Re: [WebDNA] preventing hackers from posting their own (altered)

This WebDNA talk-list message is from

2009


It keeps the original formatting.
numero = 102025
interpreted = N
texte = This is a cryptographically signed message in MIME format. --------------ms070702080709080800070401 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I agree with Donovan. A hidden field is as misconception, it's not really hidden, just not visible in a browser. Any hacker worth his salt attempting to "hack" a form post will look at the "hidden" fields first and they are quite easy to spoof. Using an encrypted value with a seed will most certainly stop them in their tracks. I've used that method for years without incident... Marc Donovan Brooke wrote: > Govinda wrote: >> Thanks Gary, >> >> well I had just assumed that [REFERRER] would not get set to the >> actual referring URL when reaching the template with that tag in it >> because of this line from the docs: >> "...Note: this will not work if the previous page was a FORM >> METHOD="POST". " >> But after seeing your post here I tried it and it seems to work fine, >> even with method=post. (why do the docs say that?) >> Assuming [referrer] is reliable in this situation, then I can just >> check against the evaluated tag's value itself.. (and not against an >> incoming hidden input). If I used a hidden input the way you suggest >> then what stops a user from creating a version of the form with a >> hidden input whose value is set to whatever he wants. (including what >> I would have stuffed in there with the [referrer] tag's value?) >> >> -G > > > > I would suggest to encrypt a hidden value with a seed... then decrypt on > the receiving end to do a match to a static or admin controlled > variable. Referrer is not reliable in all situations because of proxies. > > Donovan > > -- ------------------------------------------- Marc Thompson Software Engineer Office of Information Technology University of Utah 801.585.9264 marc.thompson@utah.edu ------------------------------------------- --------------ms070702080709080800070401 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIIFzCC AmYwggHPoAMCAQICEHaSCub5fHf1qFiROTURT3UwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UE BhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA5MDIxMzIwMjAxOVoX DTEwMDIxMzIwMjAxOVowSjEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEnMCUG CSqGSIb3DQEJARYYbXRob21wc29uQG1lZGlhLnV0YWguZWR1MIGfMA0GCSqGSIb3DQEBAQUA A4GNADCBiQKBgQC6QZuGW+lM68PiNJakaJKiM0oUeJBHX/ygyAAPZ/A+o51YkgQBxz0HMtOL 9ny/Bz16/OWw/rGFQBV+T4Y03aGsa/Q7IDxS53rN2DSmYVSJkesjpAO4B8Ud3grqy2XMKAKT 2e8/vTwWbE/kIyOtcjeWYpP9ASVUidEPRo4yTM1zVwIDAQABozUwMzAjBgNVHREEHDAagRht dGhvbXBzb25AbWVkaWEudXRhaC5lZHUwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOB gQC3NQryCLgzcsAX+7pwymoLBpvqdswI+vA9fIRhv15SXeON5d3RFk6ifWl6FWopm5Zz1gpi eqcqLaMu3qE0x7YThsYqGwVKaazyCJtJxKo/pfg5mmODWmqpnGx1c42hbtVdZzxEIIh29r0d V88PHR/rPzus5UV64CAm76bPTxizwTCCAmYwggHPoAMCAQICEHaSCub5fHf1qFiROTURT3Uw DQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0 aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1 aW5nIENBMB4XDTA5MDIxMzIwMjAxOVoXDTEwMDIxMzIwMjAxOVowSjEfMB0GA1UEAxMWVGhh d3RlIEZyZWVtYWlsIE1lbWJlcjEnMCUGCSqGSIb3DQEJARYYbXRob21wc29uQG1lZGlhLnV0 YWguZWR1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6QZuGW+lM68PiNJakaJKiM0oU eJBHX/ygyAAPZ/A+o51YkgQBxz0HMtOL9ny/Bz16/OWw/rGFQBV+T4Y03aGsa/Q7IDxS53rN 2DSmYVSJkesjpAO4B8Ud3grqy2XMKAKT2e8/vTwWbE/kIyOtcjeWYpP9ASVUidEPRo4yTM1z VwIDAQABozUwMzAjBgNVHREEHDAagRhtdGhvbXBzb25AbWVkaWEudXRhaC5lZHUwDAYDVR0T AQH/BAIwADANBgkqhkiG9w0BAQUFAAOBgQC3NQryCLgzcsAX+7pwymoLBpvqdswI+vA9fIRh v15SXeON5d3RFk6ifWl6FWopm5Zz1gpieqcqLaMu3qE0x7YThsYqGwVKaazyCJtJxKo/pfg5 mmODWmqpnGx1c42hbtVdZzxEIIh29r0dV88PHR/rPzus5UV64CAm76bPTxizwTCCAz8wggKo oAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0 ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRp bmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMT G1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwt ZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIx CzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSww KgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG 9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6 YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+ uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTASBgNV HRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3RlLmNv bS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzR UIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6E sZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341Yh eILcIRk13iSx0x1G/11fZU8xggLjMIIC3wIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u YWwgRnJlZW1haWwgSXNzdWluZyBDQQIQdpIK5vl8d/WoWJE5NRFPdTAJBgUrDgMCGgUAoIIB wzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wOTAyMTkxNzUw MDdaMCMGCSqGSIb3DQEJBDEWBBReqmNM5YerfKAXyHZKKxl4j4KFGDBSBgkqhkiG9w0BCQ8x RTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMC BzANBggqhkiG9w0DAgIBKDCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQGEwJaQTElMCMG A1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBl cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEHaSCub5fHf1qFiROTURT3UwgYcGCyqGSIb3 DQEJEAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vpbmcg Q0ECEHaSCub5fHf1qFiROTURT3UwDQYJKoZIhvcNAQEBBQAEgYC4O6cYmE9TW/6gCZgj6qLq +9xc2/x+mfjUKQV545+exJy7W4S+26XXqRsK65aw3gSWBJ0l1BpaMVld8zgDHdc4BaC6c68m OPSeVvmBPqDtffQZ8ylv9Zxdi8YFhua4RuOJoHvOBI08ZMPc4bLsXu4VY4TnwBpprT/dB9uK ZyQ+fwAAAAAAAA== --------------ms070702080709080800070401-- Associated Messages, from the most recent to the oldest:

