OWASP / OWASP/TCASVS

Should DLL Hijacking be a single item?

Open
#7 2 comments 0 reactions 1 assignee View on GitHub

@JeffreyShran is already working on this.

Since Sep 6, 2024.

enhancement help wanted
Dominant language
TeX
Stars
30
Forks
5
PR merge metrics
No merged PRs in 30d

Description

as suggested in #6 by @matreurai

Note : I've seen in TASVS-STORAGE a category specific to a specific vulnerability (DLL Hijacking). I think this should be modified as the testing standard is not made for specific vulnerabilities in my opinion. Additionally, these items are explaining a type of attack and do not provide any guidance to what to test or how to prevent/mitigate risks of such attacks. The equivalent in the Web Application Security Verification Standard would be to add an item as such:
"Cross-Site Scripting Category - Blind cross-site scripting (XSS) is a variant of stored XSS where the malicious payload is executed in a different context or application than where it was originally injected.".
I don't think this make sense in the context of a Verification Standard.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.