Penetration Testing mailing list archives
Re: Hardcoded Database IP in ASP
From: RSnake <rsnake () shocking com>
Date: Fri, 15 Sep 2006 08:24:34 -0700 (PDT)
Hi, Darryl, this is really more of a network security question than an application security question, but let me take a stab at it. It is possible, although very unlikely that they can spoof an IP packet to run some command on the server. They would be doing so blind though as they wouldn't see the responses. There is a fairly good article here: http://www.cosc.brocku.ca/~cspress/HelloWorld/1999/03-mar/spoofing.html This really isn't super practical on a lot of modern systems because they do a better job of reducing the predictability of the ISN to create the fake three way connection. Also, if the server is under any sort of load it makes it more difficult. Also, the attacker would have to know exactly what to craft to make that happen (so unless it's open source, that simple fact alone will make exploitation much more difficult). So yes, theoretically it's a bad idea, in practice it's pretty difficult to exploit from a black box perspective. Beware people on your local LAN though, they'll have a much easier time exploiting than an outsider would as they have visibility into packets in both directions if they are sniffing the network. -RSnake http://ha.ckers.org/ http://sla.ckers.org/
Hello fellow Security Guru's.I've been on the distro from sometime and gaining a lot of insight into various security issues.Question: I have ASP script that points to a backend database residing on seperate physical server. Is there any known way of getting around using a hard-coded IP address to point to the database? Would utilizing the OS hosts file serve my purposes of and satisfy secure code practices? Thanks guys.Darryl
------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php ------------------------------------------------------------------------
Current thread:
- Hardcoded Database IP in ASP Darryl Stevens (Sep 14)
- Re: Hardcoded Database IP in ASP RSnake (Sep 15)
- RE: Hardcoded Database IP in ASP Ken Schaefer (Sep 18)
- <Possible follow-ups>
- RE: Hardcoded Database IP in ASP William Woodhams (Sep 15)
- RE: Hardcoded Database IP in ASP Darryl Stevens (Sep 15)