    
  1. Re: [WebDNA] preventing hackers from posting their own (altered) version of my form? (Stuart Tremain 2009)
  2. Re: [WebDNA] preventing hackers from posting their own (altered) (Donovan Brooke 2009)
  3. Re: [WebDNA] preventing hackers from posting their own (altered) (Donovan Brooke 2009)
  4. Re: [WebDNA] preventing hackers from posting their own (altered) version of my form? (Toby Cox 2009)
  5. Re: [WebDNA] preventing hackers from posting their own (altered) version of my form? (Govinda 2009)
  6. Re: [WebDNA] preventing hackers from posting their own (altered) (Donovan Brooke 2009)
  7. Re: [WebDNA] preventing hackers from posting their own (altered) (Marc Thompson 2009)
  8. Re: [WebDNA] preventing hackers from posting their own (altered) version of my form? (Bob Minor 2009)
  9. Re: [WebDNA] preventing hackers from posting their own (altered) (Marc Thompson 2009)
  10. Re: [WebDNA] preventing hackers from posting their own (altered) (Donovan Brooke 2009)
  11. Re: [WebDNA] preventing hackers from posting their own (altered) version of my form? (Govinda 2009)
  12. [WebDNA] preventing hackers from posting their own (altered) version of my form? (Govinda 2009)
This is a cryptographically signed message in MIME format. --------------ms070702080709080800070401 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit I agree with Donovan. A hidden field is as misconception, it's not really hidden, just not visible in a browser. Any hacker worth his salt attempting to "hack" a form post will look at the "hidden" fields first and they are quite easy to spoof. Using an encrypted value with a seed will most certainly stop them in their tracks. I've used that method for years without incident... Marc Donovan Brooke wrote: > Govinda wrote: >> Thanks Gary, >> >> well I had just assumed that [referrer] would not get set to the >> actual referring URL when reaching the template with that tag in it >> because of this line from the docs: >> "...Note: this will not work if the previous page was a FORM >> METHOD="POST". " >> But after seeing your post here I tried it and it seems to work fine, >> even with method=post. (why do the docs say that?) >> Assuming [referrer] is reliable in this situation, then I can just >> check against the evaluated tag's value itself.. (and not against an >> incoming hidden input). If I used a hidden input the way you suggest >> then what stops a user from creating a version of the form with a >> hidden input whose value is set to whatever he wants. (including what >> I would have stuffed in there with the [referrer] tag's value?) >> >> -G > > > > I would suggest to encrypt a hidden value with a seed... then decrypt on > the receiving end to do a match to a static or admin controlled > variable. Referrer is not reliable in all situations because of proxies. > > Donovan > > -- ------------------------------------------- Marc Thompson Software Engineer Office of Information Technology University of Utah 801.585.9264 marc.thompson@utah.edu ------------------------------------------- --------------ms070702080709080800070401 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIIFzCC AmYwggHPoAMCAQICEHaSCub5fHf1qFiROTURT3UwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UE BhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA5MDIxMzIwMjAxOVoX DTEwMDIxMzIwMjAxOVowSjEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEnMCUG CSqGSIb3DQEJARYYbXRob21wc29uQG1lZGlhLnV0YWguZWR1MIGfMA0GCSqGSIb3DQEBAQUA A4GNADCBiQKBgQC6QZuGW+lM68PiNJakaJKiM0oUeJBHX/ygyAAPZ/A+o51YkgQBxz0HMtOL 9ny/Bz16/OWw/rGFQBV+T4Y03aGsa/Q7IDxS53rN2DSmYVSJkesjpAO4B8Ud3grqy2XMKAKT 2e8/vTwWbE/kIyOtcjeWYpP9ASVUidEPRo4yTM1zVwIDAQABozUwMzAjBgNVHREEHDAagRht dGhvbXBzb25AbWVkaWEudXRhaC5lZHUwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOB