Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Web Application Security
Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 16 2004 01:13AM
Thomas Schreiber (ts securenet de) (7 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 05:17PM
Elihu Smails (elihusmails2000 yahoo com) (5 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 01:37PM
Joseph Miller (joseph tidetamerboatlifts com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 01:37PM
Joseph Miller (joseph tidetamerboatlifts com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 07:20AM
Sverre H. Huseby (shh thathost com) (1 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 06:47PM
Elihu Smails (elihusmails2000 yahoo com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 07:20AM
Sverre H. Huseby (shh thathost com) (1 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 06:47PM
Elihu Smails (elihusmails2000 yahoo com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 03:00PM
Eran Tromer (webapp2eran tromer org) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 05:47PM
Florian Weimer (fw deneb enyo de) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:12PM
Eran Tromer (webapp2eran tromer org) (3 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:30PM
Eran Tromer (webapp2eran tromer org)
On 12/22/2004 10:12 PM, Eran Tromer wrote:
> On 12/22/2004 07:47 PM, Florian Weimer wrote:
>> The HMAC input should also cover a time-dependent value sent along in the
>> clear (which is later used to check the token for freshness). A form
>> identifier could also be helpful.
>
> [snip]
> The timestamp and (in some cases) the form identifier needed to be sent
> as extra parameters, which can get rather ugly when using GET requests.

On second thought, what you need is not a form (source) identifier, but
rather an action (target) identifier. The action is necessarily
deducible from the rest of HTTP request, so there's no good reason not
to add it to the hash. Ideally, one would hash in all parts of the
target URL and all POST parameters that are known at the time the source
page is sent (except the token itself).

Eran

[ reply ]
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:30PM
Eran Tromer (webapp2eran tromer org)
On 12/22/2004 10:12 PM, Eran Tromer wrote:<br/>
> On 12/22/2004 07:47 PM, Florian Weimer wrote:<br/>
>> The HMAC input should also cover a time-dependent value sent along in the<br/>
>> clear (which is later used to check the token for freshness). A form<br/>
>> identifier could also be helpful.<br/>
> <br/>
> [snip]<br/>
> The timestamp and (in some cases) the form identifier needed to be sent<br/>
> as extra parameters, which can get rather ugly when using GET requests.<br/>
<br/>
On second thought, what you need is not a form (source) identifier, but <br/>
rather an action (target) identifier. The action is necessarily <br/>
deducible from the rest of HTTP request, so there's no good reason not <br/>
to add it to the hash. Ideally, one would hash in all parts of the <br/>
target URL and all POST parameters that are known at the time the source <br/>
page is sent (except the token itself).<br/>
<br/>
Eran

[ reply ]
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:12PM
Eran Tromer (webapp2eran tromer org) (1 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 03:00PM
Eran Tromer (webapp2eran tromer org) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 05:47PM
Florian Weimer (fw deneb enyo de) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:12PM
Eran Tromer (webapp2eran tromer org) (3 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:30PM
Eran Tromer (webapp2eran tromer org)
On 12/22/2004 10:12 PM, Eran Tromer wrote:<br/><br/>
> On 12/22/2004 07:47 PM, Florian Weimer wrote:<br/><br/>
>> The HMAC input should also cover a time-dependent value sent along in the<br/><br/>
>> clear (which is later used to check the token for freshness). A form<br/><br/>
>> identifier could also be helpful.<br/><br/>
> <br/><br/>
> [snip]<br/><br/>
> The timestamp and (in some cases) the form identifier needed to be sent<br/><br/>
> as extra parameters, which can get rather ugly when using GET requests.<br/><br/>
<br/><br/>
On second thought, what you need is not a form (source) identifier, but <br/><br/>
rather an action (target) identifier. The action is necessarily <br/><br/>
deducible from the rest of HTTP request, so there's no good reason not <br/><br/>
to add it to the hash. Ideally, one would hash in all parts of the <br/><br/>
target URL and all POST parameters that are known at the time the source <br/><br/>
page is sent (except the token itself).<br/><br/>
<br/><br/>
Eran

[ reply ]
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:30PM
Eran Tromer (webapp2eran tromer org)
On 12/22/2004 10:12 PM, Eran Tromer wrote:<br/><br/><br/>
> On 12/22/2004 07:47 PM, Florian Weimer wrote:<br/><br/><br/>
>> The HMAC input should also cover a time-dependent value sent along in the<br/><br/><br/>
>> clear (which is later used to check the token for freshness). A form<br/><br/><br/>
>> identifier could also be helpful.<br/><br/><br/>
> <br/><br/><br/>
> [snip]<br/><br/><br/>
> The timestamp and (in some cases) the form identifier needed to be sent<br/><br/><br/>
> as extra parameters, which can get rather ugly when using GET requests.<br/><br/><br/>
<br/><br/><br/>
On second thought, what you need is not a form (source) identifier, but <br/><br/><br/>
rather an action (target) identifier. The action is necessarily <br/><br/><br/>
deducible from the rest of HTTP request, so there's no good reason not <br/><br/><br/>
to add it to the hash. Ideally, one would hash in all parts of the <br/><br/><br/>
target URL and all POST parameters that are known at the time the source <br/><br/><br/>
page is sent (except the token itself).<br/><br/><br/>
<br/><br/><br/>
Eran

[ reply ]
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 08:12PM
Eran Tromer (webapp2eran tromer org) (1 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 17 2004 08:36AM
Philippe P. (webappsec philippe prados name) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 02:44PM
Joseph Miller (joseph tidetamerboatlifts com) (1 replies)
RE: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 16 2004 10:40PM
Yvan G.J. Boily (yboily seccuris com) (2 replies)
RE: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 05:56PM
Mark Burnett (mb xato net) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 04:31PM
Jeff Williams (jeff williams aspectsecurity com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 04:31PM
Jeff Williams (jeff williams aspectsecurity com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
RE: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 16 2004 10:40PM
Yvan G.J. Boily (yboily seccuris com) (2 replies)
RE: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 20 2004 05:56PM
Mark Burnett (mb xato net) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 04:31PM
Jeff Williams (jeff williams aspectsecurity com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 21 2004 04:31PM
Jeff Williams (jeff williams aspectsecurity com) (2 replies)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 22 2004 07:46PM
Augusto Paes de Barros (apbarros gmail com)
Re: Whitepaper "SESSION RIDING - A Widespread Vulnerability in Today's Web Applications" Dec 16 2004 05:08PM
Sverre H. Huseby (shh thathost com) (1 replies)







 

Privacy Statement
Copyright 2009, SecurityFocus