WebApp Sec mailing list archives
Re: Protecting posted variables
From: "Brian Rectanus" <brectanu () gmail com>
Date: Fri, 21 Jul 2006 22:27:22 -0400
On 21 Jul 2006 05:31:01 -0000, billy.sailing () gmail com <billy.sailing () gmail com> wrote:
Outside of encrypting in SSL, how can variables being posted from the browser back to the server be protected from prying eyes?
Hello, As stated by many others, there is not much you can do about user entered data fields. However, if you want to do something about securing and/or tamper-proofing hidden form fields and various forms of session and state sent to the client, then check out isecauditors.com and their paper (Advanced Web Application Defense with ModSecurity) on adding crypto and signing features to mod_security for apache httpd. This looks to be a promising new addition to mod_security... http://www.isecauditors.com/eng/des-presentaciones.html later, -B ------------------------------------------------------------------------- Sponsored by: WatchfireAppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Protecting posted variables billy . sailing (Jul 20)
- Re: Protecting posted variables Serg B. (Jul 21)
- RE: Protecting posted variables Andrew Chong (Jul 21)
- Re: Protecting posted variables mikeiscool (Jul 21)
- Re: Protecting posted variables Rogan Dawes (Jul 21)
- RE: Protecting posted variables Debasis Mohanty (Jul 21)
- Re: Protecting posted variables Meder Kydyraliev (Jul 21)
- Re: Protecting posted variables Brian Rectanus (Jul 21)
- <Possible follow-ups>
- RE: Protecting posted variables Damhuis Anton (Jul 21)