Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17491

Re: Ecommerce site - how?

Show all headers | View raw

J.O.

> Which would be possible to tamper ...

Absolutily.

Just one question: how would he person who is shopping at the moment benefit
from altering the article codes of the products he has selected himself ?

> ... and give another attack vector

Pray tell, I'm rather interrested in hearing how changing product-id "X"
into "Y" can be exploited.

> Session cookie can have a long lifespan too, so the user could come
> back and continue with what is stored in the session.

Depending on what you mean with "sesssion cookie" here I can agree, but as
easily disagree with you.

As you have complained about how easy it would be to "attack" data stored in
a cookie I'm going to assume hat you ment a "session cookie" as in a cookie
which holds nothing more than a session-ID (correct me if I'm wrong)..

Yes, both a cookie and thus the a session ID stored in it can live for the
longest time (depending on the lifetime the website has defined for the
cookie-data ofcourse -- which, for a shopping cart of an e-commerce site,
will be rather short), but the PHP session its referring to will be
destroyed shortly after you leave the server, making that stored ID rather
worthless.

And although resuming a *shopping* session will be possible, it certainly
will not be done by using that session-ID.  hint: logging in.

> And this can just lead to issues which we already pointed out.

You guys did ?    I must have missed it somehow, I wonder how ...  /s

So, quotes and/or links, or it didn't happen.  And by the way, If you come
up with stuff I already responded to you definitily loose the game. :-)

> There are other methods which are more used nowadays, when the
> request will come from the users browser, but a request orchestrated
> by a third party, far less work than spoofing IP which ain't too
difficult.

Vagueness all around I'm afraid.  I can go in quite a number of directions
with that, which is definitily *not* a good starting point (read: I'm not
prepared to waste my time with guessing which of those directions you might
mean/be going).

> If you are interested in learning take a look at OWASP.

Nope, not interrested in learning.  No sirree, not at all! /s

I just took a quick look at that site (www.owasp.org).   The first thing I
noticed was iframes and JS, both to external sites.   For a fricking
*security* minded site.  Don't make me laugh please.  Idiots.

Regards,
Rudy Wieser




J.O. Aho <user@example.net> schreef in berichtnieuws
erd6dvFhfi0U1@mid.individual.net...
> On 06/26/17 19:40, R.Wieser wrote:
> > Christoph,
> >
> >> And yes, using a PHP session instead is usually the appropriate
> >> solution.  *Extremly* simplified:
> >
> > *Over* simplified I'm afraid.   What you put down there (remembering the
IDs
> > of the selected products) can be done by using cookies.
>
> Which would be possible to tamper and give another attack vector on the
> site. And can cause some browser to get issues if the data amount is too
> big as when you are ordering many different things at the same time.
>
> > ... which would, in this simplified case, even be preferrable, as than
the
> > user can stop, and restart shopping (even days later) whenever they want
> > (which is not possible using a basic PHP session).
>
> Session cookie can have a long lifespan too, so the user could come back
> and continue with what is stored in the session.
>
> > The idea is to, when the PHP session is created, store the clients IP
and
> > check it with the stored one on subsequent usages*.
>
> And this can just lead to issues which we already pointed out. This is a
> technique used in the early days of internet but didn't work out too
> well and didn't give any extra security.
>
> > While it certainly is
> > possible to (even without attempting to do so) hijack an IP, sending the
> > correct session-ID with it is a whole other ballgame.  Especially when
done
> > over SSL.
>
> There are other methods which are more used nowadays, when the request
> will come from the users browser, but a request orchestrated by a third
> party, far less work than spoofing IP which ain't too difficult.
>
> If you are interested in learning take a look at OWASP.
>
> --
>
>  file://Aho

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-25 05:42 -0700
  Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-25 15:30 +0200
    Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-25 16:03 +0200
    Re: Ecommerce site - how? gordonb.y152t@burditt.org (Gordon Burditt) - 2017-06-26 05:43 -0500
      Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 17:12 +0200
        Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-26 17:54 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:40 +0200
            Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:42 +0200
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 23:14 +0200
                Re: Ecommerce site - how? "Christoph M. Becker" <cmbecker69@arcor.de> - 2017-06-27 00:28 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:48 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:56 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 12:27 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:15 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 22:01 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:07 +0200
                Re: Ecommerce site - how? Gordon Burditt <gordon@hammy.burditt.org> - 2017-06-30 17:08 -0500
        Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 18:29 +0200
          Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 19:17 +0200
            Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 13:34 -0400
              Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 20:11 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-26 21:31 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-26 22:29 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 07:19 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 11:24 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-27 19:43 +0200
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 23:09 +0200
                Re: Ecommerce site - how? "J.O. Aho" <user@example.net> - 2017-06-28 07:12 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 21:10 -0400
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-26 16:32 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 10:30 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 08:38 -0400
                Re: Ecommerce site - how? "R.Wieser" <address@not.available> - 2017-06-27 17:47 +0200
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 12:16 -0400
                Re: Ecommerce site - how? gordonb.bytf1@burditt.org (Gordon Burditt) - 2017-06-29 18:16 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-29 20:41 -0400
                Re: Ecommerce site - how? gordonb.99a3p@burditt.org (Gordon Burditt) - 2017-06-29 23:39 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 07:28 -0400
                Re: Ecommerce site - how? Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2017-06-30 13:48 +0000
                Re: Ecommerce site - how? gordonb.gcghn@burditt.org (Gordon Burditt) - 2017-06-30 16:15 -0500
                Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-30 22:35 -0400
                Re: Ecommerce site - how? Richard Damon <Richard@Damon-Family.org> - 2017-06-29 23:46 -0400
        Re: Ecommerce site - how? gordonb.d2wed@burditt.org (Gordon Burditt) - 2017-06-29 17:32 -0500
  Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-06-27 10:58 -0700
    Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-06-27 15:34 -0400
    Re: Ecommerce site - how? gordonb.4psc7@burditt.org (Gordon Burditt) - 2017-06-30 16:55 -0500
      Re: Ecommerce site - how? bit-naughty@hotmail.com - 2017-07-01 03:03 -0700
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:30 -0400
        Re: Ecommerce site - how? Jerry Stuckle <jstucklex@attglobal.net> - 2017-07-01 09:34 -0400

csiph-web