Hunting Security Bugs

Chapter 7. Information Disclosure

In this chapter:
Problems with Information Disclosure
Locating Common Areas of Information Disclosure
Identifying Interesting Data
Summary

Information disclosure is one of the most abundant threats to an application and often the most overlooked. In short, information disclosure bugs involve giving too much information to individuals who are not supposed to be able to obtain that information. Some bugs are as obvious as an attacker gaining access to user credentials stored in clear text where the attacker can read them. However, some bugs are not as obvious, such as when extra data can be read only by viewing the file in a binary editor.

Problems with Information Disclosure

Although threat models and data flow diagrams ...