/Users/andrea/_magisterarbeit/korpus/clean/testkorpus/27/file21.html NN ----------------------------------------- : Sponsored VVN advertisement NN . SENT OWASP NP does VVZ not RB endorse VV commercial JJ products NNS or CC services NNS . SENT OWASP NP Home NP News NP Archives NPS News NP Archive NP December NP 13 CD News NP Archive NP January NP 28 CD News NP Archive NP April NP 27 CD 2005 CD News NP Archive NP Sept NP 2 CD 2005 CD Columns NNS Mark NP Curphey NP SSL NP issues NNS Documentation NN Framework NN Jeff NP Williams NP Trustworthy JJ Java NP Stinger NP Access NP Control NP Contracts NPS George NP Capehart NP More RBR than IN WS NP Security NP Tale NP of IN Two CD Systems NP Web NP Services NPS Architecture NP Joe NP Lima NP IIS NP Security NP IIS NP Authentication NN Jeremy NP Poteet NP . SENT NET JJ security NN Input NN validation NN Ido NP Rosen NP Encrypted VVD Sessions NP Mark NP Burnett NP Using VVG Secret JJ Questions NNS Blocking VVG Brute JJ Force NP Attacks NNS General NP Documentation NN Guide NP Guide NP Getting VVG Involved VVN Milestones NNS Downloads NP Guide NP News NP Top NP Ten CD Commentary NN Introduction NN Background NN Updates NNS A DT 1 CD Unvalidated JJ Input NN A DT 2 CD Broken NP Access NP Control NP A DT 3 CD Broken JJ Authentication NN A DT 4 CD Cross NP Site NN Scripting VVG A DT 5 CD Buffer NN Overflows VVZ A DT 6 CD Injection NN Flaws NNS A DT 7 CD Improper JJ Error NN Handling VVG A DT 8 CD Insecure JJ Storage NN A DT 9 CD Application NN Denial NN of IN Service NP A DT 10 CD Insecure JJ Configuration NN Management NP Conclusion NN Metrics NP Testing NP Commentary NN Web NP Application NN Penetration NN Checklist NN Release NP Schedule NN AppSec NP FAQ NP Legal NP Software NP . SENT Net JJ oLabs NNS CodeSpy NP WebSphinx NP C NP Spider NN PHP NP Filters VVZ WebGoat NP WebGoat NP Screenshots NP WebScarab NP Frequently RB asked VVD questions NNS Standards NP ISO NP 17799 CD AppSec NP Conferences NNS AppSec NP NYC NP 2004 CD AppSec NP Europe NP 2005 CD Accommodations NNS Agenda NP Conference NP Dinner NN AppSec NP DC NP 2005 CD Accommodations NNS Sponsors VVZ Training NP Course NP Conference NP Schedule NN Local JJ Chapters NNS Chapter NN Guidelines NNS Chapter NP Resources NPS About IN Contact NP Contributions NNS Advertising NN How WRB OWASP NP Works NP Licenses VVZ Contributor NN Licensing NN Agreement NP Membership NP Privacy NN Registration NN Papers NP International NP Espa NP ol JJ Documentaci NP n NN AppSec NP FAQ NP Testing NP Lista NP de NP Verificacion NP para NN Intrusion NN en IN Aplicaciones NP Web NP de NP OWASP NP Italian NP Chinese NP Greek NP Quick NP Links NP Guide NP Top NP Ten CD Metrics NP Testing NP AppSec NP FAQ NP Legal NP . SENT Net JJ oLabs NNS WebGoat NP WebScarab NP Validation NN Stinger NP ISO NP 17799 CD AppSec NP DC NP 2005 CD Netherlands NP Membership NP Privacy NN Registration NN Corporate NP Members NP Main NP Documentation NN AppSec NP FAQ NP Introduction NN What WP is VBZ this DT FAQ NP about RB . SENT This DT FAQ NP answers VVZ some DT of IN the DT questions NNS that IN developers NNS have VHP about IN Web NP Application NN Security NP . SENT This DT FAQ NP is VBZ not RB specific JJ to TO a DT particular JJ platform NN or CC language NN . SENT It PP addresses VVZ the DT common JJ threats NNS to TO web NN applications NNS and CC are VBP applicable JJ to TO any DT platform NN . SENT New NP . SENT The DT Spanish JJ language NN verison NN of IN the DT FAQ NP is VBZ now RB available JJ in IN Word NP and CC PDF NP formats NNS . SENT Many JJ thanks NNS to TO Juan NP Carlos NP and CC Alberto NP Pena NP for IN their PP$ fantastic JJ Spanish JJ translation NN work NN . SENT What WP are VBP these DT common JJ threats NNS to TO Web NP Applications NP . SENT While IN developing VVG an DT application NN , , most JJS of IN us PP are VBP focused VVN on IN the DT functionality NN rather RB than IN security NN . SENT Attackers NNS take VVP advantage NN of IN this DT by IN exploiting VVG the DT application NN in IN a DT number NN of IN ways NNS . SENT Some DT of IN the DT common JJ threats NNS to TO web NN applications NNS are VBP SQL NP Injection NN , , Cross NP Site NN Scripting VVG , , Variable JJ Manipulation NN and CC exploitation NN of IN important JJ features NNS like IN Forgot VVN Password NN . SENT There EX are VBP separate JJ sections NNS in IN this DT FAQ NP answering VVG the DT common JJ questions NNS on IN these DT threats NNS . SENT Who WP developed VVD this DT FAQ NP . SENT This DT FAQ NP is VBZ an DT evolving VVG document NN with IN contributions NNS from IN the DT security NN community NN . SENT Sangita NP Pakala NP and CC her PP$ team NN from IN Paladion NP Networks NPS developed VVD the DT first JJ version NN of IN the DT FAQ NP and CC maintain VV this DT page NN . SENT How WRB can MD I PP contribute VV to TO this DT FAQ NP . SENT We PP need VVP your PP$ feedback NN and CC contributions NNS to TO improve VV the DT FAQ NP . SENT We'd JJ love NN to TO hear VV from IN you PP about RB . SENT New JJ questions NNS to TO add VV to TO the DT FAQ NP Better JJR answers NNS for IN current JJ questions NNS New NP links NNS to TO documents NNS tools NNS Suggestions NNS to TO improve VV the DT FAQ NP You PP could MD mail VV your PP$ contributions NNS to TO appsecfaq JJ owasp NN . SENT org NP Login NP Issues NNS What WP are VBP the DT best JJS practices NNS I PP should MD remember VV while IN designing VVG the DT login NN pages NNS . SENT From IN the DT login NN page NN , , the DT user NN should MD be VB sent VVN to TO a DT page NN for IN authentication NN . SENT Once RB authenticated VVN , , the DT user NN should MD be VB sent VVN to TO the DT next JJ page NN . SENT This DT is VBZ explained VVN in IN the DT answer NN to TO the DT next JJ question NN . SENT The DT password NN should MD never RB be VB sent VVN in IN clear JJ text NN unencrypted VVN because IN it PP can MD be VB stolen VVN by IN sniffing VVG . SENT saving VVG the DT password NN in IN clear JJ text NN in IN the DT database NN is VBZ dangerous JJ too RB . SENT The DT best JJS method NN of IN encrypting VVG and CC sending VVG passwords NNS is VBZ the DT Salted JJ MD NP 5 CD encryption NN technique NN . SENT The DT best JJS way NN to TO manage VV sessions NNS would MD be VB to TO use VV one CD session NN token JJ with IN two CD values NNS during IN authentication NN . SENT One CD value NN before IN authentication NN and CC one CD after RB . SENT Is VBZ it PP really RB required VVD to TO redirect VV the DT user NN to TO a DT new JJ page NN after IN login NN . SENT Is VBZ it PP really RB required VVD to TO redirect VV the DT user NN to TO a DT new JJ page NN after IN login NN . SENT Yes UH . SENT Consider VV the DT application NN has VHZ a DT login NN page NN that WDT sends VVZ the DT username NN and CC password NN as IN a DT POST NN request NN to TO the DT server NN . SENT If IN a DT user NN clicks VVZ refresh VV on IN the DT second JJ page NN the DT page NN after IN login NN , , the DT same JJ request NN including VVG the DT username NN and CC password NN in IN the DT POST NN will MD be VB sent VVN again RB . SENT Now RB suppose VVP a DT valid JJ user NN browses NNS through IN our PP$ application NN and CC logs VVZ out RP , , but CC does VVZ not RB close VV the DT window NN . SENT The DT attackers NNS come VVP along IN and CC click NN the DT back JJ button NN of IN the DT browser NN till IN they PP reach VVP the DT second JJ page NN . SENT They PP only RB have VHP to TO do VV a DT refresh VV and CC since IN the DT username NN and CC password NN are VBP resubmitted VVN and CC revalidated VVN , , the DT attackers NNS can MD login NN as IN the DT user NN . SENT Now RB let's NNS assume VVP the DT application NN has VHZ a DT login NN page NN which WDT takes VVZ the DT user NN to TO an DT intermediate JJ page NN for IN authentication NN . SENT Once RB authenticated VVN , , the DT user NN is VBZ redirected VVN to TO the DT second JJ page NN with IN a DT session NN token JJ . SENT In IN this DT case NN , , even RB if IN the DT attackers NNS reach VVP the DT second JJ page NN and CC do VV a DT refresh VV , , the DT username NN and CC password NN will MD not RB be VB resubmitted VVN . SENT This DT is VBZ so RB because IN the DT request NN that WDT will MD be VB submitted VVN is VBZ the DT one NN for IN the DT second JJ page NN which WDT does VVZ not RB contain VV the DT username NN and CC password NN . SENT Therefore RB , , it PP is VBZ always RB better JJR to TO redirect VV the DT user NN . SENT How WRB does VVZ the DT salted VVD MD NP 5 CD technique NN work NN . SENT Here RB is VBZ how WRB the DT salted VVD MD NP 5 CD technique NN works NNS . SENT the DT database NN stores VVZ a DT MD NP 5 CD hash NN of IN the DT password NN . SENT MD NP 5 CD hash NN is VBZ a DT cryptographic JJ technique NN in IN which WDT the DT actual JJ value NN can MD never RB be VB recovered VVN . SENT When WRB a DT client NN requests NNS for IN the DT login NN page NN , , the DT server NN generates VVZ a DT random JJ number NN , , the DT salt NN , , and CC sends VVZ it PP to TO the DT client NN along IN with IN the DT page NN . SENT A DT JavaScript JJ code NN on IN the DT client NN computes VVZ the DT MD NP 5 CD hash NN of IN the DT password NN entered VVN by IN the DT user NN . SENT It PP then RB concatenates VVZ the DT salt NN to TO the DT hash NN and CC re NN computes VVZ the DT MD NP 5 CD hash NN . SENT This DT result NN is VBZ then RB sent VVN to TO the DT server NN . SENT The DT server NN picks VVZ the DT hash NN of IN the DT password NN from IN its PP$ database NN , , concatenates VVZ the DT salt NN and CC computes VVZ the DT MD NP 5 CD hash NN . SENT If IN the DT user NN entered VVD the DT correct JJ password NN these DT two CD hashes NNS should MD match VV . SENT The DT server NN compares VVZ the DT two CD and CC if IN they PP match VVP , , the DT user NN is VBZ authenticated VVN . SENT How WRB can MD my PP$ Forgot VVN Password NN feature NN be VB exploited VVN . SENT The DT Forgot VVN Password NN feature NN is VBZ implemented VVN in IN a DT number NN of IN different JJ ways NNS . SENT One CD common JJ way NN is VBZ to TO ask VV the DT user NN a DT hint NN question NN for IN which WDT the DT user NN has VHZ submitted VVN the DT answer NN during IN registration NN . SENT These DT are VBP questions NNS like IN What WP is VBZ your PP$ favorite JJ color NN . SENT or CC What WP is VBZ your PP$ favorite JJ pastime NN . SENT If IN the DT answer NN is VBZ correct JJ , , either CC the DT original JJ password NN is VBZ displayed VVN or CC a DT temporary JJ password NN is VBZ displayed VVN which WDT can MD be VB used VVN to TO log VV in IN . SENT In IN this DT method NN , , an DT attacker NN trying VVG to TO steal VV the DT password NN of IN a DT user NN may MD be VB able JJ to TO guess VV the DT correct JJ answer NN of IN the DT hint NN question NN and CC even RB reset VV the DT password NN . SENT In IN Forgot VVN Password NN , , is VBZ it PP safe JJ to TO display VV the DT old JJ password NN . SENT If IN the DT old JJ password NN is VBZ displayed VVN on IN the DT screen NN , , it PP can MD be VB seen VVN by IN shoulder NN surfers NNS . SENT So RB it PP is VBZ a DT good JJ idea NN not RB to TO display VV the DT password NN and CC let VV the DT user NN change NN to TO a DT new JJ one NN . SENT Moreover RB , , displaying VVG the DT password NN means VVZ it PP has VHZ to TO be VB stored VVN in IN a DT recoverable JJ form NN in IN the DT database NN which WDT is VBZ not RB a DT good JJ practice NN . SENT If IN the DT password NN is VBZ stored VVN as IN a DT one CD way NN hash NN in IN the DT database NN , , the DT only JJ way NN Forgot VVD Password NN can MD be VB implemented VVN is VBZ by IN letting VVG the DT user NN reset VV the DT old JJ password NN . SENT So RB , , it PP is VBZ always RB better JJR to TO force VV the DT users NNS reset VV their PP$ passwords NNS when WRB they PP forget VVP their PP$ passwords NNS . SENT A DT one CD way NN hash NN is VBZ the DT result NN obtained VVD when WRB we PP pass VVP a DT string NN to TO a DT one CD way NN hash NN function NN . SENT The DT result NN is VBZ such JJ that IN it PP is VBZ impossible JJ to TO get VV back RB the DT original JJ value NN from IN it PP . SENT Passwords NNS are VBP best RBS stored VVN as IN non JJ recoverable JJ hashes NNS in IN the DT database NN . SENT Is VBZ there RB any DT risk NN in IN emailing VVG the DT new JJ password NN to TO the DT user's NNS authorized VVD mail NN id NN . SENT Emailing VVG the DT actual JJ password NN in IN clear JJ text NN can MD be VB risky JJ as IN an DT attacker NN can MD obtain VV it PP by IN sniffing VVG . SENT Also RB the DT mail NN containing VVG the DT password NN might MD have VH a DT long JJ life NN time NN and CC could MD be VB viewed VVN by IN an DT attacker NN while IN it PP is VBZ lying VVG in IN the DT mailbox NN of IN the DT user NN . SENT What WP is VBZ the DT most RBS secure JJ way NN to TO design VV the DT Forgot VVN Password NN feature NN . SENT We PP should MD first RB ask VV the DT user NN to TO supply VV some DT details NNS like IN personal JJ details NNS or CC ask VV a DT hint NN question NN . SENT Then RB we PP should MD send VV a DT mail NN to TO the DT users NNS authorized VVD mail NN id NN with IN a DT link NN which WDT will MD take VV the DT user NN to TO a DT page NN for IN resetting VVG the DT password NN . SENT This DT link NN should MD be VB active JJ for IN only RB a DT short JJ time NN , , and CC should MD be VB SSL NP enabled VVD . SENT This DT way NN the DT actual JJ password NN is VBZ never RB seen VVN . SENT The DT security NN benefits NNS of IN this DT method NN are VBP . SENT the DT password NN is VBZ not RB sent VVN in IN the DT mail NN . SENT since IN the DT link NN is VBZ active JJ for IN a DT short JJ time NN , , there EX is VBZ no DT harm NN even RB if IN the DT mail NN remains VVZ in IN the DT mailbox NN for IN a DT long JJ time NN . SENT How WRB do VVP I PP protect VV against IN automated JJ password NN guessing VVG attacks NNS . SENT Password NN guessing VVG with IN automated JJ tools NNS is VBZ a DT serious JJ problem NN since IN there EX are VBP a DT number NN of IN tools NNS available JJ for IN this DT purpose NN . SENT These DT tools NNS essentially RB keep VVP trying VVG out RP different JJ passwords NNS till IN one CD matches NNS . SENT Locking VVG out RP the DT account NN after IN 5 CD failed JJ attempts NNS is VBZ a DT good JJ defense NN against IN these DT tools NNS . SENT However RB , , the DT important JJ point NN then RB is VBZ how WRB long JJ you PP lock VVP out RP the DT account NN for IN . SENT If IN it PP is VBZ for IN too RB long JJ , , service NN to TO valid JJ users NNS might MD be VB denied VVN as IN the DT attackers NNS repeatedly RB lock VVP out RP your PP$ users NNS . SENT If IN the DT time NN is VBZ too RB short RB say VVP about IN 1 CD 2 CD minutes NNS , , the DT tool NN could MD start VV again RB after IN the DT timeout NN . SENT So IN the DT best JJS method NN would MD be VB to TO insist VV on IN human JJ intervention NN after IN a DT few JJ failed JJ attempts NNS . SENT A DT method NN used VVN by IN a DT number NN of IN sites NNS these DT days NNS is VBZ to TO have VH the DT user NN read VV and CC enter VV a DT random JJ word NN that WDT appears VVZ in IN an DT image NN on IN the DT page NN . SENT Since IN this DT cannot NN be VB done VVN by IN a DT tool NN , , we PP can MD thwart VV automated JJ password NN guessing VVG . SENT The DT following VVG are VBP some DT tools NNS that WDT guess VVP passwords NNS of IN web NN applications NNS . SENT Brutus NN http NN . SENT www JJ . SENT hoobie NN . SENT net JJ brutus NP WebCracker NP http NN . SENT www JJ . SENT securityfocus NN . SENT com NN tools NNS 706 CD How WRB can MD I PP protect VV against IN keystroke NN loggers NNS on IN the DT client NN machine NN . SENT Keystroke NN loggers NNS on IN the DT end NN users NNS machines NNS can MD sometimes RB ruin VV all PDT our PP$ efforts NNS of IN securely RB transmitting VVG and CC storing VVG the DT passwords NNS . SENT The DT users NNS themselves PP may MD not RB be VB aware JJ that IN a DT key JJ logger NN has VHZ been VBN installed VVN on IN their PP$ machines NNS and CC records NNS each DT key NN pressed VVD . SENT Since IN the DT highest JJS risk NN is VBZ with IN the DT password NN , , if IN we PP can MD authenticate VV the DT users NNS without IN having VHG them PP use VV the DT keyboard NN , , or CC reveal VV the DT entire JJ password NN , , we PP solve VV the DT problem NN . SENT The DT different JJ ways NNS of IN doing VVG this DT are VBP . SENT Having VHG a DT graphical JJ keyboard NN where WRB the DT users NNS can MD enter VV the DT characters NNS they PP want VVP by IN clicking VVG the DT mouse NN on IN it PP . SENT This DT is VBZ especially RB useful JJ for IN numeric JJ PINs NNS . SENT Asking VVG the DT users NNS to TO type NN a DT part NN of IN their PP$ password NN each DT time NN and CC not RB the DT whole JJ password NN . SENT For IN example NN you PP could MD say VV Please RB enter VV the DT 1 CD st NP , , 3 CD rd NNS and CC 6 CD th NN letters NNS of IN your PP$ password NN and CC this DT rule NN could MD be VB a DT random JJ one NN each DT time NN . SENT My PP$ site NN will MD be VB used VVN from IN publicly RB shared VVN computers NNS . SENT What WP precautions NNS must MD I PP take VV . SENT If IN your PP$ application NN will MD be VB accessed VVN from IN publicly RB shared VVN computers NNS like IN libraries NNS , , you PP could MD take VV the DT following VVG precautions NNS . SENT You PP can MD make VV sure RB your PP$ pages NNS do VVP not RB get VV cached JJ on IN the DT system NN by IN setting VVG the DT correct JJ cache NN control NN directives NNS . SENT You PP could MD take VV care NN that IN no DT sensitive JJ information NN is VBZ included VVN in IN the DT URLs NNS since IN the DT history NN of IN the DT client NN browser NN will MD store VV these DT . SENT Have VHP a DT graphical JJ keyboard NN for IN entering VVG the DT password NN or CC ask VV the DT user NN to TO enter VV a DT different JJ part NN of IN the DT password NN each DT time NN . SENT This DT protects VVZ the DT password NN against IN keystroke NN loggers NNS . SENT To TO prevent VV sniffing VVG of IN passwords NNS and CC replay NN attacks NNS using VVG those DT , , you PP should MD either RB use VV SSL NP or CC salted VVD MD NP 5 CD for IN passwords NNS . SENT The DT clear JJ text NN password NN in IN the DT memory NN should MD be VB reset JJ after IN computing VVG the DT MD NP 5 CD . SENT SQL NP Injection NN What WP is VBZ SQL NP Injection NN . SENT SQL NP Injection NN is VBZ a DT technique NN by IN which WDT attackers NNS can MD execute VV SQL NP statements NNS of IN their PP$ choice NN on IN the DT backend NN database NN by IN manipulating VVG the DT input NN to TO the DT application NN . SENT Let's NNS understand VVP SQL NP Injection NN through IN the DT example NN of IN a DT login NN page NN in IN a DT web NN application NN where WRB the DT database NN is VBZ SQL NP Server NP . SENT The DT user NN needs VVZ to TO input NN Username NN and CC Password NN in IN the DT text NN boxes NNS in IN Login NP . SENT asp NN page NN . SENT Suppose VV the DT user NN enters VVZ the DT following NN . SENT Username NP . SENT Obelix NN and CC Password NN . SENT Dogmatix NP This DT input NN is VBZ then RB used VVN to TO build VV a DT query VV dynamically RB which WDT would MD be VB something NN like IN . SENT SELECT VV FROM IN Users NNS WHERE WRB username JJ Obelix NP and CC password NN Dogmatix NN This DT query NN would MD return VV to TO the DT application NN a DT row NN from IN the DT database NN with IN the DT given VVN values NNS . SENT The DT user NN is VBZ considered VVN authenticated VVN if IN the DT database NN returns VVZ one CD or CC more JJR rows NNS to TO the DT application NN . SENT Now RB , , suppose VVP an DT attacker NN enters VVZ the DT following VVG input NN in IN the DT login NN page NN . SENT Username NP . SENT or CC 1 CD 1 CD The DT query NN built VVN will MD look VV like IN this DT . SENT SELECT VV FROM IN Users NNS WHERE WRB username NN or CC 1 CD 1 CD and CC password NN in IN SQL NP Server NP is VBZ used VVN to TO comment VV out RP the DT rest NN of IN the DT line NN . SENT So RB , , our PP$ query NN is VBZ now RB effectively RB . SENT SELECT VV FROM IN Users NNS WHERE WRB username NN or CC 1 CD 1 CD This DT query NN will MD look VV in IN