Re: Protecting posted variables

[mikeiscool <michaelslists () gmail com>]

> Outside of encrypting in SSL, how can variables being posted from the browser back to
> the server be protected from prying eyes?

encrypt it yourself? but you'll also need to provide a decryption tool
for the client side. this can be javascript (google for javascrypt
from fourmilab), but really, why not use ssl?


> During previous pentests, I've seen variables being posted to a webserver (IIS6.0 is  one I
> remember this with) all hashed together. I don't think that any special client-side software
> was used, it was a function of the site....

well hashing it won't help at all. you can't reverse a hash.

-- mic

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!

https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------