gQC3NQryCLgzcsAX+7pwymoLBpvqdswI+vA9fIRhv15SXeON5d3RFk6ifWl6FWopm5Zz1gpi eqcqLaMu3qE0x7YThsYqGwVKaazyCJtJxKo/pfg5mmODWmqpnGx1c42hbtVdZzxEIIh29r0d V88PHR/rPzus5UV64CAm76bPTxizwTCCAmYwggHPoAMCAQICEHaSCub5fHf1qFiROTURT3Uw DQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0 aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1 aW5nIENBMB4XDTA5MDIxMzIwMjAxOVoXDTEwMDIxMzIwMjAxOVowSjEfMB0GA1UEAxMWVGhh d3RlIEZyZWVtYWlsIE1lbWJlcjEnMCUGCSqGSIb3DQEJARYYbXRob21wc29uQG1lZGlhLnV0 YWguZWR1MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6QZuGW+lM68PiNJakaJKiM0oU eJBHX/ygyAAPZ/A+o51YkgQBxz0HMtOL9ny/Bz16/OWw/rGFQBV+T4Y03aGsa/Q7IDxS53rN 2DSmYVSJkesjpAO4B8Ud3grqy2XMKAKT2e8/vTwWbE/kIyOtcjeWYpP9ASVUidEPRo4yTM1z VwIDAQABozUwMzAjBgNVHREEHDAagRhtdGhvbXBzb25AbWVkaWEudXRhaC5lZHUwDAYDVR0T AQH/BAIwADANBgkqhkiG9w0BAQUFAAOBgQC3NQryCLgzcsAX+7pwymoLBpvqdswI+vA9fIRh v15SXeON5d3RFk6ifWl6FWopm5Zz1gpieqcqLaMu3qE0x7YThsYqGwVKaazyCJtJxKo/pfg5 mmODWmqpnGx1c42hbtVdZzxEIIh29r0dV88PHR/rPzus5UV64CAm76bPTxizwTCCAz8wggKo oAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0 ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRp bmcxKDAmBgNVBAsTH0NlcnRpZmljYXRpb24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMT G1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwt ZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIx CzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSww KgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG 9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6 YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+ uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTASBgNV HRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3RlLmNv bS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAg pB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzR UIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6E sZkbAMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341Yh eILcIRk13iSx0x1G/11fZU8xggLjMIIC3wIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQK ExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29u YWwgRnJlZW1haWwgSXNzdWluZyBDQQIQdpIK5vl8d/WoWJE5NRFPdTAJBgUrDgMCGgUAoIIB wzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wOTAyMTkxNzUw MDdaMCMGCSqGSIb3DQEJBDEWBBReqmNM5YerfKAXyHZKKxl4j4KFGDBSBgkqhkiG9w0BCQ8x RTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMC BzANBggqhkiG9w0DAgIBKDCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQGEwJaQTElMCMG A1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBl cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEHaSCub5fHf1qFiROTURT3UwgYcGCyqGSIb3 DQEJEAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vpbmcg Q0ECEHaSCub5fHf1qFiROTURT3UwDQYJKoZIhvcNAQEBBQAEgYC4O6cYmE9TW/6gCZgj6qLq +9xc2/x+mfjUKQV545+exJy7W4S+26XXqRsK65aw3gSWBJ0l1BpaMVld8zgDHdc4BaC6c68m OPSeVvmBPqDtffQZ8ylv9Zxdi8YFhua4RuOJoHvOBI08ZMPc4bLsXu4VY4TnwBpprT/dB9uK ZyQ+fwAAAAAAAA== --------------ms070702080709080800070401-- Marc Thompson

DOWNLOAD WEBDNA NOW!

Top Articles:

Talk List

The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...

Related Readings:

[/application] error? (1997) Incrementing a number (1998) customers getting same cart (2004) Sku numbers (1997) [Replace] really replaces? (2000) Re:multiple digests, please stop (1997) # fields limited? (1997) shown next / show prev (1998) RE: shrink-wrapped version out yet? (1997) Separate SSL Server (1997) [TCPConnect] questions/problems (2001) Separate server for jpg/gif files (1998) [include ...] behavior (1997) SMSI: databases corrupted on crash and permission issuesonOSX (2002) WebCat2 - Getting to the browser's username/password data (1997) Protect vs Authenicate (1997) [WebDNA] WebDNA.us site speed (2011) [convertChars] and in a textarea on a form (1998) [WebDNA] Secure Cookies (2020) The beginning (1997)