Feeds

Denial, exposure and online security

Five top tips

Choosing a cloud hosting partner with confidence

Web applications have huge attack surfaces. Most sites have hundreds of URLs, and each function has plenty of parameters, form fields, cookies, and headers for attackers to play with.

One simple way to make your web application more secure is to minimize your attack surface. Let's look at five simple ways to do this.

Tighten up your URL space

The first step is to lock down your webserver, application server, application configuration, and code tree to be sure that you're not supporting any URLs that you didn't expect.

You should also check your application for functions, backup files, temporary files, and test code that wasn't intentionally deployed. Just because they're not linked in the user interface, doesn't mean an attacker can't find and exploit them. Also, be sure you're not supporting all file extensions - just the specific ones you expect.

Ditch those hidden fields

Hidden fields are form values that aren't displayed to the user. When the user submits a form, the hidden fields are submitted just like any other form field. Attackers can easily change hidden field values to anything they want with browser tools like TamperData or WebDeveloper. Hidden fields are frequently quite vulnerable to attack because they're often overlooked when implementing validation.

You could use normal input validation techniques to check the hidden field, but the best way to check is to do a direct comparison with the value that you just set in the web page. Of course, if you can do this, there's really no point in having the hidden fields at all, so consider just getting rid of them and reducing your attack surface.

Don't expose your privates

Most applications use parameters or form fields that reference data on the server by its name or ID. Attackers love to try to access unauthorized data by tampering with these "direct" references. For example, imagine a URL that references a file on the server:

http://www.example.com/banking/fetchReport?fn=03102008.xl

Attackers will immediately attempt to manipulate the filename to access other files on the host. If the code takes the "fn" parameter and appends it to a filepath, the attacker might try sending the following to gain access to the host's password file:

 "?fn=../../../../etc/password%00"

The %00 at the end of the URL will be decoded by the container into a null byte that terminates the string, leaving only the attackers path in the parameter. There are hundreds of attack variants, so don't try to filter out attacks.

Internet Security Threat Report 2014

More from The Register

next story
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Whistling Google: PLEASE! Brussels can only hurt Europe, not us
And Commish is VERY pro-Google. Why should we worry?
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
First in line to order a Nexus 6? AT&T has a BRICK for you
Black Screen of Death plagues early Google-mobe batch
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.