Re: [fw-wiz] preventing XSS and SQL injection?

From: ArkanoiD (ark_at_eltex.net)
Date: 06/02/05

  • Next message: Paul D. Robertson: "Re: [fw-wiz] Ok, so now we have a firewall, we're safe, right?" 
    To: "Marcus J. Ranum" <mjr@ranum.com>
Date: Thu, 2 Jun 2005 22:58:12 +0400

    It is ok when securing server traffic, but becames extremely difficult when it
    comes to client proxy, because there are too many legitimate traffic patterns to add :-(

    On Thu, Jun 02, 2005 at 03:03:36PM -0400, Marcus J. Ranum wrote:
    > ArkanoiD wrote:
    > >Are there any hints on preventing cross-site scripting attacks and
    > >SQL injection on proxy firewall by, say, applying some regexps on url data?
    >
    > Instead of trying to block what is bad, permit only what is good.
    >
    > Can you observe your legitimate traffic and converge forward
    > on a set of regexps that define what "good" looks like? Then
    > deny all else. You might be able to do that in a fairly straightforward
    > manner using Squid proxy cache ACLs.
    >
    > mjr.
    >
    >
    > email protected and scanned by AdvascanTM - keeping email useful - www.advascan.com
    >
    >
    >

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Paul D. Robertson: "Re: [fw-wiz] Ok, so now we have a firewall, we're safe, right?"

    Relevant Pages

    • Re: How do I deploy a SOAP extension on the client proxy
      ... my proxy methods need to have the extension functionality. ... > soapExtension at clientside proxy is just like we do in asp.net server ... How do I deploy a SOAP extension on the client proxy ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Web Service client that dynamically changes posting server
      ... The way I took care of this was to generate the client proxy in a tester ... file into the webservice project, itself, changing it's namespace to ... Then I created a new constructor for the proxy wherein you supply the ...
      (microsoft.public.dotnet.framework.aspnet.webservices)
    • WCF Client Proxy Open/Close for InstanceMode.PerCall
      ... What would be the recommended way of opening and closing the client proxy in ... At the moment we are creating the proxy on the client ... if creating a new proxy instance, openenig it, making the call and closing ... it afterwards for each call is really the best way to go for. ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Calling a method on a webservice
      ... implementations. ... You need to modify the generated client proxy class and replace the ...
      (microsoft.public.dotnet.framework.webservices)
    • Re: Calling a method on a webservice
      ... implementations. ... You need to modify the generated client proxy class and replace the ...
      (microsoft.public.dotnet.framework.webservices)
    • Quantcast