Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Web-App-Sec
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: Dropping connection instead of returning 400

from [Michel Arboi] Network Security [Permanent Link]
Subject: Re: Dropping connection instead of returning 400
Date: Fri, 4 Mar 2005 12:39:41 +0100 
On Tue, 1 Mar 2005 20:59:37 -0800 (PST), christopher@baus.net
<christopher@baus.net> wrote:

One thing that keeps coming back to me is 400 Bad Request handling.  It is
now my opinion that security proxies should just drop connection when
faced with traffic they refuse to handle.


I cannot see any case where dropping the connection actually enhance
security. You'd better send back a 400 (bad request) or 403
(forbidden)  -- or even, in some specific cases 405 (method not
allowed), 406 (content not allowed).


http://www.baus.net/400-bad-request


I guess that some software might retry the request if the connection
is dropped. This is a waste of ressources.
You can send back a 400 with few information in the message.

By the way, I know that some software drop the connection in front of
a badly broken request. In fact, this helps fingerprinting (with
HMAP).
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: eBanking Security Testing (network and application) Methodology Released, cbc
Next by Date:  Re: Preventing direct URL access in a J2EE environment, Kevin Conaway
Previous by Thread:  Re: Dropping connection instead of returning 400, Mariusz Pękala
Next by Thread:  RE: Dropping connection instead of returning 400, Michael Silk
Indexes:  [Date] [Thread] [Top] [All Lists]