WebApp Sec mailing list archives
Re: Hardcoded Database IP in ASP
From: "Darryl Stevens" <darryl_stevens () hotmail com>
Date: Fri, 15 Sep 2006 13:45:10 -0400
Thank you all... I 'll take your ideas and links and come up with something. I appreciate the time
From: RSnake <rsnake () shocking com> To: Darryl Stevens <darryl_stevens () hotmail com> CC: webappsec () securityfocus com, pen-test () securityfocus com Subject: Re: Hardcoded Database IP in ASP Date: Fri, 15 Sep 2006 08:24:34 -0700 (PDT) MIME-Version: 1.0Received: from fingers.shocking.com ([209.76.72.12]) by bay0-mc4-f6.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2444); Fri, 15 Sep 2006 08:22:36 -0700 Received: from fingers.shocking.com (rsnake () fingers shocking com [209.76.72.12])by fingers.shocking.com (8.13.4/8.13.6/Debian-1) with ESMTP id k8FFOYtf023229(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);Fri, 15 Sep 2006 08:24:35 -0700
X-Message-Info: LsUYwwHHNt3660MmjhEvYg2f34OAemlKtU9j2Z7TuGo= References: <BAY117-F11BF9097A6403868C3DB5FEC290 () phx gbl>X-Proofpoint-Virus-Version: vendor=fsecure engine=4.65.5431:2.3.11,1.2.37,4.0.164 definitions=2006-09-15_04:2006-09-15,2006-09-14,2006-09-15 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlx=0 adultscore=0 adjust=0 reason=mlx engine=3.1.0-0609080000 definitions=main-0609150002
Return-Path: rsnake () shocking comX-OriginalArrivalTime: 15 Sep 2006 15:22:36.0532 (UTC) FILETIME=[C6237340:01C6D8DA]
Hi, Darryl, this is really more of a network security question than an application security question, but let me take a stab at it. It is possible, although very unlikely that they can spoof an IP packet to run some command on the server. They would be doing so blind though as they wouldn't see the responses. There is a fairly good article here: http://www.cosc.brocku.ca/~cspress/HelloWorld/1999/03-mar/spoofing.html This really isn't super practical on a lot of modern systems because they do a better job of reducing the predictability of the ISN to create the fake three way connection. Also, if the server is under any sort of load it makes it more difficult. Also, the attacker would have to know exactly what to craft to make that happen (so unless it's open source, that simple fact alone will make exploitation much more difficult). So yes, theoretically it's a bad idea, in practice it's pretty difficult to exploit from a black box perspective. Beware people on your local LAN though, they'll have a much easier time exploiting than an outsider would as they have visibility into packets in both directions if they are sniffing the network. -RSnake http://ha.ckers.org/ http://sla.ckers.org/
Hello fellow Security Guru's.I've been on the distro from sometime and gaining a lot of insight into various security issues.Question: I have ASP script that points to a backend database residing on seperate physical server. Is there any known way of getting around using a hard-coded IP address to point to the database? Would utilizing the OS hosts file serve my purposes of and satisfy secure code practices? Thanks guys.Darryl
------------------------------------------------------------------------- Sponsored by: WatchfireCross-Site Scripting (XSS) is one of the most common application-level attacks that hackers use to sneak into web applications today. This whitepaper will discuss how traditional CSS attacks are performed, how to secure your site against these attacks and check if your site is protected. Cross-Site Scripting Explained - Download this whitepaper today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr --------------------------------------------------------------------------
Current thread:
- Hardcoded Database IP in ASP Darryl Stevens (Sep 14)
- RE: Hardcoded Database IP in ASP Ken Schaefer (Sep 19)
- Re: Hardcoded Database IP in ASP RSnake (Sep 19)
- Re: Hardcoded Database IP in ASP Darryl Stevens (Sep 19)
- Re: Hardcoded Database IP in ASP security (Sep 19)
- Re: Hardcoded Database IP in ASP PCSC Information Services (Sep 22)
- <Possible follow-ups>
- RE: Hardcoded Database IP in ASP Darryl Stevens (Sep 19)