Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's W

from [Eran Tromer] Network Security [Permanent Link]
Subject: Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications"
Date: Wed, 22 Dec 2004 22:30:40 +0200
On 12/22/2004 10:12 PM, Eran Tromer wrote:
On 12/22/2004 07:47 PM, Florian Weimer wrote: 
The HMAC input should also cover a time-dependent value sent along in the
clear (which is later used to check the token for freshness).  A form
identifier could also be helpful.

[snip] 
> The timestamp and (in some cases) the form  identifier needed to be sent
> as extra parameters, which can get rather ugly when using GET requests.

On second thought, what you need is not a form (source) identifier, but rather an action (target) identifier. The action is necessarily deducible from the rest of HTTP request, so there's no good reason not to add it to the hash. Ideally, one would hash in all parts of the target URL and all POST parameters that are known at the time the source page is sent (except the token itself).

  Eran

[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in To day's Web Applications", Florian Weimer
Next by Date:  Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications", Augusto Paes de Barros
Previous by Thread:  Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications", Eran Tromer
Next by Thread:  Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications", Elihu Smails
Indexes:  [Date] [Thread] [Top] [All Lists]