Tuesday, May 27, 2008

Web site security–Ajax security

Fuelled by the increased interest in Web 2.0, AJAX (Asynchronous JavaScript Technology and XML) is attracting the attention of businesses all round the globe.

AJAX is meant to increase interactivity, speed, and usability. The technologies have prompted a richer and friendly experience for the user as web applications are designed to imitate ‘traditional’ desktop applications.

There is the general misconception that in AJAX applications are more secure because it is thought that a user cannot access the server-side script without the rendered user interface (the AJAX based webpage). XML HTTP Request based web applications obscure server-side scripts, and this obscurity gives website developers and owners a false sense of security – obscurity is not security. Since XML HTTP requests function by using the same protocol as all else on the web (HTTP), technically speaking, AJAX-based web applications are vulnerable to the same hacking methodologies as ‘normal’ applications.

Another weakness of AJAX is the process that formulates server requests. The Ajax engine uses JS to capture the user commands and to transform them into function calls. Such function calls are sent in plain visible text to the server and may easily reveal database table fields such as valid product and user IDs, or even important variable names, valid data types or ranges, and any other parameters which may be manipulated by a hacker.

With this information, a hacker can easily use AJAX functions without the intended interface by crafting specific HTTP requests directly to the server. In case of cross-site scripting, maliciously injected scripts can actually leverage the AJAX provided functionalities to act on behalf of the user thereby tricking the user with the ultimate aim of redirecting his browsing session (e.g., phishing) or monitoring his traffic.

Solution

The only solution for effective and efficient security auditing is a vulnerability scanner which automates the crawling of websites to identify weaknesses. However, without an engine that parses and executes JavaScript, such crawling is inaccurate and gives website owners a false sense of security.

Sunday, May 25, 2008

Special Characters in Development

‘ ‘ left single quote
’ ’ right single quote
&sbquo; ‚ single low-9 quote
“ “ left double quote
” ” right double quote
&bdquo; „ double low-9 quote
&dagger; † dagger
&Dagger; ‡ double dagger
&permil; ‰ per mill sign
&lsaquo; ‹ single left-pointing angle quote
&rsaquo; › single right-pointing angle quote
&spades; ♠ black spade suit
&clubs; ♣ black club suit
&hearts; ♥ black heart suit
&diams; ♦ black diamond suit
&oline; ‾ overline, = spacing overscore
← ← leftward arrow
↑ ↑ upward arrow
→ → rightward arrow
↓ ↓ downward arrow
™ ™ trademark sign

Name Code Number Code Glyph Description

 � -
 unused
	 horizontal tab

 line feed
 unused
  space
! ! exclamation mark
" " " double quotation mark
# # number sign
$ $ dollar sign
% % percent sign
& & & ampersand
' ' apostrophe
( ( left parenthesis
) ) right parenthesis
* * asterisk
+ + plus sign
, , comma
- - hyphen
. . period

Name Code Number Code Glyph Description

&frasl; / / slash
0-
9 digits 0-9
: : colon
; ; semicolon
< < <> greater-than sign
? ? question mark
@ @ at sign
A-
Z uppercase letters A-Z
[ [ left square bracket
\ \ backslash
] ] right square bracket
^ ^ caret
_ _ horizontal bar (underscore)
` ` grave accent
a-
z lowercase letters a-z
{ { left curly brace
| | vertical bar

Name Code Number Code Glyph Description
} } right curly brace
~ ~ tilde
-
 unused
–  – en dash
—  — em dash
-
 unused
    nonbreaking space
¡ ¡ ¡ inverted exclamation
¢ ¢ ¢ cent sign
£ £ £ pound sterling
¤ ¤ ¤ general currency sign
¥ ¥ ¥ yen sign
¦ or &brkbar; ¦ ¦ broken vertical bar
§ § § section sign
¨ or &die; ¨ ¨ umlaut
© © © copyright
ª ª ª feminine ordinal
« « « left angle quote
¬ ¬ ¬ not sign
  soft hyphen
® ® ® registered trademark
¯ or &hibar; ¯ ¯ macron accent

Name Code Number Code Glyph Description
° ° ° degree sign
± ± ± plus or minus
² ² ² superscript two
³ ³ ³ superscript three
´ ´ ´ acute accent
µ µ µ micro sign
¶ ¶ ¶ paragraph sign
· · · middle dot
¸ ¸ ¸ cedilla
¹ ¹ ¹ superscript one
º º º masculine ordinal
» » » right angle quote
¼ ¼ ¼ one-fourth
½ ½ ½ one-half
¾ ¾ ¾ three-fourths
¿ ¿ ¿ inverted question mark
À À À uppercase A, grave accent
Á Á Á uppercase A, acute accent
Â Â Â uppercase A, circumflex accent

Name Code Number Code Glyph Description
Ã Ã Ã uppercase A, tilde
Ä Ä Ä uppercase A, umlaut
Å Å Å uppercase A, ring
Æ Æ Æ uppercase AE
Ç Ç Ç uppercase C, cedilla
È È È uppercase E, grave accent
É É É uppercase E, acute accent
Ê Ê Ê uppercase E, circumflex accent
Ë Ë Ë uppercase E, umlaut
Ì Ì Ì uppercase I, grave accent
Í Í Í uppercase I, acute accent
Î Î Î uppercase I, circumflex accent
Ï Ï Ï uppercase I, umlaut
Ð Ð Ð uppercase Eth, Icelandic
Ñ Ñ Ñ uppercase N, tilde
Ò Ò Ò uppercase O, grave accent
Ó Ó Ó uppercase O, acute accent
Ô Ô Ô uppercase O, circumflex accent
Õ Õ Õ uppercase O, tilde

