1) Consider data that is input to a Web form. Such data is often transferred to the server by including it in a URL. Suppose the input is validated on the client. For example, suppose the following order has been checked by the client:http://www.things.com/orders/tinal& custlD- 1 12&num-55&qty-20&price- 10&shipping=5&total-205 This URL is interpreted to mean that the customer with ID number 112 has ordered 20 of item number 55, at a cost of $10 each, which, with $ 5 shipping. gives a total cost of $205,Q . Show three ways in which a client named Mallory can cheat the server.

2) Find and point the buffer overflow in the code below. Illustrate an attack using the stack image we covered in class. Show how the buffer overflow can be eliminated Algorithm 1 Code snippet of a vulnerable function

1. ... 2. char buf [64), in|MAX_SIZE]; 3. int bytes; 4. printf("Enter buffer contents:"); 5. read(0, in, MAX_SIZE-1); 6. printf("Bytes to copy :"); 7. scanf(" %d",&bytes); 8. memcpy(buf, in,bytes);

9. ...

3) What will the following code print? Why? Identify the line where the vulnerability is. Explain the vulnerability. Show how the vulnerability can be eliminated. Algorithm 2 Example vulnerability. 1.void called (int foo){ 2. if (foo = 1) printf("foo"); 3.else printf("bar"); 4.} 5.int main (){ 6. called(2); 7. return O;}