No Tengo
Páginas: 3 (630 palabras)
Publicado: 8 de agosto de 2012
MULTIPLE TRICKY WAYS TO PROTECT
SENSITIVE FILES & DIRECTORIES OF YOUR
CRITICAL WEB APPLICATIONS
By
d0ubl3_h3lix
Tue Jan 29 2008
Abstract
Nowadays almost all kinds of full-featured webapplications such in CMSes (Content
Management Systems) include administrative interface where we can administer
dynamic features provided. While the admin feature provides us much convenience, itsurely attracts attackers like delicious honey for hungry bees. Typically, developers
do not always make detailed attention to make every admin area secure because the
user is an admin who is trusted andreliable. Over times, the more web applications
are complicated, the more hidden security holes have to be existed. Hence, to protect
this admin feature as much as we can is a must for criticalapplications. In this paper, I
will show you multiple protection ways which may not be foolproof but may hinder
attackers to a certain extent.
Assumption
I assume your web servers and underlyinghosting infrastructure have been properly
patched and secure as attackers can own your applications ultimately through even a
single hole in each OSI layer. I assume the admin interface of the webapplication you
are using has some hidden flaws. Since you are not a core developer of that thirdparty application, you may not know how to fix them up. In this case, your CMS is at
risk of beingattacked any time. You are not in helpless position. You have my
suggested methods for protection.
Protection Methods
Through Fixed IPs
If you always use or manage your web applications from singleIP (maybe your
company IP), this method adds some protection. Restricting IPs with server-side
methods to your admin files and folders force attackers to try to know admin’s IP
address if they aresmart. An average attacker cannot even determine why they are
banned. Nevertheless, this method is the lowest level protection mode if you deal with
a lot of clients. Smart attackers may trick you...
SENSITIVE FILES & DIRECTORIES OF YOUR
CRITICAL WEB APPLICATIONS
By
d0ubl3_h3lix
Tue Jan 29 2008
Abstract
Nowadays almost all kinds of full-featured webapplications such in CMSes (Content
Management Systems) include administrative interface where we can administer
dynamic features provided. While the admin feature provides us much convenience, itsurely attracts attackers like delicious honey for hungry bees. Typically, developers
do not always make detailed attention to make every admin area secure because the
user is an admin who is trusted andreliable. Over times, the more web applications
are complicated, the more hidden security holes have to be existed. Hence, to protect
this admin feature as much as we can is a must for criticalapplications. In this paper, I
will show you multiple protection ways which may not be foolproof but may hinder
attackers to a certain extent.
Assumption
I assume your web servers and underlyinghosting infrastructure have been properly
patched and secure as attackers can own your applications ultimately through even a
single hole in each OSI layer. I assume the admin interface of the webapplication you
are using has some hidden flaws. Since you are not a core developer of that thirdparty application, you may not know how to fix them up. In this case, your CMS is at
risk of beingattacked any time. You are not in helpless position. You have my
suggested methods for protection.
Protection Methods
Through Fixed IPs
If you always use or manage your web applications from singleIP (maybe your
company IP), this method adds some protection. Restricting IPs with server-side
methods to your admin files and folders force attackers to try to know admin’s IP
address if they aresmart. An average attacker cannot even determine why they are
banned. Nevertheless, this method is the lowest level protection mode if you deal with
a lot of clients. Smart attackers may trick you...
Leer documento completo
Regístrate para leer el documento completo.