Name Code Number Code Glyph Description
Ö Ö Ö uppercase O, umlaut
× × × multiplication sign
Ø Ø Ø uppercase O, slash
Ù Ù Ù uppercase U, grave accent
Ú Ú Ú uppercase U, acute accent
Û Û Û uppercase U, circumflex accent
Ü Ü Ü uppercase U, umlaut
Ý Ý Ý uppercase Y, acute accent
Þ Þ Þ uppercase THORN, Icelandic
ß ß ß lowercase sharps, German
à à à lowercase a, grave accent
á á á lowercase a, acute accent
â â â lowercase a, circumflex accent
ã ã ã lowercase a, tilde
ä ä ä lowercase a, umlaut
å å å lowercase a, ring
æ æ æ lowercase ae
ç ç ç lowercase c, cedilla
è è è lowercase e, grave accent

Name Code Number Code Glyph Description
é é é lowercase e, acute accent
ê ê ê lowercase e, circumflex accent
ë ë ë lowercase e, umlaut
ì ì ì lowercase i, grave accent
í í í lowercase i, acute accent
î î î lowercase i, circumflex accent
ï ï ï lowercase i, umlaut
ð ð ð lowercase eth, Icelandic
ñ ñ ñ lowercase n, tilde
ò ò ò lowercase o, grave accent
ó ó ó lowercase o, acute accent
ô ô ô lowercase o, circumflex accent
õ õ õ lowercase o, tilde
ö ö ö lowercase o, umlaut
÷ ÷ ÷ division sign
ø ø ø lowercase o, slash
ù ù ù lowercase u, grave accent
ú ú ú lowercase u, acute accent
û û û lowercase u, circumflex accent

Name Code Number Code Glyph Description
ü ü ü lowercase u, umlaut
ý ý ý lowercase y, acute accent
þ þ þ lowercase thorn, Icelandic
ÿ ÿ ÿ lowercase y, umlaut

Tuesday, May 20, 2008

var varNotes = varNotes.replace(
// Replace out the new line character.
new RegExp( “\\n“, “g” ),

// Put in … so we can see a visual representation of where
// the new line characters were replaced out.
“<br>”
);

Saturday, May 10, 2008

SSL in WEBLOGIC7.0

SSL Generation PROCESS

WEBLOGIC SSL Generation PROCESS

STEP 1:

The CertGen is only used for weblogic and works only on the system installed weblogic.

Set the class path in system environments variables to \bea\weblogic700\server\lib\weblogic.jar

Generate a Private key and a certificate (public key) using CertGen

Syntax:

Java utils.CertGen [EXPORT] [hostname]

Password : This is the password given to the private key.

Certfilename : This is the file name for the certificate. This is also called Public keyfilename : This is the name of the private key file.

Export : use this option, so that weblogic accepts the key.

Hostname : By default the hostname is the system name.

E.g.:

Java utils.CertGen satish123 weblogiccert weblogickey export www.credense.com

The files generated by the above example are:

Public keys (certificates)

Weblogiccert.pem (this is in pem format)

Weblogiccert.der (this is in der format)

Private keys:

Weblogickey.pem (this key is in pem format)

Weblogickey.der (this key is in der format)

STEP 2:

Then generate a jks file using the above-generated private and public keys.

If we give an already existing file for a jks then the importprivatekey will override the contents and generate a new file so careful when giving the jks file name.

Syntax:

Java utils.ImportPrivateKey keystore keystorepass alias keypass certfile keyfile

E.g.: java utils.ImportPrivateKey satish.jks satish123 weblogickey satish123 weblogiccert.der weblogickey.der

Keystore : Name of the keystore (jks file name)

Keystorepass : Password for keystore.

Alias : this is the name we have to give in Server Private Key Alias in weblogic console (see below fig).

Keypass :Password of the private key given when generating the key

Certfile :name of the certificate filename.

Keyfile :name of the private key filename.

STEP 3:

The below step is not necessary if we give the path in the startWebLogic.cmd

The trustedCAKeyStore is the path and name of the java key store (jks)

And the pkpassword is the password for the keystore.

If we have not given this weblogic will take the default keystore as j2sdk1.4.2_10\jre\lib\security\cacerts and the default password is “changeit” if we have not given the string . -Dweblogic.management.pkpassword in startweblogic.cmd.

set JAVA_OPTIONS=-Dweblogic.management.pkpassword=satish123

set JAVA_OPTIONS=-Dweblogic.security.SSL.trustedCAKeyStore=D:\Satish\ssl\keys\satish.jks

Then import the above generated public key or certificate to

j2sdk1.4.2_10\jre\lib\security\cacerts

STEP 4:

Configuration in weblogic7.0 server

Go to https://localhost:7002/console

Now go to servers select myserver à connections à SSL

Set the default key store

Private Key Store Location:

To the jks that is generated for weblogic

Private Key Store Pass Phrase: Give the password