QuestionQ194
Exploiting Insecure Web Application ReferencesMany of the company’s customers have complained that their web-forum accounts were compromised, and you have been asked to investigate. After creating an account as a normal user and signing in to the application, you try to add a new post and use Webscarab to intercept the request your browser sends to the web server. The intercepted request appears below. Which measure would you recommend to prevent end-user application-level manipulation of accounts?
GET http://192.168.56.101:80/index.php?action=add_event&id=15 HTTP/1.0
User-Agent: Opera/9.80 (X11; Linux x86_64; U; en) Presto/2.8.131 Version/11.11
Host: 192.168.56.101 -
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: en-US, en;q=0.9
Accept-Encoding: gzip, deflate -
Referer: http://192.168.56.101/index.php
Cookie: SESSIONID=1232; logged_in=1; user_id=123
Proxy-Connection: Keep-Alive -
- A Apply a timestamp within the SESSIONID variable and digitally sign or hash it to ensure its integrity.
- B Use POST instead of GET requests, to avoid sending parameters in URLs that can be manipulated.
- C Enforce SSL encryption to prevent sniffing of the users' credentials.
- D Use client-side filtering of user-supplied data to prevent tampered input from reaching the server.
Community Discussion