Question

您有用户,在网上卡菲机器中成功登录,Hacker H能够传播网络并接上用户会议。 • 接收另一个机器并充当用户?

H 能否进入<代码>http://rafter/(session id)/CreditCard Information.aspx,以了解用户的信用卡号码?

Answer 1

我担心没有人列出这2起袭击:

1) Session Fixation A hacker vists your web site and gets one of these session urls. He then sends out many spoofed emails to probable users to make them appear as though they are coming from your site. The email is asking the to login and they are given a session url by the attacker. Then, the attacker checks the session url periodically to see if someone has authenticated. If they have, then the attack succeeded and the hacker just stole an account. A fix to this issue is to store the user s ip address in a session variable upon creation and check it for each request. If you are only passing the session id via Cookie then an attacker cannot set the cookie value on another browser for a domain he doesn t control, thus this attack cannot be carried out.

2) A Printer: Sometimes people print a a page from a website. Ever look at the very bottom of a page printed from a website? Well, usually the URL of the page is there. If you where to print out a page, and then give it to someone it is as if you just wrote down your username/password and gave it to them.

www.un.org/Depts/DGACM/index_spanish.htm 避免所有费用的会议次数。

将SSL用于entire session。如果你不这样做,你就会泄露会议(如果你使用 co!)是真的。使用Ssl是A3“Broken Authentication and Session management”的明显要求, OWASP 10,2010年。

Answer 2

这取决于许多事情。

基本上,如果你知道有URL,你就可以看到后面的东西。黑客一旦开斋,就能够做他想要做的一切。

如果黑客能够进入http://www.un.org/Depts/DGACM/index_french.htm,则该黑客也可以被该黑客拦截。

尽管如此,还可以另外建立一些证券。例如:

(session id) should be valid only for a short period
(session id) can be valid only for a specific IP (the IP that created the session)
(session id) can be valid only for a certain user-agent / flash version / .. signature
(session id) can be changed for each new page view, deprecating the previous session_id

在处理信用卡信息时,

Always use https. It is more secure because the datas are encrypted between at least the browser and the first https proxy on the route to the server

The case when you would need to manipulate credit card information yourself are rare. Websites handling credit card by themselves nowadays are more and more forced to respect the PCI/DSS rules which can be quite a burden. You should probably get a contract with a banking solution where the credit card will be submited on their web pages, or use paypal for instance.
Never keep credit card information in your database unless you have the necessary security solutions in place, with a regular external audit.

The following link 不妨进一步深入了解会议最佳做法。

I hope this will help you Jerome WAGNER

Answer 3

是的。

如果黑客们 session开你的会议,他就可以在这个网站上做任何事情。

为了防止这种情况,认证表格和随后的所有网页总是用在https上。除其他外,https 消除(或减少)中度攻击中的男子。

Answer 4

换言之,是出于其他招贴画所描述的理由。

当然,如果你利用无加密的吉大港银行连接通过信用卡信息,他就能够直接揭发信用卡,不管你进入什么时候。不管用什么会议方法,你们都必须执行sl/https。

友情链接