Lesson 15 Client Side Vulnerabilities and you

Active Server Pages MS’s answer to the scripting world of PERL and CGI on Unix Usually Written In Visual Basic Script (VBS) Provides: –State –Backend data base access –Generally display HTML in Browser

ASP (2) Pros: – Ability to Output HTML file on the fly Con – Numerous Vulnerabilities that allow attackers to view ASP code itself -- Attackers can learn further vulnerabilities in program logic -- Attackers can view sensitive info

ASP (3) Con Numerous Vulnerabilities that allow attackers to view ASP code itself – Attackers can learn further vulnerabilities in program logic – Attackers can view sensitive info

Well Known Vulnerabilities ASP DOT Bug Vulnerability (IIS 3.0) –Allowed hacker to view ASP source code –Now patched –Patch intoduced new vulnerabilities

Well Known Vulnerabilities(2) ASP Alternate Data Streams (IIS 3.0) –Allowed file download –Limit file access rights of all source code by removing read access of the Everyone Group –Only allow execute permission

Well Known Vulnerabilities(3) Show code.asp Vulnerability (IIS 4.0) de.asp?source=/../../../../../boot.ini Script did not restrict use of “..” Allows Hacker to download files In this example Hacker Views Boot.ini file Applying hot fix corrected the problem

Well Known Vulnerabilities(4) Codebrws.asp Vulnerability (IIS 4.0) s.asp?source=/../../../../../winnt/repair/setup.log Allows Hacker to View any file on target system Applying hot fix corrected the problem

Managing Your Security IE Configuration Very Flexibile Checking WWW Page Certificates –File Properties IE TOOLs--Internet Options –Advanced –Security –Content

MS Advanced Options Can Set SSL/TLS Options Warn About Invalid Digital Certificates Warn on form submission redirection Much More just see >>>>>>>

Using File Properties Allows User to Check on Web Page properties Allows User to verify Digital Certificates Allows User to verify encryption

MS Internet Security Zones Next Series of Slide Shows You How User (Client) can select the security they desire while interacting on the Internet.

MS Internet Content Next Series of Slide Shows You Can Manage Digital Certificates on your home computer

Checking Your Open Ports

Checking Your IP Configuration

SUMMARY Client Side Security is Your Responsibility Do not be afraid to experiment