Path: csiph.com!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Ecommerce site - how? Date: Tue, 27 Jun 2017 07:56:56 +0200 Lines: 70 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Trace: individual.net X/IuIVNM3qT5u26HKnJ+7wvpz47xzZNd8GrsDezQIiS8eKZ8BP Cancel-Lock: sha1:A97PijJMWowVr64bXaL/FTG8O/8= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.0 In-Reply-To: Content-Language: en-GB Xref: csiph.com comp.lang.php:17494 On 06/26/17 23:14, R.Wieser wrote: > J.O. > >> Which would be possible to tamper ... > > Absolutily. > > Just one question: how would he person who is shopping at the moment benefit > from altering the article codes of the products he has selected himself ? it don't have to benefit the shopper, it can benefit a third party. >> ... and give another attack vector > > Pray tell, I'm rather interrested in hearing how changing product-id "X" > into "Y" can be exploited. Thought of sending more than just product id, the code that is on the e-commerce site may have a flaw which makes it possible to send a value not usually stored in the cookie to make the site to do something else, for example "admin=true" and the user may suddenly be the administrator of the whole site. >> Session cookie can have a long lifespan too, so the user could come >> back and continue with what is stored in the session. > > Depending on what you mean with "sesssion cookie" here I can agree, but as > easily disagree with you. > > As you have complained about how easy it would be to "attack" data stored in > a cookie I'm going to assume hat you ment a "session cookie" as in a cookie > which holds nothing more than a session-ID (correct me if I'm wrong).. > > Yes, both a cookie and thus the a session ID stored in it can live for the > longest time (depending on the lifetime the website has defined for the > cookie-data ofcourse -- which, for a shopping cart of an e-commerce site, > will be rather short), but the PHP session its referring to will be > destroyed shortly after you leave the server, making that stored ID rather > worthless. The session cookie do not automatically get "destroyed" just for you leave a site, it live the set life span it has, some sites uses a short life span and other a long. Depending on your browser settings, you can let the cookie survive a close down of the browser. > And although resuming a *shopping* session will be possible, it certainly > will not be done by using that session-ID. hint: logging in. Hint: no login needed as long as you visit the site before the session cookie expires. >> If you are interested in learning take a look at OWASP. > > Nope, not interrested in learning. No sirree, not at all! /s > > I just took a quick look at that site (www.owasp.org). The first thing I > noticed was iframes and JS, both to external sites. For a fricking > *security* minded site. Don't make me laugh please. Idiots. JavaScript and iframes don't automatically make a page insecure, if you do follow the guidelines at OWASP then your page will has less risks of normal vulnerabilities, no matte how your site is generated. -- //Aho