Re: Protecting posted variables

[Rogan Dawes <discard () dawes za net>]

billy.sailing () gmail com wrote:
> Hey all,
>
> A 'fixing the problem question'...
>
> Outside of encrypting in SSL, how can variables being posted from the
> browser back to the server be protected from prying eyes?
>
> During previous pentests, I've seen variables being posted to a
> webserver (IIS6.0 is  one I remember this with) all hashed together.
> I don't think that any special client-side software was used, it was
> a function of the site....
>
> Can anyone help in identifying what it was that I saw in operation? -
> The only solution I can see is that it was the AspKeepSessionIDSecure
> Metabase Property
>
> (ref:http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0d49cbc8-10e1-4fa8-ba61-c34e524a3ae6.mspx?mfr=true)
>
>
> with the variables posted in with the sessionid?
>
> Also, is this type of solution available in any other webserver?
>
> Any help gratefully recieved...
>
> Thanks..

The only way that you'd get this effect is with some kind of client 
software. That software could be JavaScript (e.g. implementations of 
MD5, or RSA, etc are available with a little searching), or a Java 
applet, or ActiveX control.

But other than these mechanisms, there is no standard way of 
encrypting/manipulating the form values before they are sent, that I 
know of.

Regards,

Rogan

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------