Re: Secure Form Script?

From: Stephen Samuel (samuel_at_bcgreen.com)
Date: 05/13/04

  • Next message: Bryce Porter: "RE: Secure Form Script?" 
    Date: Thu, 13 May 2004 14:55:36 -0700
To: Michael Rice <michael@riceclan.org>, focus-linux@securityfocus.com

    Why not just a form that accepts a subject, a sender email
    and a text message, then mails that to a specific user.
    Even if manage to hijack the fields due to improperly vetted
    input, you'd still only end up with the input going to one
    possible person (the recipient is specified on the (fixed))
    sendmail commandline).

    Michael Rice wrote:
    >>Can someone point me to a discussion about the issues involved with
    >>hijacking web forms? In the applications I write, the destination address
    >>is usually stored on the server, either in the script itself, or in a
    >>configuration file, or in a database. I don't see how someone could use
    >>such a script to change the destination address and point it at a list
    >>of addresses belonging to spam victims.
    >
    >
    > It's usually not sufficient to store the to addresses on the server
    > and/or obfuscate the parameters used for the other input fields.
    >
    >
    > Consider a form that constructs the email like:
    >
    > Date: $local->date
    > From: $form->from
    > To: $local->to
    > Subject: $form->subject
    >
    > $form->body
    >
    > So, to hijack this form, I would construct a subject like: 

    -- 
Stephen Samuel +1(604)876-0426                samuel@bcgreen.com
		   http://www.bcgreen.com/~samuel/
    Powerful committed communication. Transformation touching
      the jewel within each person and bringing it to light.
  • Next message: Bryce Porter: "RE: Secure Form Script?"

    Relevant Pages

    • RE: Secure Form Script?
      ... Or you can write your own script in Perl ... Even if manage to hijack the fields due to improperly vetted ... the destination ... > It's usually not sufficient to store the to addresses on the server ...
      (Focus-Linux)
    • Re: Can anyone use my domain name to send outgoing emails?
      ... I don't know how much checking Hotmail does. ... A receiving mail server can check that the IP address of the sending ... If anyone can put anybody else's email address in the sender email ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • Re: Can anyone use my domain name to send outgoing emails?
      ... If anyone can put anybody else's email address in the sender email address ... and send into any hotmail account. ... SMTP illegally? ... can't access any SMTP message submission server without access permissions ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • sending email problem....
      ... When i try to send a message with this function with a wrong sender email address, my script just stops... ... Disposition => 'attachment' ...
      (perl.beginners)
    • Re: sending email problem....
      ... Tony Marquis wrote: ... When i try to send a message with this function with a wrong sender email address, my script just stops... ... I say that because its just a sub, there is no call to it with example data or the actual error (which would be helpfull to see where its coming from, especially if you are reporting the error ...
      (perl.beginners)