Penetration Testing mailing list archives
Re: C# Exceptions
From: "3 shool" <3shool () gmail com>
Date: Fri, 25 Aug 2006 15:53:43 -0700
Hi Tim & group, My responses below in caps. On 8/25/06, Tim <pand0ra.usa () gmail com> wrote:
I added my responses in-line with yours below. If I am guessing this correctly, the application in question runs on the same server as the web server, correct? If so, it doesn't matter,
SORRY, THE DESKTOP APPLICATION AND WEB SERVICES ARE ON DIFFERENT MACHINES. DESKTOP APPLICATION IS USED BY 30 TO 50 USERS AND THE APPLICATION ACCESSES REMOTE SERVER / WEB SERVICES FOR FINANCIAL TRANSACTIONS OVER HTTPS.
What kind of data are you sending to the web server/application? You
DATA SENT TO WEB SERVICES IS FINANCIAL, OVER HTTPS. THOUGH THE APPLICATION COMMUNICATES CONTINUOUSLY TO THE SQL SERVER FOR OTHER INFORMATION. THIS HAPPENS OVER TCP PORT 1433.
say that DoS might not be an issue, so I assume management has defined
DOS IS NOT A HIGH PRIORITY ISSUE BECAUSE THE CHANCES OR IMPACT OF SUCH A SITUATION ARE LOW. THOUGH THE ACCESS VIOLATION IS CONSIDERED AS HIGH PRIORITY SINCE IT CAN CAUSE MALICIOUS CODE EXECUTION.
Without knowing a lot more about the application I can only provide some guesses here. 1. Spoofing (creating data packets from a non-existence source) traffic is probably not necessary, unless you do not want to be detected by an IDS. 2. If your Internet gateway is compromised... you have bigger things to worry about. Spoofing is not going to be a significant issue in this situation.
AS THE APPLICATION CREATES REQUESTS RATHER THEN WAITING FOR REQUESTS, THE SPOOFING WILL HAVE TO BE DONE ON THE REPLIES AND IT HAS TO BE DONE ON AN ALREADY ESTABLISHED CONNECTION ELSE TCP/IP WILL REJECT PACKETS.
Here, I would worry about the front end (web server) and how it validates input going to the application. If it is a database, there is a chance that you can get the application to spit out usernames/passwords/private information/account numbers/etc if the web server is not filtering data. If the application is susceptible to a buffer overflow, then that is another big worry.
WEB SERVICES ARE WELL TESTED, THOUGH WE NEED TO TEST SQL/CODE INJECTIONS FROM THE DESKTOP APPLICATION. ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Message not available
- Message not available
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Patrick (Aug 26)
- Re: C# Exceptions 3 shool (Aug 27)
- RE: C# Exceptions Patrick (Aug 27)
- Re: C# Exceptions 3 shool (Aug 27)
- <Possible follow-ups>
- RE: C# Exceptions Krpata, Tyler (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- Re: C# Exceptions 3 shool (Aug 25)
- RE: C# Exceptions Steven Scheffler (Aug 28)
- RE: C# Exceptions Patrick (Aug 28)
- Re: C# Exceptions 3 shool (Aug 28)