Back to overview

Cornucopia 2

This card is framework/language-specific. Examples include:

Beware of un-trusted data. Check buffer sizes. Do not rely on garbage collection. Use non-executable stacks when available. Avoid the use of known vulnerable functions. Properly free allocated memory. Use checksums or hashes to verify the integrity of interpreted code, libraries, executables, and configuration files. Utilize locking to prevent multiple simultaneous requests. Use a synchronization mechanism to prevent race conditions. Protect shared variables and resources from inappropriate concurrent access. Explicitly initialize all your variables and other data store. In cases where the application must run with elevated privileges, raise privileges as late as possible, and drop them as soon as possible. Make no assumptions about availability of other resources, and handle exceptions.

How to play?

Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur


Owasp ASVS (4.0): 14.1.2

Capec: 25 ,26 ,29 ,96 ,123 ,124 ,128 ,129 ,264 ,265

Owasp SCP: 194,195,196,197,198,199,200,201,202,205,206,207,208,209

Owasp Appsensor:

Safecode: 3,5,6,7,9,22,25,26,34

ASVS (4.0) Cheatsheetseries Index

ASVS V14.1 - Build


Command Injection

Buffer Overflow

Loading comments 0%

Github logo View source on GitHub

Provided by dotNET lab

This website is created, hosted and provided by dotNET lab. dotNET lab provides training and guidance on secure software development. Contact us to get in touch!

OWASP Cornucopia

OWASP Cornucopia is originally created by Colin Watson. It is open source and can be downloaded free of charge from the OWASP website. It is is free to use. It is licensed under the Creative Commons Attribution-ShareAlike 3.0 license, so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. OWASP does not endorse or recommend commercial products or services. OWASP Cornucopia is licensed under the Creative Commons Attribution-ShareAlike 3.0 license and is © 2012-2016 OWASP Foundation.