Wednesday, August 25, 2010

Polyglot Programming and Web Security

Polyglot Programming and Web Security

Polyglot is a computer program written in a valid form of multiple
programming languages.
For example, print"Hello",0?"Ruby":"Perl","
!\n" is a Perl/Ruby polyglot program
which returns different result each languages using difference of
handling boolean value.

Applying these techniques makes five language polyglot program like as
following:
----------------------------------------------
#include/*
q="""*/
int main() {putchar('C'); if(sizeof('C')-1);
else {putchar('+'); putchar('+');}} /*=;
print'Perl'#";print'Ruby'#""";print'Python'#*/
----------------------------------------------
$ perl a.cpp
Perl
$ ruby a.cpp
Ruby
$ python a.cpp
Python
$ gcc -xc a.cpp && ./a.out
C
$ cl.exe a.cpp
$ a.exe
C++

And applying more growth of these techniques makes obfuscated program
with just only symbols
for Perl / Ruby / JavaScript and so on like as:
http://developer.cybozu.co.jp/takesako/2009/07/polyglotrejectk.html

Moreover I'll show the Perl / Ruby / PHP / JavaScript program embedded
in GIF / JPEG images.
And we can make a x86 executable code in ascii string which includes
just only symbols.

all your base32 are belong to us
http://conferences.yapcasia.org/ya2009/talk/2226

Reference:
http://osdc.tw/2010/02/schedule_polyglot_programming.html

No comments: