RE: Hardcoded Database IP in ASP

["Ken Schaefer" <Ken () adOpenStatic com>]

: -----Original Message-----
: From: listbounce () securityfocus com
: [mailto:listbounce () securityfocus com] On Behalf Of Darryl Stevens
: Subject: Hardcoded Database IP in ASP
: 
: Question: I have ASP script that points to a backend database residing
: on separate physical server. Is there any known way of getting around
: using a hard-coded IP address to point to the database? Would 
: utilizing the OS hosts file serve my purposes of and satisfy 
: secure code practices? Thanks guys.
: 
: Darryl

What threats, exactly, are you trying to secure against here?

You are changing from having the DB server's IP address directly in your code
to using a hostname in your code, and storing the corresponding IP address in
the hosts file. Are you afraid someone might get hold of the IP address? If
they did get this IP address, what would they do with it? And would storing
it in a hosts file help? A malicious attacker could simply connect using the
hostname, and Windows will resolve it to the IP address via a hosts file
lookup...

Cheers
Ken

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level
attacks that hackers use to sneak into web applications today. This
whitepaper will discuss how traditional CSS attacks are performed, how to
secure your site against these attacks and check if your site is protected.
Cross-Site Scripting Explained - Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------