the DT database NN for IN a DT row NN where WRB either DT username NN is VBZ blank JJ or CC the DT condition NN 1 CD 1 CD is VBZ met VVN . SENT Since IN the DT latter NN always RB evaluates VVZ to TO true JJ , , the DT query NN will MD return VV all DT rows NNS of IN the DT Users NNS table NN and CC the DT user NN is VBZ authenticated VVN . SENT The DT attacker NN has VHZ been VBN successful JJ in IN logging VVG into IN the DT application NN without IN a DT username NN and CC password NN . SENT You PP can MD read VV more JJR on IN this DT at IN the DT Securiteam NP site NN . SENT http NN . SENT www JJ . SENT securiteam NN . SENT com NN securityreviews NNS 5 CD DP NN 0 CD N NP 1 CD P NN 76 CD E NN . SENT html NN Is VBZ it PP just RB ASP NN and CC SQL NP Server NP or CC are VBP all DT platforms NNS vulnerable JJ . SENT Almost RB all DT platforms NNS are VBP vulnerable JJ to TO SQL NP Injection NN . SENT Inadequate JJ checking NN of IN user NN input NN and CC the DT use NN of IN dynamic JJ SQL NP queries NNS are VBP what WP make VVP an DT application NN vulnerable JJ to TO these DT attacks NNS . SENT The DT syntax NN of IN the DT input NN entered VVN for IN SQL NP Injection NN will MD depend VV on IN the DT database NN being VBG used VVN . SENT During IN our PP$ application NN security NN audits NN we PP have VHP found VVN many JJ applications NNS using VVG other JJ databases NNS to TO be VB vulnerable JJ . SENT The DT above JJ example NN would MD work VV on IN SQL NP Server NP , , Oracle NP and CC MySQL NP . SENT This DT shows NNS that IN the DT problem NN is VBZ with IN the DT inadequate JJ checking NN of IN user NN input NN and CC the DT use NN of IN dynamic JJ SQL NP and CC not RB the DT underlying JJ database NN . SENT Apart RB from IN username NN and CC password NN which WDT variables NNS are VBP candidates NNS for IN SQL NP Injection NN . SENT Any DT input NN field NN that WDT makes VVZ up IN the DT where WRB clause NN of IN a DT database NN query NN is VBZ a DT candidate NN for IN SQL NP Injection NN , , eg NN . SENT account NN numbers NNS , , and CC credit NN card NN numbers NNS in IN the DT case NN of IN an DT online JJ banking NN application NN . SENT In IN addition NN to TO form VV fields NNS , , an DT attacker NN can MD use VV hidden JJ fields NNS and CC query NN strings NNS also RB for IN injecting VVG commands NNS . SENT How WRB do VVP we PP prevent VV SQL NP Injection NN in IN our PP$ applications NNS . SENT It PP is VBZ quite RB simple JJ to TO prevent VV SQL NP injection NN while IN developing VVG the DT application NN . SENT You PP need VVP to TO check VV all DT input NN coming VVG from IN the DT client NN before IN building VVG a DT SQL NP query NN . SENT The DT best JJS method NN is VBZ to TO remove VV all DT unwanted JJ input NN and CC accept VV only RB expected VVN input NN . SENT While IN server NN side NN input NN validation NN is VBZ the DT most RBS effective JJ method NN of IN preventing VVG SQL NP Injection NN , , the DT other JJ method NN of IN prevention NN is VBZ not RB using VVG dynamic JJ SQL NP queries NNS . SENT This DT can MD be VB achieved VVN by IN using VVG stored VVN procedures NNS or CC bind NN variables NNS in IN databases NNS that WDT support VVP these DT features NNS . SENT For IN applications NNS written VVN in IN Java NP , , CallableStatements NP and CC PreparedStatements NP can MD be VB used VVN . SENT For IN ASP NN applications NNS , , ADO NN Command NP Objects NNS can MD be VB used VVN . SENT You PP can MD check VV the DT following VVG article NN for IN more JJR on IN SQL NP Injection NN in IN Oracle NP . SENT http NN . SENT www JJ . SENT integrigy NN . SENT com NN info NN IntegrigyIntrotoSQLInjectionAttacks NP . SENT pdf NP I'm NP using VVG stored VVN procedures NNS for IN authentication NN , , am VBP I PP vulnerable JJ . SENT No UH . SENT Using VVG stored VVN procedures NNS prevents VVZ SQL NP Injection NN because IN the DT user NN input NN is VBZ no DT longer RB used VVN to TO build VV the DT query NN dynamically RB . SENT Since IN a DT stored VVN procedure NN is VBZ a DT group NN of IN precompiled JJ SQL NP statements NNS and CC the DT procedure NN accepts VVZ input NN as IN parameters NNS , , a DT dynamic JJ query NN is VBZ avoided VVN . SENT Although IN input NN is VBZ put VVN into IN the DT precompiled JJ query NN as RB is VBZ , , since IN the DT query NN itself PP is VBZ in IN a DT different JJ format NN , , it PP does VVZ not RB have VH the DT effect NN of IN changing VVG the DT query NN as RB expected VVN . SENT By IN using VVG stored VVN procedures NNS we PP are VBP letting VVG the DT database NN handle VV the DT execution NN of IN the DT query NN instead RB of IN asking VVG it PP to TO execute VV a DT query NN we PP have VHP built VVN . SENT I'm NN using VVG client NN side NN JavaScript NN code NN for IN checking VVG user NN input NN . SENT Isn't NN that IN enough RB . SENT No UH . SENT Although IN client NN side NN checking NN disallows VVZ the DT attacker NN to TO enter VV malicious JJ data NNS directly RB into IN the DT input NN fields NNS , , that WDT alone RB is VBZ not RB enough JJ to TO prevent VV SQL NP Injection NN . SENT Client NN side NN scripts NNS only RB check VVP for IN input NN in IN the DT browser NN . SENT But CC this DT does VVZ not RB guarantee VV that IN the DT information NN will MD remain VV the DT same JJ till IN it PP reaches VVZ the DT server NN . SENT There EX are VBP tools NNS that WDT can MD capture VV the DT request NN going VVG from IN the DT client NN to TO the DT server NN and CC change VV it PP before IN sending VVG it PP to TO the DT server NN . SENT The DT attacker NN can MD also RB inject VV commands NNS into IN the DT querystring VVG variables NNS which WDT are VBP not RB checked VVN by IN the DT client NN side NN scripts NNS . SENT Are VBP Java NP servlets NNS vulnerable JJ to TO SQL NP injection NN . SENT Yes UH , , they PP are VBP if IN the DT user NN input NN is VBZ not RB checked VVN properly RB , , and CC if IN they PP build VVP SQL NP queries NNS dynamically RB . SENT But CC Java NP servlets NNS also RB have VHP certain JJ features NNS that WDT prevent VVP SQL NP Injection NN like IN CallableStatements NP and CC PreparedStatements NP . SENT Like IN stored VVN procedures NNS and CC bind NN variables NNS , , they PP avoid VVP the DT need NN of IN dynamic JJ SQL NP statements NNS . SENT Variable JJ Manipulation NN Why WRB can't JJ I PP trust VVP the DT information NN coming VVG from IN the DT browser NN . SENT There EX are VBP chances NNS that IN the DT information NN is VBZ modified VVN before IN it PP reaches VVZ the DT server NN . SENT Attackers NNS browsing VVG the DT site NN can MD manipulate VV the DT information NN in IN a DT GET VV or CC POST VV request NN . SENT There EX are VBP a DT number NN of IN tools NNS like IN Achilles NP which WDT are VBP capable JJ of IN intercepting VVG all PDT this DT information NN and CC allow VV the DT attacker NN running VVG the DT tool NN to TO modify VV it PP . SENT Also RB , , the DT information NN that IN the DT user NN sees VVZ or CC provides VVZ on IN a DT web NN page NN has VHZ to TO travel VV through IN the DT internet NN before IN it PP reaches VVZ the DT server NN . SENT Although IN the DT client NN and CC the DT server NN may MD be VB trusted VVN , , we PP cannot NN be VB sure JJ that IN the DT information NN is VBZ not RB modified VVN after IN it PP leaves VVZ the DT browser NN . SENT Attackers NNS can MD capture VV the DT information NN on IN the DT way NN and CC manipulate VV it PP . SENT What WP information NN can MD be VB manipulated VVN by IN the DT attacker NN . SENT Manipulating VVG the DT variables NNS in IN the DT URL NN is VBZ simple JJ . SENT But CC attackers NNS can MD also RB manipulate VV almost RB all DT information NN going VVG from IN the DT client NN to TO the DT server NN like IN form NN fields NNS and CC hidden JJ fields NNS . SENT How WRB do VVP attackers NNS manipulate VV the DT information NN . SENT What WP tools NNS do VVP they PP use VVP . SENT For IN manipulating VVG any DT information NN , , including VVG form NN fields NNS , , hidden JJ variables NNS and CC cookies NNS , , attackers NNS use VVP tools NNS known VVN as IN HTTP NP proxy NN tools NNS . SENT Once RB the DT browser's JJ proxy NN settings NNS are VBP configured VVN to TO go VV through IN the DT HTTP NP proxy NN , , the DT tool NN can MD see VV all DT information NN flowing VVG between IN the DT client NN and CC the DT server NN . SENT it PP even RB allows VVZ the DT attacker NN to TO modify VV any DT part NN of IN the DT request NN response NN before IN sending VVG it PP . SENT Some DT such JJ tools NNS are VBP . SENT WebScarab NP can MD be VB downloaded VVN at IN the DT OWASP NP site NN www NP . SENT owasp NN . SENT org NP Odysseus NP can MD be VB found VVN at IN http NN . SENT www JJ . SENT wastelands NNS . SENT gen NN . SENT nz NP odysseus NP index NN . SENT php NP I'm NP using VVG SSL NP . SENT Can MD attackers NNS still RB modify VV information NN . SENT Although IN SSL NP provides VVZ a DT lot NN of IN security NN , , SSL NP alone RB is VBZ not RB enough JJ to TO prevent VV variable JJ manipulation NN attacks NNS . SENT SSL NP is VBZ useful JJ to TO prevent VV man NN in IN the DT middle JJ attacks NNS where WRB an DT attacker NN intercepts VVZ another DT user's NNS session NN , , sees VVZ its PP$ contents NNS or CC modifies VVZ data NNS . SENT But CC it PP cannot NN prevent VV an DT attacker NN from IN intercepting VVG his PP$ own JJ connection NN and CC manipulating VVG the DT variables NNS . SENT Let's NNS see VVP how WRB Achilles NP works VVZ with IN SSL NP to TO manipulate VV data NNS . SENT Achilles NP has VHZ a DT fake JJ certificate NN with IN a DT pair NN of IN keys NNS that IN it PP generated VVD itself PP . SENT When WRB the DT client NN requests NNS for IN the DT SSL NP page NN , , Achilles NP sends VVZ it PP as RB is VBZ to TO the DT server NN . SENT The DT server NN then RB sends VVZ its PP$ certificate NN with IN its PP$ public JJ key NN in IN response NN . SENT Achilles NP now RB intercepts VVZ this DT , , generates VVZ a DT session NN key NN and CC sends VVZ it PP to TO the DT server NN encrypted VVN with IN the DT public JJ key NN of IN the