Ask the Expert

Web application variable manipulation

What happens if a Web application uses client-side SSL certificates in addition to server-side certificates? Is Web application variable manipulation still possible?

    Requires Free Membership to View

Unfortunately, Web application variables can still be manipulated even when both client and server are using digital certificates to authenticate themselves and establish an SSL connection. In order to manipulate Web application variables an attacker uses an HTTP proxy tool. By adjusting the client's browser's proxy settings to pass through the HTTP proxy, all HTTP and HTTPS requests and responses can be channelled through the proxy before being forwarded to the server. This gives the attacker a window to view and alter all information passed in the browsing session, including any variables passed by the application in cookies, hidden form elements and URLs. The main threat from these proxy tools is they enable attackers to view and edit the information sent from the client to the server.

Not all "man-in-the-middle" proxy tools can handle SSL sessions when the client and the server use certificates, because they can't store the client certificate for handshaking or logon. However, if they import the required client certificate prior to handshaking or logon, the Paros Proxy can intercept and modify HTTPS data, even when applications require a client certificate. Although the client and the server may be trusted, the attacker can modify any part of the request and response before forwarding it.

Paros is a very powerful program and can be used to evaluate the security of Web applications. It is free of charge and completely written in Java. It has several tools including a record feature, which keeps a history of all HTTP requests and responses. This feature allows the developer or attacker to review all of the actions, pages and variables. It also includes automated vulnerability scanning and detection capabilities for some common Web application attacks, including SQL injection and cross-site scripting. Paros also scans for unsafe Web content, such as unsigned ActiveX controls and browser exploits sent by the target Web server. For more information about Paros visit the Web site at http://www.parosproxy.org.


More Information

  • Visit our Web application security resource center for news, tips and additional expert advice.

  • Learn how to improve Web site security by securing Web applications from authenticated users and avoiding client-side authentication.


  • This was first published in December 2005

    There are Comments. Add yours.

     
    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: