WebApp Sec mailing list archives
RE: Protecting posted variables
From: "Andrew Chong" <andrewjw () singnet com sg>
Date: Fri, 21 Jul 2006 14:00:54 +0800
The industry best practice is to use SSL to encrypt the transport layer. No rocket science and no further applications codings. Another custom encryption will add-on to another keys management issue. Regards, Andrew Chong (Singapore), cissp -----Original Message----- From: billy.sailing () gmail com [mailto:billy.sailing () gmail com] Sent: Friday, July 21, 2006 1:31 PM To: webappsec () securityfocus com Subject: Protecting posted variables Hey all, A 'fixing the problem question'... Outside of encrypting in SSL, how can variables being posted from the browser back to the server be protected from prying eyes? During previous pentests, I've seen variables being posted to a webserver (IIS6.0 is one I remember this with) all hashed together. I don't think that any special client-side software was used, it was a function of the site.... Can anyone help in identifying what it was that I saw in operation? - The only solution I can see is that it was the AspKeepSessionIDSecure Metabase Property (ref:http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Libr ary/IIS/0d49cbc8-10e1-4fa8-ba61-c34e524a3ae6.mspx?mfr=true) with the variables posted in with the sessionid? Also, is this type of solution available in any other webserver? Any help gratefully recieved... Thanks.. ------------------------------------------------------------------------ - Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc ------------------------------------------------------------------------ - -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.3/394 - Release Date: 7/20/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.10.3/394 - Release Date: 7/20/2006 ------------------------------------------------------------------------- Sponsored by: Watchfire AppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today! https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Protecting posted variables billy . sailing (Jul 20)
- Re: Protecting posted variables Serg B. (Jul 21)
- RE: Protecting posted variables Andrew Chong (Jul 21)
- Re: Protecting posted variables mikeiscool (Jul 21)
- Re: Protecting posted variables Rogan Dawes (Jul 21)
- RE: Protecting posted variables Debasis Mohanty (Jul 21)
- Re: Protecting posted variables Meder Kydyraliev (Jul 21)
- Re: Protecting posted variables Brian Rectanus (Jul 21)
- <Possible follow-ups>
- RE: Protecting posted variables Damhuis Anton (Jul 21)