DT server NN . SENT So RB it PP has VHZ successfully RB established VVN a DT SSL NP connection NN with IN the DT server NN . SENT Now RB for IN the DT client NN side NN , , Achilles NP sends VVZ out RP its PP$ own JJ certificate NN and CC public JJ key NN to TO the DT client NN . SENT The DT client's NNS browser NN will MD show VV a DT message NN saying VVG the DT certificate NN is VBZ un NP trusted VVN and CC ask VV whether IN it PP should MD be VB accepted VVN . SENT but CC since IN it PP is VBZ the DT attackers NNS browser NN and CC the DT attackers NNS themselves PP have VHP put VVN Achilles NP , , they PP will MD accept VV the DT certificate NN . SENT Now RB the DT client NN generates VVZ a DT session NN key NN , , encrypts VVZ it PP with IN Achilles NP public JJ key NN and CC sends VVZ it PP . SENT So RB now RB Achilles NP has VHZ set VVN up RP two CD SSL NP connections NNS one CD with IN the DT server NN and CC the DT other JJ with IN the DT client NN . SENT It PP decrypts VVZ the DT information NN coming VVG from IN the DT server NN , , shows VVZ it PP as IN plain JJ text NN to TO the DT attackers NNS and CC then RB encrypts VVZ it PP again RB with IN the DT client's JJ key NN and CC sends VVZ it PP . SENT A DT similar JJ method NN is VBZ followed VVN for IN traffic NN in IN the DT other JJ direction NN . SENT Is VBZ there RB some DT way NN to TO prevent VV these DT proxy JJ tools NNS from IN editing VVG the DT data NNS . SENT The DT main JJ threat NN these DT proxy JJ tools NNS pose VVP is VBZ editing VVG the DT information NN sent VVD from IN the DT client NN to TO the DT server NN . SENT One CD way NN to TO prevent VV it PP is VBZ to TO sign VV the DT message NN sent VVD from IN the DT client NN with IN a DT Java NP Applet NP downloaded VVD onto IN the DT client NN machine NN . SENT Since IN the DT applet NN we PP developed VVD will MD be VB the DT one NN validating VVG the DT certificate NN and CC not RB the DT browser NN , , a DT proxy JJ tool NN will MD not RB be VB able JJ to TO get VV in IN between IN the DT client NN and CC the DT server NN with IN a DT fake JJ certificate NN . SENT The DT applet NN will MD reject VV the DT fake JJ certificate NN . SENT The DT public JJ key NN of IN this DT certificate NN can MD then RB be VB used VVN to TO digitally RB sign VV each DT message NN sent VVD between IN the DT client NN and CC the DT server NN . SENT An DT attacker NN would MD then RB have VH to TO replace VV the DT embedded VVN certificate NN in IN the DT applet NN with IN a DT fake JJ certificate NN to TO succeed VV that DT raises VVZ the DT barrier NN for IN the DT attacker NN . SENT Browser NN Cache NP How WRB can MD the DT browser NN cache NN be VB used VVN in IN attacks NNS . SENT The DT browser NN has VHZ a DT capability NN to TO temporarily RB store VV some DT of IN the DT pages NNS browsed VVD . SENT These DT cached JJ files NNS are VBP stored VVN in IN a DT folder NN , , like IN the DT Temporary JJ Internet NP Files NP folder NN in IN the DT case NN of IN Internet NN Explorer NN . SENT When WRB we PP ask VVP for IN these DT pages NNS again RB , , the DT browser NN displays VVZ them PP from IN its PP$ cache NN . SENT This DT is VBZ much RB faster RBR than IN downloading VVG the DT page NN from IN the DT server NN . SENT Let's NNS consider VVP the DT particular JJ scenario NN where WRB a DT user NN has VHZ logged VVN in RP to TO an DT application NN with IN username NN and CC password NN . SENT The DT user NN browses VVZ the DT different JJ pages NNS which WDT contain VVP sensitive JJ information NN . SENT Let's NNS suppose VVP a DT page NN with IN the DT user's JJ credit NN card NN information NN gets VVZ cached JJ in IN the DT browser NN and CC the DT user NN logs VVZ out RP of IN the DT application NN . SENT Now RB suppose VVP the DT attackers NNS access NN the DT same JJ machine NN and CC searches NNS through IN the DT Temporary JJ Internet NP Files NP , , they PP will MD get VV the DT credit NN card NN details NNS . SENT The DT attackers NNS do VVP not RB need VV to TO know VV the DT username NN and CC password NN of IN the DT user NN to TO steal VV the DT information NN . SENT How WRB do VVP I PP ensure VV that IN sensitive JJ pages NNS are VBP not RB cached VVN on IN the DT user's JJ browser NN . SENT The DT response NN header NN sent VVN from IN the DT server NN has VHZ some DT cache NN control NN directives NNS that WDT can MD be VB set VVN from IN your PP$ code NN . SENT These DT directives NNS control VVP the DT caching NN of IN content NN on IN the DT client NN browser NN . SENT The DT directives NNS to TO be VB set VVN are VBP cache NN control NN . SENT no DT cache NN or CC cache NN control NN . SENT no DT store NN . SENT What's NP the DT difference NN between IN the DT cache NN control NN directives NNS . SENT no DT cache NN , , and CC no DT store NN . SENT The DT no DT cache NN directive NN in IN a DT response NN indicates VVZ that IN the DT response NN must MD not RB be VB used VVN to TO serve VV a DT subsequent JJ request NN i NP . SENT e SYM . SENT the DT cache NN must MD not RB display VV a DT response NN that WDT has VHZ this DT directive NN set VVN in IN the DT header NN but CC must MD let VV the DT server NN serve VV the DT request NN . SENT The DT no DT cache NN directive NN can MD include VV some DT field NN names NNS . SENT in IN which WDT case NN the DT response NN can MD be VB shown VVN from IN the DT cache NN except IN for IN the DT field NN names NNS specified JJ which WDT should MD be VB served VVN from IN the DT server NN . SENT The DT no DT store NN directive NN applies VVZ to TO the DT entire JJ message NN and CC indicates VVZ that IN the DT cache NN must MD not RB store VV any DT part NN of IN the DT response NN or CC any DT request NN that WDT asked VVD for IN it PP . SENT Am VBP I PP totally RB safe JJ with IN these DT directives NNS . SENT These DT directives NNS solve VV the DT problem NN of IN caching VVG to TO some DT extent NN but CC not RB completely RB , , since IN no DT cache NN and CC no DT store NN are VBP not RB supported VVN by IN HTTP NP 1 CD . SENT 0 CD caches NNS . SENT Also RB , , we PP have VHP observed VVN that DT non JJ html NN content NN types NNS like IN pdf NP and CC Excel NP spreadsheets NNS get VVP cached JJ on IN the DT browser NN even RB when WRB the DT above JJ tags NNS are VBP set VVN . SENT Where WRB can MD I PP learn VV more RBR about IN caching NN . SENT Some DT useful JJ links NNS that WDT talk VVP about IN caching NN are VBP Caching VVG Tutorial NN for IN Web NP Authors NNS and CC Webmasters NP by IN Mark NP Nottingham NP at IN http NN . SENT www JJ . SENT mnot NN . SENT net JJ cache NN docs NNS HTTP NP RFC NP at IN http NN . SENT www JJ . SENT w NN 3 CD . SENT org NP Protocols NNS rfc NN 2616 CD rfc NN 2616 CD sec NN 14 CD . SENT html NN sec JJ 14 CD . SENT 9 CD . SENT 1 CD Cross NP Site NN Scripting VVG What WP is VBZ Cross NP Site NN Scripting VVG . SENT Cross NP Site NN scripting VVG XSS NP is VBZ a DT type NN of IN attack NN that WDT can MD be VB carried VVN out RP to TO steal VV sensitive JJ information NN belonging VVG to TO the DT users NNS of IN a DT web NN site NN . SENT This DT relies VVZ on IN the DT server NN reflecting VVG back JJ user NN input NN without IN checking VVG for IN embedded VVN javascript NN . SENT This DT can MD be VB used VVN to TO steal VV cookies NNS and CC session NN IDs NNS . SENT Let's NNS see VVP how WRB it PP works VVZ . SENT We PP would MD all RB have VH come VVN across IN the DT following VVG situation NN sometime RB we PP type NN a DT URL NN in IN the DT browser NN , , say VVP www JJ . SENT abcd NN . SENT com NN mypage NN . SENT asp NN , , and CC receive VV an DT error NN page NN that WDT says VVZ Sorry RB www JJ . SENT abcd NN . SENT com NN mypage NN . SENT asp NN does VVZ not RB exist VV or CC a DT page NN with IN a DT similar JJ message NN . SENT In IN other JJ words NNS , , pages NNS that WDT display VVP the DT user NN input NN back RB on IN the DT browser NN . SENT Pages NNS like IN this DT could MD be VB exploited VVN using VVG XSS NP . SENT Instead RB of IN a DT normal JJ input NN , , think VVP what WP will MD happen VV if IN the DT input NN contains VVZ a DT script NN in IN it PP . SENT While IN reflecting VVG back RB the DT input NN , , instead RB of IN rendering VVG it PP as IN normal JJ HTML NP output NN , , the DT browser NN treats VVZ it PP as IN a DT script NN and CC executes VVZ it PP . SENT This DT script NN could MD contain VV some DT malicious JJ code NN . SENT The DT attackers NNS can MD send VV a DT link NN that WDT contains VVZ a DT script NN as IN part NN of IN the DT URL NN to TO a DT user NN . SENT When WRB the DT user NN clicks VVZ it PP , , the DT script NN gets VVZ executed VVN on IN the DT user's JJ browser NN . SENT This DT script NN may MD have VH been VBN written VVN to TO collect VV important JJ information NN about IN the DT user NN and CC send VV it PP to TO the DT attacker NN . SENT Kevin NP Spett's NP paper NN Cross NP Site NN Scripting VVG , , Are VBP your PP$ web NN applications NNS vulnerable JJ . SENT is VBZ a DT good JJ source NN of IN information NN on IN this DT topic NN and CC is VBZ available JJ at IN http NN . SENT www JJ . SENT spidynamics NNS . SENT com NN whitepapers NNS SPIcross NP sitescripting NN . SENT pdf NN The DT Cross NP Site NN Scripting VVG FAQ NP at IN CGI NP Security NP is VBZ another DT good JJ place NN to TO learn VV more JJR on IN XSS NP . SENT What WP information NN can MD an DT attacker NN steal VV using VVG XSS NP . SENT The DT attackers NNS can MD steal VV the DT session NN ID NN of IN a DT valid JJ user NN using VVG XSS NP . SENT The DT session NN ID NN is VBZ very RB valuable JJ because IN it PP is VBZ the DT secret NN token JJ that IN the DT user NN presents VVZ after IN login NN as IN proof NN of IN identity NN until IN logout NN . SENT If IN the DT session NN ID NN is VBZ stored VVN in IN a DT cookie NN , , the DT attackers NNS can MD write VV a DT script NN which WDT will MD run VV on IN the DT user's JJ browser NN , , query VV the DT value NN in IN the DT cookie NN and CC send VV it PP to TO the DT attackers NNS . SENT The DT attackers NNS can MD then RB use VV the DT valid JJ session NN ID NN to TO browse VV the DT site NN without IN logging VVG in RP . SENT The DT script NN could MD also RB collect VV other JJ information NN from IN the DT page NN , , including VVG the DT entire JJ contents NNS of IN the DT page NN . SENT Apart RB from IN mailing VVG links NNS of IN error NN pages NNS , , are VBP there RB other JJ methods NNS of IN exploiting VVG XSS NP . SENT Yes UH , , there EX are VBP other JJ methods NNS . SENT Let's NNS take VVP the DT example NN of IN a DT bulletin NN board NN application NN that WDT has VHZ a DT page NN where WRB data NNS entered VVD by IN one CD user NN can MD be VB viewed VVN by IN other JJ users NNS . SENT The DT attackers NNS enter VVP a DT script NN into IN this DT page NN . SENT When WRB a DT valid JJ user NN tries VVZ to TO view VV the DT page NN , , the DT script NN gets VVZ executed VVN on IN the DT user's JJ browser NN . SENT It PP will MD send VV the DT user's JJ information NN to TO the DT attackers NNS . SENT How WRB can MD I PP prevent VV XSS NP . SENT XSS NP can MD be VB prevented VVN while IN coding VVG the DT application NN . SENT You PP should MD be VB validating VVG all DT input NN and CC output NN to TO and CC from IN the DT application NN and CC escape VV all DT special JJ characters NNS that WDT may MD be VB used VVN in IN a DT script NN . SENT If IN the DT code NN replaces VVZ the DT special JJ characters NNS by IN the DT following NN before IN displaying VVG the DT output NN , , XSS NP can MD be VB prevented VVN to TO some DT extent NN . SENT gt NN . SENT 40 CD . SENT 41 CD . SENT 35 CD . SENT 38 CD . SENT Gunter NP Ollmann NP has VHZ written VVN an DT excellent JJ paper NN on IN the DT use NN of IN special JJ characters NNS in IN XSS NP attacks NNS . SENT For IN instance NN , , the DT above JJ technique NN of IN escaping VVG special JJ characters NNS cannot NN protect VVP against IN a DT script NN injected VVN like IN javascript NN . SENT self NN . SENT location NN . SENT href NN http NN . SENT www JJ . SENT evil JJ . SENT org JJS as IN this DT script NN does VVZ not RB use VV any DT of IN the DT special JJ characters NNS . SENT Can MD XSS NP be VB prevented VVN without IN modifying VVG the DT source NN code NN . SENT There EX is VBZ a DT method NN that WDT requires VVZ minimal JJ coding VVG as RB compared VVN to TO performing VVG input NN , , output NN validation NN to TO prevent VV the DT stealing VVG of IN cookies NNS by IN XSS NP . SENT Internet NP Explorer NN 6 CD has VHZ an DT attribute NN called VVD HTTP NP Only RB that WDT can MD be VB set VVN for IN cookies NNS . SENT Using VVG this DT attribute NN makes VVZ sure JJ that IN the DT cookie NN can MD not RB be VB accessed VVN by IN any DT scripts NNS . SENT More JJR details NNS are VBP available JJ at IN the DT MSDN NP site NN on IN httpcookies NNS at IN http NN . SENT msdn NN . SENT microsoft NP . SENT com NN library NN default NN . SENT asp NN . SENT url NN workshop NN author NN dhtml NN httponly JJ cookies NNS . SENT asp NN Mozilla NP also RB has VHZ plans NNS to TO implement VV a DT similar JJ feature NN . SENT Researchers NNS have VHP found VVN a DT method NN to TO beat VV this DT . SENT It PP is VBZ known VVN as IN Cross NP Site NN Tracing VVG . SENT What WP is VBZ Cross NP Site NN Tracing VVG XST NP . SENT How WRB can MD it PP be VB prevented VVN . SENT Attackers NNS are VBP able JJ to TO bypass VV the DT HTTP NP Only RB attribute VVP to TO steal VV cookie NN information NN by IN Cross NP Site NN tracing VVG XST NP . SENT TRACE VV is VBZ a DT HTTP NP method NN that WDT can MD be VB sent VVN to TO the DT server NN . SENT The DT server NN sends VVZ back JJ anything NN included VVD in IN the DT TRACE NN request NN back RB to TO the DT browser NN . SENT In IN a DT site NN that WDT uses VVZ cookies NNS , , the DT cookie NN information NN is VBZ sent VVN to TO the DT server NN in IN each DT request NN . SENT If IN we PP send VVP a DT TRACE VV request NN in IN a DT URL NN of IN such PDT a DT site NN , , the DT server NN will MD send VV back RB all DT cookie NN information NN to TO the DT browser NN . SENT Now RB imagine VV a DT situation NN similar JJ to TO the DT one NN described VVN in IN XSS NP but CC the DT site NN in IN this DT case NN is VBZ using VVG the DT HTTP NP Only JJ cookies NNS . SENT The DT attackers NNS make VVP a DT valid JJ user NN click NN on IN a DT link NN that WDT contains VVZ a DT script NN that WDT calls VVZ the DT TRACE VV method NN . SENT When WRB the DT user NN clicks VVZ on IN the DT link NN the DT TRACE VV request NN as RB well RB as IN all PDT the DT cookie NN information NN is VBZ sent VVN to TO the DT server NN . SENT The DT server NN then RB sends VVZ back RB the DT cookie NN information NN back RB to TO the DT script NN in IN the DT browser NN . SENT Suppose VVP that IN the DT malicious JJ script NN also RB contains VVZ code NN to TO send VV this DT information NN to TO the DT attackers NNS . SENT The DT attackers NNS have VHP succeeded VVN again RB in IN stealing VVG the DT cookies NNS although IN HTTP NP Only JJ Cookies NNS were VBD used VVN . SENT To TO summarize VV , , HTTP NP Only JJ cookies NNS prevent VVP the DT JavaScript NN from IN directly RB accessing VVG the DT cookies NNS but CC the DT attacker NN was VBD able JJ to TO retrieve VV it PP through IN an DT indirect JJ method NN . SENT XST NP can MD be VB prevented VVN by IN disabling VVG the DT TRACE VV method NN on IN the DT web NN server NN . SENT This DT paper NN by IN Jeremiah NP Grossman NP discusses VVZ XST NN in IN greater JJR detail NN http NN . SENT www JJ . SENT cgisecurity NN . SENT com NN whitehat NNS mirror VVP WhitePaper NP screen NN . SENT pdf NP Web NP Server NP Fingerprinting VVG How WRB do VV attackers NNS identify VV which WDT web NN server NN I'm NP using VVG . SENT Identifying VVG the DT application NN running VVG on IN a DT remote JJ web NN server NN is VBZ known VVN as IN fingerprinting VVG the DT server NN . SENT The DT simplest JJS way NN to TO do VV this DT is VBZ to TO send VV a DT request NN to TO the DT server NN and CC see VV the DT banner NN sent VVD in IN the DT response NN . SENT Banners NNS will MD generally RB have VH the DT server NN name NN and CC the DT version NN number NN in IN it PP . SENT We PP can MD address VV this DT problem NN by IN either RB configuring VVG the DT server NN not RB too RB display VV the DT banner NN at IN all DT or CC by IN changing VVG it PP to TO make VV the DT server NN look NN like IN something NN else RB . SENT How WRB can MD I PP fake JJ the DT banners NNS or CC rewrite VV the DT headers NNS from IN my PP$ web NN server NN . SENT There EX are VBP a DT number NN of IN tools NNS that WDT help VVP in IN faking VVG the DT banners NNS . SENT URLScan NP is VBZ a DT tool NN that WDT can MD change VV the DT banner NN of IN an DT IIS NP web NN server NN . SENT http NN . SENT www JJ . SENT microsoft NP . SENT com NN technet NN treeview NN default NN . SENT asp NN . SENT url NN technet NN security NN tools NNS URLScan NP . SENT asp NN mod NN security NN has VHZ a DT feature NN for IN changing VVG the DT identity NN of IN the DT Apache NP web NN server NN . SENT It PP can MD be VB found VVN at IN http NN . SENT www JJ . SENT modsecurity NN . SENT org NP Servermask NP for IN faking VVG banners NNS of IN IIS NP , , can MD be VB found VVN at IN http NN . SENT www JJ . SENT servermask NN . SENT com NN Once IN I PP fake JJ the DT banners NNS , , can MD my PP$ web NN server NN still RB be VB fingerprinted VVN . SENT Yes UH . SENT Unfortunately RB there EX are VBP tools NNS that IN fingerprint NN the DT web NN server NN without IN relying VVG on IN the DT banners NNS . SENT Different JJ web NN servers NNS may MD implement VV features NNS not RB specified VVN in IN HTTP NP RFCs NP differently RB . SENT Suppose VV we PP make VV a DT database NN of IN these DT special JJ requests NNS and CC the DT responses NNS of IN each DT web NN server NN . SENT We PP can MD now RB send VV these DT requests NNS to TO the DT web NN server NN we PP want VVP to TO fingerprint NN and CC compare VV the DT responses NNS with IN the DT database NN . SENT This DT is VBZ the DT technique NN used VVN by IN tools NNS like IN Fire NP Water NP . SENT This DT tool NN can MD be VB found VVN at IN http NN . SENT www JJ . SENT ntobjectives NNS . SENT com NN products NNS firewater NN There EX is VBZ a DT paper NN by IN Saumil NP Shah NP that WDT discusses VVZ the DT tool NN httprint NN at IN http NN . SENT net JJ square NN . SENT com NN httprint NN httprint NN paper NN . SENT html NN httprint NN can MD be VB found VVN at IN http NN . SENT net JJ square NN . SENT com NN httprint NN A DT friend NN told VVD me PP it's NN safer JJR to TO run VV my PP$ web NN server NN on IN a DT non JJ standard JJ port NN . SENT Is VBZ that DT right NN . SENT A DT web NN server NN generally RB needs VVZ to TO be VB accessed VVN by IN a DT lot NN of IN people NNS on IN the DT internet NN . SENT Since IN it PP normally RB runs VVZ on IN port NN 80 CD and CC all DT browsers NNS are VBP configured VVN to TO access VV port NN 80 CD of IN the DT web NN server NN , , users NNS are VBP able JJ to TO browse VV the DT site NN . SENT If IN we PP change VVP the DT port NN , , the DT users NNS will MD have VH to TO specify VV the DT port NN in IN addition NN to TO the DT domain NN name NN . SENT But CC this DT is VBZ a DT good JJ idea NN for IN an DT intranet NN application NN where WRB all DT users NNS know VVP where WRB to TO connect VV . SENT It PP is VBZ more RBR secure JJ since IN the DT web NN server NN will MD not RB be VB targeted VVN by IN automated JJ attacks NNS like IN worms NNS that WDT scan VV port JJ 80 CD and CC other JJ standard JJ ports NNS . SENT Should MD I PP really RB be VB concerned VVN that IN my PP$ web NN server NN can MD be VB fingerprinted VVN . SENT Well RB , , there EX are VBP two CD schools NNS of IN thought NN here RB . SENT According VVG to TO the DT first JJ school NN , , yes RB you PP should MD take VV precaution NN against IN fingerprinting VVG as IN correctly RB identiying VVG the DT web NN server NN maybe RB the DT first JJ step NN in IN a DT more RBR dangerous JJ attack NN . SENT Once RB attackers NNS have VHP found VVN out RP that IN the DT web NN server NN is VBZ say VV IIS NP 5 CD , , they PP will MD search VV for IN known VVN vulnerabilities NNS for IN IIS NP 5 CD . SENT If IN the DT web NN server NN is VBZ not RB patched VVN for IN all DT known VVN vulnerabilities NNS or CC the DT attackers NNS find VVP one CD for IN which WDT a DT patch NN has VHZ not RB been VBN released VVN yet RB , , there EX is VBZ nothing NN to TO stop VV them PP from IN attacking VVG it PP . SENT Also RB automated VVN tools NNS and CC worms NNS can MD be VB fooled VVN by IN changing VVG the DT version NN information NN . SENT Some DT determined VVN and CC focused VVN attackers NNS might MD go VV to TO additional JJ lengths NNS to TO identify VV the DT server NN but CC the DT hurdles NNS that IN the DT attackers NNS have VHP to TO overcome VV have VHP increased VVN when WRB it's NNS more RBR difficult JJ to TO fingerprint NN the DT web NN server NN name NN and CC version NN . SENT Jeremiah NP Grossman NP pointed VVD out RP the DT other JJ school NN of IN thought NN . SENT Evasive JJ measures NNS are VBP futile JJ as IN any DT scanner NN targeting VVG a DT web NN site NN , , will MD normally RB not RB care VV what WP the DT web NN server NN is VBZ . SENT The DT scanner NN will MD run VV ALL PDT its PP$ tests NNS no DT matter NN if IN they PP apply VVP to TO the DT system NN or CC not RB . SENT This DT is VBZ a DT typical JJ shotgun NN approach NN . SENT A DT bad JJ guy NN targeting VVG the DT site NN might MD be VB hampered VVN by IN not RB knowing VVG the DT exact JJ version NN , , but CC if IN he's NNS determined VVD he PP would MD still RB try VV out RP all DT related JJ exploits NNS and CC try VVP to TO break VV in IN . SENT Testing VVG I PP want VVP to TO chain NN my PP$ proxy JJ tool NN with IN a DT proxy JJ server NN . SENT are VBP there RB tools NNS that WDT let VVP me PP do VVP that IN . SENT Yes UH , , there EX are VBP several JJ tools NNS that WDT allow VVP proxy NN chaining VVG . SENT Some DT of IN these DT are VBP . SENT WebScarab NN http NN . SENT www JJ . SENT owasp NN . SENT org NP development NN webscarab NN Exodus NN http NN . SENT home NN . SENT intekom NN . SENT com NN rdawes NNS exodus NN . SENT html NN Odysseus NN http NN . SENT www JJ . SENT wastelands NNS . SENT gen NN . SENT nz NP odysseus NP index NN . SENT php NP Can't NP web NN application NN testing NN be VB automated VVN . SENT Are VBP there RB any DT tools NNS for IN that DT . SENT There EX are VBP tools NNS that WDT scan VV applications NNS for IN security NN flaws NNS . SENT But CC these DT tools NNS can MD only RB look VV for IN a DT limited JJ number NN of IN vulnerabilities NNS , , and CC do VVP not RB find VV all PDT the DT problems NNS in IN the DT application NN . SENT Moreover RB , , a DT lot NN of IN attacks NNS require VVP understanding NN of IN the DT business NN context NN of IN the DT application NN to TO decide VV on IN the DT variables NNS to TO manipulate VV in IN a DT particular JJ request NN , , which WDT a DT tool NN is VBZ incapable JJ of IN doing VVG . SENT A DT presentation NN by IN Jeremiah NP Grossman NP of IN White NP Hat NN Security NN which WDT talks VVZ about IN the DT limitations NNS of IN automated JJ scanning VVG , , can MD be VB found VVN at IN http NN . SENT www JJ . SENT blackhat NN . SENT com NN presentations NNS bh NN federal JJ 03 CD bh NN fed VVN 03 CD grossman NP up RP . SENT pdf NN In IN our PP$ tests NNS using VVG a DT slightly RB modified VVN WebGoat NP the DT best RBS Black JJ box NN scanning VVG tool NN found VVD less JJR than IN 20 CD of IN the DT issues NNS . SENT Some DT tools NNS for IN automated JJ scanning VVG are VBP . SENT SpikeProxy NP , , open JJ source NN and CC freely RB available JJ at IN http NN . SENT www JJ . SENT immunitysec NN . SENT com NN spikeproxy NN . SENT html NP WebInspect NP , , can MD be VB found VVN at IN http NN . SENT www JJ . SENT spidynamics NNS . SENT com NN productline NN WE PP over RB . SENT html VV Where WRB can MD I PP try VV out RP my PP$ testing NN skills NNS . SENT Is VBZ there RB a DT sample NN application NN I PP can MD practice VV with IN . SENT OWASP NP provides VVZ a DT sample NN application NN that WDT can MD be VB used VVN for IN this DT purpose NN called VVD . SENT As IN the DT site NN says VVZ , , the DT WebGoat NP project's NN goal NN is VBZ to TO teach VV web NN security NN in IN an DT interactive JJ teaching NN environment NN . SENT There EX are VBP lessons NNS on IN most JJS of IN the DT common JJ vulnerabilities NNS . SENT Another DT interesting JJ site NN is VBZ Hackingzone NN which WDT has VHZ a DT game NN on IN SQL NP Injection NN at IN http NN . SENT www JJ . SENT hackingzone NN . SENT org NP sql NN index NN . SENT php NN Are VBP there RB source NN code NN scanning VVG tools NNS for IN . SENT NET JJ langauges NNS , , Java NP , , PHP NP etc NN that WDT predict VVP vulnerabilities NNS in IN the DT source NN code NN . SENT Rough JJ Auditing NN Tool NP for IN Security NP RATS NNS is VBZ a DT tool NN that WDT scans VVZ the DT source NN code NN for IN security NN flaws NNS in IN C NP , , C NP , , Python NN , , Perl NP and CC PHP NP programs NNS . SENT It PP can MD be VB found VVN at IN http NN . SENT www JJ . SENT securesoftware NN . SENT com NN download NN rats NNS . SENT htm NP FX NP Cop NN was VBD created VVN by IN the DT Microsoft NP Team NP at IN the DT GotDotNet NP community NN site NN to TO check VV for IN the DT . SENT NET JJ Frameowork NN guidelines NNS which WDT inlcude VV security NN . SENT Prexis NP is VBZ a DT commercial JJ source NN code NN and CC run VV time NN analzyer NN . SENT Flawfinder NP is VBZ a DT static JJ source NN code NN analzyer NN . SENT Compaq NP ESC NP is VBZ a DT run NN time NN analyzer NN for IN Java NP . SENT Parasoft NP AEP NP is VBZ a DT commercial JJ source NN code NN analyzer NN for IN Java NP . SENT We PP would MD like VV to TO know VV about IN more JJR tools NNS for IN scanning VVG source NN code NN . SENT If IN you PP know VVP about IN any DT , , please UH inform VV us PP and CC we'll NN add VVP to TO this DT FAQ NP Can MD non JJ HTTP NP protocols NNS also RB be VB intercepted VVN and CC played VVN with IN like IN this DT . SENT Yes UH , , Interactive JJ TCP NN Replay NN is VBZ a DT tool NN that WDT acts VVZ as IN a DT proxy NN for IN non JJ HTTP NP applications NNS and CC also RB allows VVZ modifying VVG the DT traffic NN . SENT It PP allows VVZ editing VVG of IN the DT messages NNS in IN a DT hex NN editor NN . SENT ITR NP also RB logs VVZ all PDT the DT messages NNS passing VVG between IN the DT client NN and CC the DT server NN . SENT It PP can MD use VV different JJ types NNS of IN character NN encoding VVG like IN ASCII NP or CC EBCDIC NP for IN editing VVG and CC logging VVG . SENT More JJR information NN on IN this DT can MD be VB found VVN at IN http NN . SENT www JJ . SENT webcohort NN . SENT com NN web NN application NN security NN research NN tools NNS . SENT html NN Cryptography NN SSL NN What WP is VBZ SSL NP . SENT Secure JJ Socket NN Layer NP SSL NP gives VVZ us PP assurance NN of IN two CD things NNS . SENT Firstly RB when WRB a DT client NN connects VVZ to TO a DT web NN server NN , , the DT client NN can MD be VB sure JJ that IN it PP is VBZ talking VVG to TO the DT right JJ server NN by IN checking VVG the DT certificate NN the DT server NN sends VVZ it PP . SENT Secondly RB , , SSL NP assures VVZ you PP of IN the DT confidentiality NN of IN the DT data NNS , , as IN the DT client NN and CC the DT server NN exchange NN encrypted VVD messages NNS that IN cannot NN be VB understood VVN by IN anybody NN else RB . SENT This DT is VBZ how WRB SSL NP works VVZ . SENT When WRB the DT client NN requests NNS for IN a DT SSL NP page NN , , the DT server NN sends VVZ a DT certificate NN that IN it PP has VHZ obtained VVN from IN a DT trusted VVN certificate NN authority NN . SENT This DT certificate NN contains VVZ the DT public JJ key NN of IN the DT server NN . SENT After IN satisfying VVG itself PP that IN the DT certificate NN is VBZ correct JJ and CC the DT server NN is VBZ a DT genuine JJ one NN , , the DT client NN generates VVZ one CD random JJ number NN , , the DT session NN key NN . SENT This DT key NN is VBZ encrypted VVN by IN the DT public JJ key NN of IN the DT server NN and CC sent VVD across RP . SENT The DT server NN decrypts VVZ the DT message NN with IN its PP$ private JJ key NN . SENT Now RB both DT sides NNS have VHP a DT session NN key NN known VVN only RB to TO the DT two CD of IN them PP . SENT All DT communication NN to TO and CC fro RB is VBZ encrypted VVN and CC decrypted VVN with IN the DT session NN key NN . SENT An DT interesting JJ link NN on IN SSL NP is VBZ http NN . SENT www JJ . SENT rsasecurity NN . SENT com NN standards NNS ssl NN basics NNS . SENT html NN Should MD I PP use VV 40 CD bit NN or CC 128 CD bit NN SSL NP . SENT There EX are VBP 2 CD strengths NNS in IN SSL NP 40 CD bit NN and CC 128 CD bit NN . SENT These DT refer VVP to TO the DT length NN of IN the DT secret JJ key NN used VVN for IN encrypting VVG the DT session NN . SENT This DT key NN is VBZ generated VVN for IN every DT SSL NP session NN and CC is VBZ used VVN to TO encrypt VV the DT rest NN of IN the DT session NN . SENT The DT longer RBR the DT key NN the DT more RBR difficult JJ it PP is VBZ to TO break VV the DT encrypted VVN data NNS . SENT So RB , , 128 CD bit NN encryption NN is VBZ much RB more RBR secure JJ than IN 40 CD bit NN . SENT Most JJS browsers NNS today NN support VVP 128 CD bit NN encryption NN . SENT There EX are VBP a DT few JJ countries NNS which WDT have VHP browsers NNS with IN only RB 40 CD bit NN support NN . SENT In IN case NN you PP are VBP using VVG 40 CD bit NN SSL NN , , you PP may MD need VV to TO take VV further JJR precautions NNS to TO protect VV sensitive JJ data NNS . SENT Salted VVD hash NN for IN transmitting VVG passwords NNS is VBZ a DT good JJ technique NN . SENT This DT ensures VVZ that IN the DT password NN can MD not RB be VB stolen VVN even RB if IN the DT SSL NP key NN is VBZ broken VVN . SENT Is VBZ 40 CD bit NN SSL NN really RB unsafe JJ . SENT 40 CD bit NN SSL NP is VBZ not RB really RB unsafe JJ . SENT It's NNS just RB that IN it PP is VBZ computationally RB feasible JJ to TO break VV the DT key NN used VVN in IN 40 CD bit NN but CC not RB the DT key NN used VVN in IN 128 CD bit NN . SENT Even RB though IN 40 CD bit NN can MD be VB broken VVN , , it PP takes VVZ a DT fairly RB large JJ number NN of IN computers NNS to TO break VV it PP . SENT Nobody NN would MD even RB attempt VV to TO do VV that IN for IN a DT credit NN card NN number NN or CC the DT like IN . SENT But CC there EX are VBP claims NNS of IN breaking VVG the DT 40 CD bit NN RC NP 4 CD key NN in IN a DT few JJ hours NNS . SENT So RB depending VVG on IN the DT data NN your PP$ application NN deals NNS with IN , , you PP can MD decide VV on IN the DT SSL NP strength NN . SENT Using VVG 128 CD bit NN is VBZ definitely RB safer JJR . SENT What WP all RB are VBP encrypted VVN when WRB I PP use VVP SSL NP . SENT Is VBZ the DT page NN request NN also RB encrypted VVN . SENT After IN the DT initial JJ SSL NP negotiation NN is VBZ done VVN and CC the DT connection NN is VBZ on IN HTTPS NP , , everything NN is VBZ encrypted VVN including VVG the DT page NN request NN . SENT So IN any DT data NNS sent VVN in IN the DT query NN string NN will MD also RB be VB encrypted VVN . SENT Which WDT cryptographic JJ algorithms NNS do VVP SSL NP use NN . SENT SSL NP supports VVZ a DT number NN of IN cryptographic JJ algorithms NNS . SENT During IN the DT initial JJ handshaking JJ phase NN , , it PP uses VVZ the DT RSA NP public JJ key JJ algorithm NN . SENT For IN encrypting VVG the DT data NNS with IN the DT session NN key NN the DT following VVG algorithms NNS are VBP used VVN RC NP 2 CD , , RC NP 4 CD , , IDEA NN , , DES NP , , triple JJ DES NP and CC MD NP 5 CD message NN digest VV algorithm NN . SENT I PP want VVP to TO use VV SSL NP . SENT Where WRB do VVP I PP begin VV . SENT There EX are VBP several JJ Certificate NN Authorities NNS that IN you PP can MD buy VV a DT SSL NP certificate NN from IN . SENT Whichever WDT CA MD you PP choose VV , , the DT basic JJ procedure NN will MD be VB as RB follows VVZ Create VV key JJ pair NN for IN the DT server NN Create VV the DT Certificate NN Signing NN Request NN . SENT This DT will MD require VV you PP to TO provide VV certain JJ details NNS like IN location NN and CC fully RB qualified VVN domain NN name NN of IN the DT server NN . SENT Submit VV the DT CSR NP to TO the DT CA MD along RB with IN documentary JJ proof NN of IN identity NN . SENT Install VV the DT certificate NN sent VVD by IN the DT CA MD The DT first JJ two CD steps NNS are VBP done VVN from IN the DT web NN server NN . SENT All DT servers NNS have VHP these DT features NNS . SENT While IN installing VVG the DT certificate NN issued VVN by IN the DT CA MD , , you PP will MD have VH to TO specify VV which WDT web NN pages NNS are VBP to TO be VB on IN SSL NP . SENT Cookies NNS and CC Session NP Management NP Are VBP there RB any DT risks NNS in IN using VVG persistent JJ vs NP non JJ persistent JJ cookies NNS . SENT Persistent JJ cookies NNS are VBP data NNS that IN a DT web NN site NN places NNS on IN the DT user's JJ hard JJ drive NN or CC equivalent NN for IN maintaining VVG information NN over IN more JJR than IN one CD browser NN session NN . SENT This DT data NNS will MD stay VV in IN the DT user's JJ system NN and CC can MD be VB accessed VVN by IN the DT site NN the DT next JJ time NN the DT user NN browses VVZ the DT site NN . SENT Non JJ persistent JJ cookies NNS on IN the DT other JJ hand NN are VBP those DT that WDT are VBP used VVN only RB in IN the DT browser NN session NN that WDT creates VVZ it PP . SENT They PP stay VVP only RB in IN the DT memory NN of IN the DT machine NN and CC are VBP not RB persisted VVD on IN the DT hard JJ disk NN . SENT The DT security NN risk NN with IN persistent JJ cookies NNS is VBZ that IN they PP are VBP generally RB stored VVN in IN a DT text NN file NN on IN the DT client NN and CC an DT attacker NN with IN access NN to TO the DT victim's JJ machine NN can MD steal VV this DT information NN . SENT Can MD another DT web NN site NN steal VV the DT cookies NNS that IN my PP$ site NN places NNS on IN a DT user's JJ machine NN . SENT No UH , , it PP is VBZ not RB possible JJ for IN a DT website NN to TO access VV another DT site's NNS cookies NNS . SENT Cookies NNS have VHP a DT domain NN attribute NN associated VVN with IN them PP . SENT Only RB a DT request NN coming VVG from IN the DT domain NN specified VVN in IN the DT attribute NN can MD access VV the DT cookie NN . SENT This DT attribute NN can MD have VH only RB one CD value NN . SENT Which WDT is VBZ the DT best JJS way NN to TO transmit VV session NN ids NNS in IN cookies NNS , , or CC URL NP or CC a DT hidden JJ variable NN . SENT Transmitting VVG session NN IDs NNS in IN the DT URL NP can MD lead VV to TO several JJ risks NNS . SENT Shoulder NN surfers NNS can MD see VV the DT session NN ID NN . SENT if IN the DT URL NP gets VVZ cached JJ on IN the DT client NN system NN , , the DT session NN ID NN will MD also RB be VB stored VVN . SENT the DT session NN ID NN will MD get VV stored VVN in IN the DT referrer NN logs VVZ of IN other JJ sites NNS . SENT Hidden JJ variables NNS are VBP not RB always RB practical JJ as IN every DT request NN might MD not RB be VB a DT POST NN . SENT Cookies NNS are VBP the DT safest JJS method NN as IN cookies NNS do VVP not RB get VV cached JJ , , are VBP not RB visible JJ in IN the DT W NP 3 CD C NP or CC referrer NN logs NNS , , and CC most JJS users NNS anyway RB accept VVP cookies NNS . SENT What WP are VBP these DT secure JJ cookies NNS . SENT A DT cookie NN can MD be VB marked VVN as IN secure JJ which WDT ensures VVZ the DT cookie NN is VBZ used VVN only RB over IN SSL NP sessions NNS . SENT If IN secure JJ is VBZ not RB specified VVN , , the DT cookie NN will MD be VB sent VVN unencrypted JJ over IN non JJ SSL NP channels NNS . SENT Sensitive JJ cookies NNS like IN session NN tokens NNS should MD be VB marked VVN as RB secure JJ if IN all DT pages NNS in IN the DT web NN site NN requiring VVG session NN tokens NNS are VBP SSL NP enabled VVD . SENT One CD thing NN to TO keep VV in IN mind NN here RB is VBZ that IN images NNS are VBP generally RB not RB downloaded JJ over IN SSL NP and CC they PP usually RB don't VVD require VV a DT session NN token JJ to TO be VB presented VVN . SENT By IN setting VVG the DT session NN cookie NN to TO be VB secure JJ , , we PP ensure VVP that IN the DT browser NN does VVZ not RB send VV the DT cookie NN while IN downloading VVG the DT image NN over IN the DT non JJ SSL NP connection NN . SENT If IN I PP use VVP a DT session NN ID NN that WDT is VBZ a DT function NN of IN the DT client's JJ IP NP address NN , , will MD session NN hijacking VVG be VB prevented VVN . SENT An DT attacker NN can MD hijack VV another DT user's JJ session NN by IN stealing VVG the DT session NN token JJ . SENT Methods NNS have VHP been VBN suggested VVN to TO prevent VV the DT session NN from IN being VBG hijacked VVN even RB if IN the DT session NN token JJ is VBZ stolen VVN . SENT For IN instance NN , , using VVG a DT session NN token JJ that WDT is VBZ a DT function NN of IN the DT user's JJ IP NP address NN . SENT In IN this DT approach NN , , even RB if IN the DT attacker NN stole VVD the DT token JJ , , he PP would MD need VV the DT same JJ IP NP address NN as IN the DT user NN to TO successfully RB hijack VV a DT session NN . SENT However RB , , session NN hijacking VVG can NN still RB be VB possible JJ . SENT Suppose VV the DT attacker NN is VBZ on IN the DT same JJ LAN NP as IN the DT user NN and CC uses VVZ the DT same JJ Proxy NN IP NP as IN the DT user NN to TO access VV the DT web NN site NN . SENT The DT attacker NN can MD still RB steal VV the DT session NN if IN he PP is VBZ able JJ to TO sniff VV the DT session NN token JJ . SENT It PP may MD also RB be VB not RB possible JJ to TO implement VV this DT if IN the DT IP NP of IN the DT client NN changes NNS during IN a DT session NN , , making VVG the DT session NN invalid JJ if IN the DT token JJ is VBZ tied VVN to TO the DT initial JJ IP NP address NN . SENT This DT may MD happen VV if IN the DT client NN is VBZ coming VVG from IN behind IN a DT bank NN of IN proxy JJ servers NNS . SENT How WRB about RB encrypting VVG the DT session NN id NN cookies NNS instead RB of IN using VVG SSL NP . SENT Encrypting VVG just RB the DT session NN ID NN over IN a DT non JJ SSL NP connection NN will MD not RB serve VV any DT purpose NN . SENT Since IN the DT session NN ID NN will MD be VB encrypted VVN once RB and CC the DT same JJ value NN will MD be VB sent VVN back RB and CC forth RB each DT time NN , , an DT attacker NN can MD use VV the DT encrypted VVN value NN to TO hijack VV the DT session NN . SENT What WP is VBZ the DT concept NN of IN using VVG a DT page NN id NN , , in IN addition NN to TO the DT session NN id NN . SENT A DT Session NP ID NN or CC token JJ has VHZ the DT lifetime NN of IN a DT session NN and CC is VBZ tied VVN to TO the DT logged VVN in IN user NN . SENT A DT page NN ID NN or CC token JJ has VHZ a DT lifetime NN of IN a DT page NN and CC is VBZ tied VVN to TO a DT page NN that WDT is VBZ served VVN . SENT It PP is VBZ a DT unique JJ token JJ given VVN when WRB a DT page NN is VBZ downloaded VVN and CC is VBZ presented VVN by IN the DT user NN when WRB accessing VVG the DT next JJ page NN . SENT The DT server NN expects VVZ a DT particular JJ value NN for IN the DT user NN to TO access VV the DT next JJ page NN . SENT Only RB if IN the DT token JJ submitted VVN matches NNS what WP the DT server NN is VBZ expecting VVG is VBZ the DT next JJ page NN served VVD . SENT An DT application NN can MD use VV this DT to TO ensure VV that IN a DT user NN accesses VVZ pages NNS only RB in IN the DT sequence NN determined VVN by IN the DT application NN . SENT The DT user NN cannot NN paste VV a DT deep JJ URL NN in IN the DT browser NN and CC skip VV pages NNS just RB because IN he PP has VHZ a DT session NN token JJ , , as IN the DT page NN token JJ would MD not RB be VB authorized VVN to TO access VV the DT deeper JJR URL NN directly RB . SENT Logging VVG and CC Audit NP Trails NNS What WP are VBP these DT W NP 3 CD C NP logs NNS . SENT W NP 3 CD C NP is VBZ a DT logging VVG format NN used VVN for IN Web NP server NN log NN files NNS . SENT W NP 3 CD C NP logs NNS record NN access NN details NNS of IN each DT request NN . SENT the DT timestamp NN , , source NN IP NP , , page NN requested VVD , , the DT method NN used VVD , , http NN protocol NN version NN , , browser NN type NN , , the DT referrer NN page NN , , the DT response NN code NN etc NN . SENT Note NN that IN these DT are VBP access NN logs NNS , , and CC so RB a DT separate JJ record NN is VBZ maintained VVN for IN each DT request NN . SENT When WRB a DT page NN with IN multiple JJ gif NN files NNS is VBZ downloaded JJ , , it PP would MD be VB recorded VVN as IN multiple JJ entries NNS in IN the DT W NP 3 CD C NP log NN . SENT so RB , , W NP 3 CD C NP logs NNS tend VVP to TO be VB voluminous JJ . SENT Do VVP I PP need VVP to TO have VH logging VVG in IN my PP$ application NN even RB if IN I've NP W NP 3 CD C NP logs NNS . SENT Yes UH , , it's NNS important JJ that IN your PP$ application NN maintains VVZ application NN level NN logs VVZ even RB when WRB W NP 3 CD C NP logging VVG is VBZ used VVN . SENT As IN W NP 3 CD C NP logs NNS contain VVP records NNS for IN every DT http NN request NN , , it PP is VBZ difficult JJ and CC , , at IN times NNS impossible JJ to TO extract VV a DT higher JJR level NN meaning VVG from IN these DT logs NNS . SENT For IN instance NN , , the DT W NP 3 CD C NP logs NNS are VBP cumbersome JJ to TO identify VV a DT specific JJ session NN of IN user NN and CC the DT activities NNS that IN the DT user NN performed VVD . SENT It's NNS better RBR that IN the DT application NN keeps VVZ a DT trail NN of IN important JJ activities NNS , , rather RB than IN decode VV it PP from IN W NP 3 CD C NP logs NNS . SENT What WP should MD I PP log VV from IN within IN my PP$ application NN . SENT Keep VV an DT audit NN trail NN of IN activity NN that IN you PP might MD want VV to TO review VV while IN troubleshooting NN or CC conducting VVG forensic JJ analysis NN . SENT Please UH note NN that IN it PP is VBZ inadvisable JJ to TO keep VV sensitive JJ business NN information NN itself PP in IN these DT logs NNS , , as IN administrators NNS have VHP access NN to TO these DT logs NNS for IN troubleshooting NN . SENT Activities NNS commonly RB kept VVD track NN of IN are VBP . SENT Login NN and CC logout NN of IN users NNS Critical JJ transactions NNS eg NN . SENT fund NN transfer NN across IN accounts NNS Failed VVD login NN attempts NNS Account NP lockouts NNS Violation NN of IN policies NNS The DT data NN that WDT is VBZ logged VVN for IN each DT of IN these DT activities NNS usually RB include VVP . SENT User NN ID NN Time NP stamp NN Source NN IP NP Error NN codes NNS , , if IN any DT Priority NN Should MD I PP encrypt VV my PP$ logs NNS . SENT Isn't NN that IN a DT performance NN hit VVD . SENT Encryption NN is VBZ required VVN when WRB information NN has VHZ to TO be VB protected VVN from IN being VBG read VVN by IN unauthorized JJ users NNS . SENT Yes UH , , encryption NN does VVZ take VV a DT performance NN hit NN , , so RB if IN your PP$ logs NNS do VVP not RB contain VV sensitive JJ information NN you PP might MD want VV to TO forego VV encryption NN . SENT However RB , , we PP strongly RB urge VVP that IN you PP protect VV your PP$ logs NNS from IN being VBG tampered VVN by IN using VVG digital JJ signatures NNS . SENT Digital NP signatures NNS are VBP less JJR processor NN intensive JJ than IN encryption NN and CC ensure VV that IN your PP$ logs NNS are VBP not RB tampered VVN . SENT Can MD I PP trust VV the DT IP NP address NN of IN a DT user NN I PP see VVP in IN my PP$ audit NN logs NNS . SENT Could MD a DT user NN be VB spoofing VVG impersonating VVG their PP$ IP NP address NN . SENT A DT bad JJ guy NN who WP wants VVZ to TO hide VV his PP$ actual JJ IP NP address NN might MD use VV a DT service NN like IN anonymizer NN , , or CC use VV open JJ HTTP NP relays NNS . SENT HTTP JJ open JJ relays NNS are VBP improperly RB configured VVN web NN servers NNS on IN the DT web NN that WDT are VBP used VVN as IN a DT HTTP NP proxy NN to TO connect VV to TO other JJ sites NNS . SENT In IN such JJ cases NNS , , the DT IP NP address NN you PP see VVP in IN your PP$ log NN files NNS will MD be VB those DT of IN these DT services NNS or CC the DT open JJ relay NN that WDT is VBZ being VBG used VVN . SENT So RB , , the DT IP NP address NN you PP see VVP in IN your PP$ log NN files NNS might MD not RB always RB be VB trustworthy JJ . SENT Miscellaneous JJ What WP are VBP application NN firewalls NNS . SENT How WRB good JJ are VBP they PP really RB . SENT Application NN firewalls NNS analyze VVP the DT requests NNS at IN the DT application NN level NN . SENT These DT firewalls NNS are VBP used VVN for IN specific JJ applications NNS like IN a DT web NN server NN or CC a DT database NN server NN . SENT The DT web NN application NN firewalls NNS protect VVP the DT web NN server NN from IN HTTP NP based VVN attacks NNS . SENT They PP monitor VVP the DT requests NNS for IN attacks NNS that WDT involve VVP SQL NP Injection NN , , XSS NP , , URL NP encoding VVG etcetera NN . SENT But CC they PP are VBP not RB able JJ to TO protect VV against IN attacks NNS that WDT require VVP understanding NN of IN the DT business NN context NN this DT includes VVZ most JJS attacks NNS that WDT rely VVP on IN variable JJ manipulation NN . SENT However RB , , application NN layer NN firewalls NNS cannot NN protect VV attacks NNS that WDT require VVP the DT logic NN of IN the DT application NN to TO be VB understood VVN to TO protect VV against IN . SENT Some DT application NN firewalls NNS are VBP . SENT Netcontinuum's NP NC NP 1000 CD Kavado NP Inc NP . SENT s PP InterDo NP Teros NP Inc NP . SENT s PP Teros NP 100 NP APS NP What WP is VBZ all RB this DT about RB referrer JJR logs NNS , , and CC sensitive JJ URLs NNS . SENT The DT HTTP NP header NN contains VVZ a DT field NN known VVN as IN Referrer NP . SENT For IN visiting VVG a DT web NN page NN we PP may MD either RB . SENT Type NN its PP$ URL NN directly RB into IN the DT address NN bar NN of IN the DT browser NN Click NP a DT link NN on IN some DT other JJ page NN that WDT brings VVZ us PP there RB Be VB redirected VVN there RB by IN some DT page NN . SENT In IN the DT first JJ case NN , , the DT referrer NN field NN will MD be VB empty JJ but CC in IN the DT other JJ two CD cases NNS it PP will MD contain VV the DT URL NN of IN the DT previous JJ page NN . SENT The DT URL NN of IN the DT first JJ page NN will MD get VV stored VVN in IN the DT web NN server NN access NN logs VVZ of IN the DT second JJ page NN when WRB the DT user NN reaches VVZ the DT second JJ page NN from IN the DT first JJ page NN . SENT Now RB suppose VVP , , the DT two CD pages NNS belong VVP to TO different JJ sites NNS and CC the DT first JJ URL NN contains VVZ sensitive JJ information NN like IN a DT user's JJ session NN ID NN . SENT If IN the DT second JJ site NN belongs VVZ to TO attackers NNS , , they PP can MD obtain VV this DT information NN by IN just RB going VVG through IN the DT logs NNS . SENT Information NN in IN the DT URLs NP will MD get VV stored VVN in IN the DT referrer NN logs VVZ as RB well RB as IN the DT history NN of IN the DT browser NN . SENT Therefore RB , , we PP should MD be VB careful JJ not RB to TO have VH any DT sensitive JJ information NN in IN the DT URL NN . SENT I PP want VVP to TO use VV the DT most RBS secure JJ language NN . SENT which WDT language NN do VVP you PP recommend VVP . SENT Any DT language NN can MD be VB used VVN since IN secure JJ programming NN practices NNS are VBP what WP make VVP applications NNS safe JJ . SENT Most JJS security NN techniques NNS can MD be VB implemented VVN in IN any DT language NN . SENT Our PP$ advice NN would MD be VB to TO use VV any DT language NN you PP are VBP comfortable JJ with IN . SENT But CC some DT languages NNS like IN Java NP have VHP additional JJ features NNS like IN bind NN variables NNS that IN aid NN security NN . SENT you PP could MD use VV those DT additional JJ features NNS if IN you PP decide VVP to TO program VV in IN that DT language NN . SENT What WP are VBP the DT good JJ books NNS to TO learn VV secure JJ programming NN practices NNS . SENT The DT OWASP NP Guide NP to TO Building NP Secure JJ Web NP Application NN and CC Web NP Services NPS is VBZ a DT good JJ guide NN for IN web NN application NN developers NNS . SENT You PP can MD download VV it PP from IN http NN . SENT www JJ . SENT owasp NN . SENT org NP documentation NN guide NN Writing VVG Secure JJ Code NP by IN Michael NP Howard NP and CC David NP LeBlanc NP has VHZ a DT chapter NN on IN Securing VVG Web NP Based VVN Services NP . SENT More JJR information NN on IN this DT book NN can MD be VB found VVN at IN . SENT http NN . SENT www JJ . SENT microsoft NP . SENT com NN mspress NN books NNS toc NN 5612 CD . SENT asp NN Secure JJ Programming NN for IN Linux NP and CC Unix NP HOWTO NP by IN David NP Wheeler NP talks NNS about IN writing VVG secure JJ applications NNS including VVG web NN applications NNS . SENT it PP also RB specifies VVZ guidance NN for IN a DT number NN of IN languages NNS . SENT The DT book NN can MD be VB found VVN at IN . SENT http NN . SENT www JJ . SENT dwheeler NN . SENT com NN secure JJ programs NNS Are VBP there RB any DT training NN programs NNS on IN secure JJ programming NN that IN I PP can MD attend VV . SENT Microsoft NP offers VVZ training NN programs NNS on IN Developing VVG Security NN Enhanced VVN Web NP Applications NP and CC Developing VVG and CC Deploying VVG Secure JJ Microsoft NP . SENT NET JJ Framework NN Application NN . SENT More JJR information NN can MD be VB found VVN at IN http NN . SENT www JJ . SENT microsoft NP . SENT com NN traincert NN syllabi NN 2300 CD AFinal NN . SENT asp NN and CC http NN . SENT www JJ . SENT microsoft NP . SENT com NN traincert NN syllabi NN 2350 CD BFinal NP . SENT asp NN Foundstone NN offers VVZ secure JJ coding VVG training NN through IN Global JJ Knowledge NN Aspect NN Security NP offers VVZ a DT similar JJ course NN . SENT OWASP NP FAQ NP Ver NP 3 CD . SENT doc NN 2005 CD The DT OWASP NP Foundation NP Contact NP the DT site NN admin NN with IN comments NNS questions NNS concerning VVG this DT site NN . SENT