From: RSnake (rsnake@shocking.com)
Date: Fri Sep 15 2006 - 11:24:34 EDT
Hi, Darryl, this is really more of a network security question than an
application security question, but let me take a stab at it. It is
possible, although very unlikely that they can spoof an IP packet to run
some command on the server. They would be doing so blind though as they
wouldn't see the responses. There is a fairly good article here:
http://www.cosc.brocku.ca/~cspress/HelloWorld/1999/03-mar/spoofing.html
This really isn't super practical on a lot of modern systems because
they do a better job of reducing the predictability of the ISN to create
the fake three way connection. Also, if the server is under any sort of
load it makes it more difficult. Also, the attacker would have to know
exactly what to craft to make that happen (so unless it's open source,
that simple fact alone will make exploitation much more difficult).
So yes, theoretically it's a bad idea, in practice it's pretty
difficult to exploit from a black box perspective. Beware people on
your local LAN though, they'll have a much easier time exploiting than
an outsider would as they have visibility into packets in both
directions if they are sniffing the network.
-RSnake
http://ha.ckers.org/
http://sla.ckers.org/
> Hello fellow Security Guru's.
>
> I've been on the distro from sometime and gaining a lot of insight into
> various security issues.
>
> Question: I have ASP script that points to a backend database residing on
> seperate physical server. Is there any known way of getting around using a
> hard-coded IP address to point to the database? Would utilizing the OS hosts
> file serve my purposes of and satisfy secure code practices? Thanks guys.
>
> Darryl
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:57 EDT