Entwickler-Ecke
Internet / Netzwerk - Security of Idhttp post?
chukalv - Mo 22.05.06 07:19
Titel: Security of Idhttp post?
Is there a way to get the data and the location to which I`m sending post data with the IdHttp component? Or is there a way to fake them? And if yes, are there any ways to secure it?
The reason is that I`m creating a application that sends data about the program registration throught the IdHttp.post method.
For example:
Delphi-Quelltext
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
| var
stream: TMultiPartFormDataStream;
begin
Stream := TMultiPartFormDataStream.create;
stream.addformfield('somecode','3434343');
try
theresult := Idhttp1.post('http://my.syte.com/securitychechk.php',stream);
except
end;
stream.free;
If theresult := 'Yes!' then ShowMessage('The code is OK...');
end; |
Are there any ways to cache the link to the securitycheck.php ot to fake the result? IMHO that could be done with the putty to fake the port and so on..
digi_c - Mo 22.05.06 08:38
Well hi there!
I doesn't understand exactly what securety you mean so I trie to explain possible attacks in general:
the code:
A attacker would be able to extract the URL out of the .EXE file by a decompiler so he would be able to see the "hidden" secret PHP function. You could use a runtime packer(UPX) or other obsurcefactors to scramble the .EXE file but if a cracker wan't to break it he'll do it. The better sollution would be to implement a own crypt function and to add a lot of garbage function so tracing the programm would be difficult.
the request:
Nevertheless the connected server could be analysed by using the
netstat -a command or tools from
http://www.sysinternals.com. So attackers might see the server. If someone uses a sniffer app he would be able to analyse the complete traffic inluding the url and submitted values. A FW would help him to interrupt the connection. With the help of a proxy attackers might analyse the data, too but furthermore they could inject/change it. This is called man-in-the-middle attack.
To protect your transmissions you should use https sockets but I have no knowledge about it but i think it's just a little bit more difficult(signed certificates,...).
I doesn't know your intension but to register a shareware and so on it's defineitly a bad idea ;)
chukalv - Mo 22.05.06 08:51
1. About the code. About that I`m not really worried, because there are no security holes if the user would find out the adress of the php file.
2. About the man-in-the-middle. This what I wanted to know. So I understood that there is a possibility to fake the answer from the real server. Should now read about secure http transfer...
Thanks for the answer!
P.S. The code is not for a shareware registration, but for a user login ;)
digi_c - Mo 22.05.06 09:05
In web https is mostly used for login forms. Otherwise my boss would be able to checkout my mail account. I guess that would be definitly bad ;-)
Entwickler-Ecke.de based on phpBB
Copyright 2002 - 2011 by Tino Teuber, Copyright 2011 - 2026 by Christian Stelzmann Alle Rechte vorbehalten.
Alle Beiträge stammen von dritten Personen und dürfen geltendes Recht nicht verletzen.
Entwickler-Ecke und die zugehörigen Webseiten distanzieren sich ausdrücklich von Fremdinhalten jeglicher Art!