Security of Idhttp post?

chukalv · Beiträge: 44

Is there a way to get the data and the location to which I`m sending post data with the IdHttp component? Or is there a way to fake them? And if yes, are there any ways to secure it?
The reason is that I`m creating a application that sends data about the program registration throught the IdHttp.post method.
For example:

markieren

Delphi-Quelltext

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:

var
stream: TMultiPartFormDataStream;
begin
Stream := TMultiPartFormDataStream.create;
stream.addformfield('somecode','3434343');
try
theresult := Idhttp1.post('http://my.syte.com/securitychechk.php',stream);
except 
end;
stream.free;
If theresult := 'Yes!' then ShowMessage('The code is OK...');
end;

Are there any ways to cache the link to the securitycheck.php ot to fake the result? IMHO that could be done with the putty to fake the port and so on..

digi_c · Beiträge: 1905 W98, XP D7 PE, Lazarus, WinAVR

Well hi there!

I doesn't understand exactly what securety you mean so I trie to explain possible attacks in general:

the code:
A attacker would be able to extract the URL out of the .EXE file by a decompiler so he would be able to see the "hidden" secret PHP function. You could use a runtime packer(UPX) or other obsurcefactors to scramble the .EXE file but if a cracker wan't to break it he'll do it. The better sollution would be to implement a own crypt function and to add a lot of garbage function so tracing the programm would be difficult.

the request:
Nevertheless the connected server could be analysed by using the netstat -a command or tools from www.sysinternals.com. So attackers might see the server. If someone uses a sniffer app he would be able to analyse the complete traffic inluding the url and submitted values. A FW would help him to interrupt the connection. With the help of a proxy attackers might analyse the data, too but furthermore they could inject/change it. This is called man-in-the-middle attack.
To protect your transmissions you should use https sockets but I have no knowledge about it but i think it's just a little bit more difficult(signed certificates,...).

I doesn't know your intension but to register a shareware and so on it's defineitly a bad idea

chukalv · Beiträge: 44

1. About the code. About that I`m not really worried, because there are no security holes if the user would find out the adress of the php file.

2. About the man-in-the-middle. This what I wanted to know. So I understood that there is a possibility to fake the answer from the real server. Should now read about secure http transfer...

Thanks for the answer!

P.S. The code is not for a shareware registration, but for a user login

digi_c · Beiträge: 1905 W98, XP D7 PE, Lazarus, WinAVR

In web https is mostly used for login forms. Otherwise my boss would be able to checkout my mail account. I guess that would be definitly bad ;-)

digi_c · Beiträge: 1905 W98, XP D7 PE, Lazarus, WinAVR

You might have a look on www.insecure.org/tools.html, too to see what's possible by low level tools.

	Mitgliederliste
	Gruppen
	Das Team
	Richtlinien
	Synonyme