Thank you all... I 'll take your ideas and links and come up with something.
I appreciate the time
From: RSnake <rsnake@shocking.com>
To: Darryl Stevens <darryl_stevens@hotmail.com>
CC: webappsec@securityfocus.com, pen-test@securityfocus.com
Subject: Re: Hardcoded Database IP in ASP
Date: Fri, 15 Sep 2006 08:24:34 -0700 (PDT)
MIME-Version: 1.0
Received: from fingers.shocking.com ([209.76.72.12]) by
bay0-mc4-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Fri, 15
Sep 2006 08:22:36 -0700
Received: from fingers.shocking.com (rsnake@fingers.shocking.com
[209.76.72.12])by fingers.shocking.com (8.13.4/8.13.6/Debian-1) with ESMTP
id k8FFOYtf023229(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256
verify=NOT);Fri, 15 Sep 2006 08:24:35 -0700
X-Message-Info: LsUYwwHHNt3660MmjhEvYg2f34OAemlKtU9j2Z7TuGo=
References: <BAY117-F11BF9097A6403868C3DB5FEC290@phx.gbl>
X-Proofpoint-Virus-Version: vendor=fsecure
engine=4.65.5431:2.3.11,1.2.37,4.0.164
definitions=2006-09-15_04:2006-09-15,2006-09-14,2006-09-15 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlx=0
adultscore=0 adjust=0 reason=mlx engine=3.1.0-0609080000
definitions=main-0609150002
Return-Path: rsnake@shocking.com
X-OriginalArrivalTime: 15 Sep 2006 15:22:36.0532 (UTC)
FILETIME=[C6237340:01C6D8DA]
Hi, Darryl, this is really more of a network security question than an
application security question, but let me take a stab at it. It is
possible, although very unlikely that they can spoof an IP packet to run
some command on the server. They would be doing so blind though as they
wouldn't see the responses. There is a fairly good article here:
http://www.cosc.brocku.ca/~cspress/HelloWorld/1999/03-mar/spoofing.html
This really isn't super practical on a lot of modern systems because
they do a better job of reducing the predictability of the ISN to create
the fake three way connection. Also, if the server is under any sort of
load it makes it more difficult. Also, the attacker would have to know
exactly what to craft to make that happen (so unless it's open source,
that simple fact alone will make exploitation much more difficult).
So yes, theoretically it's a bad idea, in practice it's pretty
difficult to exploit from a black box perspective. Beware people on
your local LAN though, they'll have a much easier time exploiting than
an outsider would as they have visibility into packets in both
directions if they are sniffing the network.
-RSnake
http://ha.ckers.org/
http://sla.ckers.org/
Hello fellow Security Guru's.
I've been on the distro from sometime and gaining a lot of insight into
various security issues.
Question: I have ASP script that points to a backend database residing on
seperate physical server. Is there any known way of getting around using a
hard-coded IP address to point to the database? Would utilizing the OS
hosts file serve my purposes of and satisfy secure code practices? Thanks
guys.
Darryl
-------------------------------------------------------------------------
Sponsored by: Watchfire
Cross-Site Scripting (XSS) is one of the most common application-level
attacks that hackers use to sneak into web applications today. This
whitepaper will discuss how traditional CSS attacks are performed, how to
secure your site against these attacks and check if your site is protected.
Cross-Site Scripting Explained - Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------
