DllHijackAuditor – Free Audit Tool For DLL Hijack Vulnerability

DllHijackAuditor is the smart tool to Audit against the Dll Hijacking Vulnerability in any Windows application. This is recently discovered critical security issue affecting almost all Windows systems on the planet. It appears that large amount of Windows applications are currently susceptible to this vulnerability which can allow any attacker to completely take over the system.

DllHijackAuditor helps in discovering all such Vulnerable Dlls in a Windows application which otherwise can lead to successful exploitation resulting in total compromise of the system. With its simple GUI interface, DllHijackAuditor makes it easy for anyone to instantly perform the auditing operation. It also presents detailed technical Audit report which can help the developer in fixing all vulnerable points in the application.

New version v2 brings out following features,

• New & Smart Debugger based ‘Interception Engine’ for consistent and efficient performance.
• Support for specifying as well as auditing of application with custom & multiple Extensions.
• Timeout Configuration to alter the waiting time for each Application.

DllHijackAuditor is a standalone portable application which support from Windows XP to Windows 7.

Reference:

• more info & download

Exploiting DLL Hijacking Flaws

In the month of August/September time frame, there has been a lot of attacks on DLL Hijacking. More than 200 Windows applications are having this flaw and vulnerable to this attack.

DLL Hijacking is a vulnerability that triggered when a vulnerable file type is opened from within a directory controlled by the attacker.


HD Moore (Metasploit) explains the problem and adds a *scanner* into the metasploit framework. Please read his blog entry here (tool for scanning the local machine)

• http://blog.metasploit.com/2010/08/better-faster-stronger.html
• http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html

JSON Hijacking

I've been introduced to this JSON Hijacking topic recently. It is a very nice write-up.

Basically this vulnerability requires that you are exposing a JSON service which…

• Returns sensitive data with a JSON array.
• Responds to GET requests.
• Has JavaScript enabled (very likely the case)
• Supports the __defineSetter__ method.

This type of attack seems similar as a variant of a Cross Site Request Forgery (CSRF) attack.