WebApp Sec mailing list archives
Re: Protecting posted variables
From: mikeiscool <michaelslists () gmail com>
Date: Fri, 21 Jul 2006 16:02:44 +1000
Outside of encrypting in SSL, how can variables being posted from the browser back to the server be protected from prying eyes?
encrypt it yourself? but you'll also need to provide a decryption tool for the client side. this can be javascript (google for javascrypt from fourmilab), but really, why not use ssl?
During previous pentests, I've seen variables being posted to a webserver (IIS6.0 is one I remember this with) all hashed together. I don't think that any special client-side software was used, it was a function of the site....
well hashing it won't help at all. you can't reverse a hash. -- mic ------------------------------------------------------------------------- Sponsored by: WatchfireAppScan 6.5 is now available! New features for Web Services Testing, Advanced Automated Capabilities for Penetration Testers, PCI Compliance Reporting, Token Analysis, Authentication testing, Automated JavaScript execution and much more. Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc -------------------------------------------------------------------------
Current thread:
- Protecting posted variables billy . sailing (Jul 20)
- Re: Protecting posted variables Serg B. (Jul 21)
- RE: Protecting posted variables Andrew Chong (Jul 21)
- Re: Protecting posted variables mikeiscool (Jul 21)
- Re: Protecting posted variables Rogan Dawes (Jul 21)
- RE: Protecting posted variables Debasis Mohanty (Jul 21)
- Re: Protecting posted variables Meder Kydyraliev (Jul 21)
- Re: Protecting posted variables Brian Rectanus (Jul 21)
- <Possible follow-ups>
- RE: Protecting posted variables Damhuis Anton (Jul 21)