Re: Hardcoded Database IP in ASP

[security <security () xentek net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

You can use the computer's netbios/netbuei name, if the web server  
can see the DB server on the LAN. (Try pinging the db machine from  
the server using it's name as the host). This way it can follow the  
machine, regardless of IP.

I would also store this info in your Global.asa file, which should be  
more secure than in the same .asp script that is using the  
connection. Set your values as variables, and they will be available  
to your other scripts.

You could use the HOSTS file, but this is only if you can't:

a) add an entry to your company's DNS server (i.e. )
b) can't use the netbois/netbuei name resolution service for whatever  
reason


But the HOSTS file will be hard to scale, since any server you deploy  
this app to will need it.

- -e


On Sep 14, 2006, at 2:28 PM, Darryl Stevens wrote:

> Hello fellow Security Guru's.
>
> I've been on the distro from sometime and gaining a lot of insight  
> into various security issues.
>
> Question: I have ASP script that points to a backend database  
> residing on seperate physical server. Is there any known way of  
> getting around using a hard-coded IP address to point to the  
> database? Would utilizing the OS hosts file serve my purposes of  
> and satisfy secure code practices? Thanks guys.
>
> Darryl
>
>
>
> ---------------------------------------------------------------------- 
> --
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ---------------------------------------------------------------------- 
> --

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFFCq5Qj8o5VXXdUSwRAhkxAJ41NGCM23rPUMZT5SrKFngWOcsznwCfWVQT
jbGirmtm/O04LrFAapHmzA4=
=6Aos
-----END PGP SIGNATURE-----

-------------------------------------------------------------------------
Sponsored by: Watchfire

Cross-Site Scripting (XSS) is one of the most common application-level 
attacks that hackers use to sneak into web applications today. This 
whitepaper will discuss how traditional CSS attacks are performed, how to 
secure your site against these attacks and check if your site is protected. 
Cross-Site Scripting Explained - Download this whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr
--------------------------------------------------------------------------