1. Lesson 15 Client Side Vulnerabilities and you

2. Active Server Pages MS’s answer to the scripting world of PERL and CGI on Unix Usually Written In Visual Basic Script (VBS) Provides: –State –Backend data base access –Generally display HTML in Browser

3. ASP (2) Pros: – Ability to Output HTML file on the fly Con – Numerous Vulnerabilities that allow attackers to view ASP code itself -- Attackers can learn further vulnerabilities in program logic -- Attackers can view sensitive info

4. ASP (3) Con Numerous Vulnerabilities that allow attackers to view ASP code itself – Attackers can learn further vulnerabilities in program logic – Attackers can view sensitive info

5. Well Known Vulnerabilities ASP DOT Bug Vulnerability (IIS 3.0) http://127.134.10.1/scripts/myexample.asp. –Allowed hacker to view ASP source code –Now patched –Patch intoduced new vulnerabilities http://127.134.10.1/scripts/myexample%2easp

6. Well Known Vulnerabilities(2) ASP Alternate Data Streams (IIS 3.0) http://127.134.10.1/scripts/myexample.asp::$data –Allowed file download –Limit file access rights of all source code by removing read access of the Everyone Group –Only allow execute permission

7. Well Known Vulnerabilities(3) Show code.asp Vulnerability (IIS 4.0) http://127.134.10.1/mscode/samples/SELECTOR/showco de.asp?source=/../../../../../boot.ini Script did not restrict use of “..” Allows Hacker to download files In this example Hacker Views Boot.ini file Applying hot fix corrected the problem

8. Well Known Vulnerabilities(4) Codebrws.asp Vulnerability (IIS 4.0) http://127.134.10.1/iissamples/exair/howitworks/codebrw s.asp?source=/../../../../../winnt/repair/setup.log Allows Hacker to View any file on target system Applying hot fix corrected the problem

9. Managing Your Security IE Configuration Very Flexibile Checking WWW Page Certificates –File Properties IE TOOLs--Internet Options –Advanced –Security –Content

10. MS Advanced Options Can Set SSL/TLS Options Warn About Invalid Digital Certificates Warn on form submission redirection Much More just see >>>>>>>

12. Using File Properties Allows User to Check on Web Page properties Allows User to verify Digital Certificates Allows User to verify encryption

16. MS Internet Security Zones Next Series of Slide Shows You How User (Client) can select the security they desire while interacting on the Internet.

20. MS Internet Content Next Series of Slide Shows You Can Manage Digital Certificates on your home computer

25. Checking Your Open Ports

27. Checking Your IP Configuration

30. SUMMARY Client Side Security is Your Responsibility Do not be afraid to experiment