Well it is really a client-side solution, rather than server-side,
because in order for you to encrypt user-supplied data there has to be
Javascript/ActiveX/Applet that would encrypt parameters before posting.
I've seen many developers implementing that to "prevent tampering with
parameters", which was easily bypassed by either modifying parameters in
the HTTP response that preceeds request (e.g. changing hidden parameter
value), or by injecting Javascript that would change any parameter through
DOM, at any time.
Why not use SSL anyway?
Meder
On Fri, Jul 21, 2006 at 05:31:01AM -0000, billy.sailing@gmail.com wrote:
Hey all,
A 'fixing the problem question'...
Outside of encrypting in SSL, how can variables being posted from the browser
back to the server be protected from prying eyes?
During previous pentests, I've seen variables being posted to a webserver
(IIS6.0 is one I remember this with) all hashed together. I don't think that
any special client-side software was used, it was a function of the site....
Can anyone help in identifying what it was that I saw in operation? - The
only solution I can see is that it was the AspKeepSessionIDSecure Metabase
Property
(ref:http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61-c34e524a3ae6.mspx?mfr=true)
with the variables posted in with the sessionid?
Also, is this type of solution available in any other webserver?
Any help gratefully recieved...
Thanks..
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
--
http://o0o.nu/~meder
-------------------------------------------------------------------------
Sponsored by: Watchfire
AppScan 6.5 is now available! New features for Web Services Testing,
Advanced Automated Capabilities for Penetration Testers, PCI Compliance
Reporting, Token Analysis, Authentication testing, Automated JavaScript
execution and much more.
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------
