Re: Protecting posted variables

["Serg B." <sergicles () gmail com>]

Hi,

The way HTTP works I really don't think that it is possible to
"secure" POST or GET  (or any other browser/forms originating) data
between a browser and a server unless SSL is being utilised.

Any other information, such as obfuscated or client side encryption
(like you mentioned? All hashed together and what not...) can be
decoded/disassembled since they are on the client machine.

I suppose you could send a public key via an AJAX call out into remote
site and JS would apply that to encrypt the data (perhaps custom
crypto) and send it back. But can you imagine implementing deploying
key based cryptographic algorithms in JS? Outch!

I think SSL is pretty much the only way here.

  Serg

On 21 Jul 2006 05:31:01 -0000, billy.sailing () gmail com
<billy.sailing () gmail com> wrote:
> Hey all,
>
>
> A 'fixing the problem question'...
>
>
> Outside of encrypting in SSL, how can variables being posted from the browser back to the server be protected from 
> prying eyes?
>
>
> During previous pentests, I've seen variables being posted to a webserver (IIS6.0 is  one I remember this with) all hashed 
> together. I don't think that any special client-side software was used, it was a function of the site....
>
>
> Can anyone help in identifying what it was that I saw in operation? - The only solution I can see is that it was the 
> AspKeepSessionIDSecure Metabase Property
>
>
> (ref:http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61-c34e524a3ae6.mspx?mfr=true)
>
>
> with the variables posted in with the sessionid?
>
>
> Also, is this type of solution available in any other webserver?
>
>
> Any help gratefully recieved...
>
>
> Thanks..
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
>
> AppScan 6.5 is now available! New features for Web Services Testing,
> Advanced Automated Capabilities for Penetration Testers, PCI Compliance
> Reporting, Token Analysis, Authentication testing, Automated JavaScript
> execution and much more.
> Download a Free Trial of AppScan today!
>
> https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
> -------------------------------------------------------------------------

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------