Comments on: Faking the unexpected http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/ A tool for designers dealing with programmers dealing with designers... Sun, 14 Mar 2010 20:33:58 +0000 http://wordpress.org/?v=2.6.2 By: Gareth Heyes http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-1204 Gareth Heyes Fri, 11 Apr 2008 10:18:16 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-1204 Yeah Stefan rocks :) He has a book? Is it in English? I'd be interested if you could provide a link. Yeah Stefan rocks :)
He has a book? Is it in English? I’d be interested if you could provide a link.

]]> By: Handy http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-1203 Handy Thu, 10 Apr 2008 23:31:10 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-1203 Nice example. Stefan Esser describes this problem very good in his book about PHP security. By the way, he is the guy, who worked in the PHP Security Response Team. Nice example. Stefan Esser describes this problem very good in his book about PHP security. By the way, he is the guy, who worked in the PHP Security Response Team.

]]> By: zhaiduo http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-977 zhaiduo Wed, 05 Dec 2007 05:44:49 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-977 yep, you are right! yep, you are right!

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-973 Gareth Heyes Mon, 03 Dec 2007 09:06:38 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-973 @Jack You need to filter all user supplied data including User-agent etc and I have mentioned many times before how to do this. The article was to highlight the amount of times I've seen PHP code with just $userip = $_SERVER['HTTP_X_FORWARDED_FOR']; and blindly trusting it. @Jack

You need to filter all user supplied data including User-agent etc and I have mentioned many times before how to do this. The article was to highlight the amount of times I’ve seen PHP code with just $userip = $_SERVER['HTTP_X_FORWARDED_FOR']; and blindly trusting it.

]]> By: Jack http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-972 Jack Mon, 03 Dec 2007 08:47:17 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-972 Hello, This article is very good, but gives no viable alternative. Why ? Jack Hello,

This article is very good, but gives no viable alternative. Why ?

Jack

]]> By: Gareth Heyes http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-969 Gareth Heyes Sun, 02 Dec 2007 19:58:18 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-969 @Awesome AnDrEw You must be feeling smug right now :) I wonder how many feel sick :) @Awesome AnDrEw

You must be feeling smug right now :)

I wonder how many feel sick :)

]]> By: Skip Chris http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-968 Skip Chris Sun, 02 Dec 2007 19:45:08 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-968 In my limited 'developer' way, rather than as a webappsec professional, this is one of those things I see all the time, the key culprit being _SERVER['PHP_SELF']... :S Another common one (though a bit more obvious and less related to this post) is something along the lines of: www.example.org/controller/action ---> <form action="<? echo $action; ?>"> In my limited ‘developer’ way, rather than as a webappsec professional, this is one of those things I see all the time, the key culprit being _SERVER['PHP_SELF']… :S

Another common one (though a bit more obvious and less related to this post) is something along the lines of:
http://www.example.org/controller/action
—>
<form action=”<? echo $action; ?>”>

]]> By: Andrew MacFie http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-967 Andrew MacFie Sun, 02 Dec 2007 18:20:27 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-967 I think accepting 'HTTP_X_FORWARDED_FOR' or 'REMOTE_ADDR' values as ultimately correct identifiers for end users is clearly a different problem than failing to perform output validation on user-supplied data. 'HTTP_X_FORWARDED_FOR' and other HTTP headers are of course trivial to spoof, and there is irony in the perceived extra level of security that checking for proxied users appears to provide. If this information is really required, the developer might want to have a look at some Metasploit Project research (hxxp://metasploit.com/research/misc/decloak/). Outputting unfiltered user input is always bad, as shown, but trusting HTTP headers as always legitimate values is far too tempting and a more commonly overlooked source of vulnerability than, say, query strings. I think accepting ‘HTTP_X_FORWARDED_FOR’ or ‘REMOTE_ADDR’ values as ultimately correct identifiers for end users is clearly a different problem than failing to perform output validation on user-supplied data. ‘HTTP_X_FORWARDED_FOR’ and other HTTP headers are of course trivial to spoof, and there is irony in the perceived extra level of security that checking for proxied users appears to provide. If this information is really required, the developer might want to have a look at some Metasploit Project research (hxxp://metasploit.com/research/misc/decloak/).

Outputting unfiltered user input is always bad, as shown, but trusting HTTP headers as always legitimate values is far too tempting and a more commonly overlooked source of vulnerability than, say, query strings.

]]> By: Awesome AnDrEw http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-966 Awesome AnDrEw Sun, 02 Dec 2007 16:08:50 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-966 I choose the latter option, and sanitize all user-input and headers. I choose the latter option, and sanitize all user-input and headers.

]]> By: kourge http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-965 kourge Sun, 02 Dec 2007 15:58:53 +0000 http://www.thespanner.co.uk/2007/12/02/faking-the-unexpected/#comment-965 Clever! This can almost certainly attack sites that display the user's user agent such... Clever! This can almost certainly attack sites that display the user’s user agent such…

]]>