마시멜로우로 체감되는 요즘 물가
00:20
진영민yeongmin
Рет қаралды 27 МЛН
UML use case diagrams
12:42
Lucid Software
Рет қаралды 294 М.
Generic HTML Sanitizer Bypass Investigation
14:05
LiveOverflow
Рет қаралды 140 М.
Writing Secure JavaScript
24:15
freeCodeCamp.org
Рет қаралды 57 М.
Don't trust time
9:49
LiveOverflow
Рет қаралды 298 М.
HOW FRCKN' HARD IS IT TO UNDERSTAND A URL?! - uXSS CVE-2018-6128
15:47
Cross Site Request Forgery - Computerphile
9:20
Computerphile
Рет қаралды 758 М.
TLS Handshake Explained - Computerphile
16:59
Computerphile
Рет қаралды 550 М.
CUDA Explained - Why Deep Learning uses GPUs
13:33
deeplizard
Рет қаралды 230 М.
That's how money comes into our family
00:14
Mamasoboliha
Рет қаралды 11 МЛН