RE: Script Based Attacks & Form Hacks

["WebAppSecurity [Technicalinfo.net]" <webappsec () technicalinfo net>]

Hi Chad,

I think you will find the following paper exhaustive enough to answer your
question:
http://www.ngssoftware.com/papers/StoppingAutomatedAttackTools.pdf

Cheers,

Gunter


> -----Original Message-----
> From: Chad Maniccia [mailto:wopazar () gmail com] 
> Sent: 21 July 2005 18:31
> To: webappsec () securityfocus com
> Subject: Script Based Attacks & Form Hacks
>
> Hi List,
>
> One thing I have not heard any one discuss is the use of 
> automated scripts and form hacking. I could easily write a 
> Java program to attack any ASP,JSP,PHP etc.. simply by 
> viewing the page source to find the parameters the form 
> processor will be looking for. You could use this to fill up 
> some ones database with garbage bring the server to a 
> standstill or worse yet bypass all the fancy javascript you 
> had on the calling page. Some web applications actually use 
> javascript to calcualte currency transactions.
>
> What ideas do you guys have to protect yourself from these?
>
>
> Thanks,
> Chad