Re: [WebDNA] PCI Vulnerability testing

This WebDNA talk-list message is from

2009

It keeps the original formatting. numero = 102403
interpreted = N
texte = I arrived at my solution after several months of testing with HackerSafe.I originally had [removehtml] but then that was wiping out the ability to use html code in my own forms if I wanted to, and it was a total detriment to

input in the CMS.Matthew A Perosi JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer 323 Union Blvd. Totowa, NJ 07512Pre-Sales: 888.872.0274Service: 973.413.8213Training: 973.413.8214Fax: 973.413.8217http://www.jewelerwebsites.comhttp://en.wikipedia.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.comGovinda wrote:> Yes, of course.. I looked so quickly at it I didn't pay attention to > the [url] and [input] contexts.>> Does anyone think there is any need for this level of cleaning if the > data has already been cleaned with [removehtml]? I.e. without "<" and > ">" can any serious harm be done?> -G>> On Apr 13, 2009, at 2:01 PM, Psi Prime, Matthew A Perosi wrote:>>> [text][url][name][/url]=[input][value][/input][/text]>> ^^^>> This line is used to totally clean the input.>>>> WebDNA manages variables in different levels. Whatever level you are >> in right now will use the most recently declared set of variables. A >> level can be viewed as any looping construct, like [loop] or >> [founditems], etc...>>>> So here's how that line of code works...>> [formvariables] will give you all the variables incoming to the page.>>>> You can then create another set of identical variables with the same >> name using [url][name][/url].>> This new set of variables will become the actual variables that are >> used on the page, instead of the [formvariables].>>>> When you [url] all of the names you effectively kill all attacks >> because all the bad characters are converted to url'd values.>>>> The re-declaration of all the variables will not hurt your variables >> in any way since normal variable names don't have strange >> characters... so they pass right through unharmed.>>>> Matthew A Perosi JewelerWebsites.com>> ------------------------------by Psi Prime------->> Senior Web Developer 323 Union Blvd.>> Totowa, NJ 07512>> Pre-Sales: 888.872.0274>> Service: 973.413.8213>> Training: 973.413.8214>> Fax: 973.413.8217>>>> http://www.jewelerwebsites.com>> http://en.wikipedia.org/wiki/Psi_Prime%2C_Inc>> http://www.psiprime.com>>>>>>>> Govinda wrote:>>>>>> On Apr 13, 2009, at 1:35 PM, Psi Prime, Matthew A Perosi wrote:>>>>>>> This seems to work for me.>>>> It seems to stand up to the attacks from McAfee Secure>>>>>>>> [formvariables]>>>> [showif [url][name][/url]^script>][redirect /index.html][/showif]>>>> [showif [url][name][/url]^iframe][redirect /index.html][/showif]>>>>>>>>>>> [text][url][name][/url]=[input][value][/input][/text]>>>>>> what is this line ^^^ for in this context?>>>>>>>>>>> [/formvariables]>>>> [showif [countchars][cart][/countchars]>18][redirect >>>> /index.html][/showif]>>>>>>>>>> --------------------------------------------------------->> This message is sent to you because you are subscribed to>> the mailing list <talk@webdna.us>.>> To unsubscribe, E-mail to: <talk-leave@webdna.us>>> archives: http://mail.webdna.us/list/talk@webdna.us>> old archives: http://dev.webdna.us/TalkListArchive/>> ---------------------------------------------------------> This message is sent to you because you are subscribed to> the mailing list <talk@webdna.us>.> To unsubscribe, E-mail to: <talk-leave@webdna.us>> archives: http://mail.webdna.us/list/talk@webdna.us> old archives: http://dev.webdna.us/TalkListArchive/>>

Associated Messages, from the most recent to the oldest:

<li><a href="page.dna?numero=102414">Re: [WebDNA] PCI Vulnerability testing</a> ("Psi Prime, Matthew A Perosi " <matt@psiprime.com> 2009)</li>

<li><a href="page.dna?numero=102411">Re: [WebDNA] PCI Vulnerability testing</a> (Jeffrey Jones <jjones@synergos.com> 2009)</li>

<li><a href="page.dna?numero=102409">Re: [WebDNA] PCI Vulnerability testing</a> ("Psi Prime, Matthew A Perosi " <matt@psiprime.com> 2009)</li>

<li><a href="page.dna?numero=102408">Re: [WebDNA] PCI Vulnerability testing</a> (William DeVaul <wdevaul@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102404">Re: [WebDNA] PCI Vulnerability testing</a> (Jeffrey Jones <jjones@synergos.com> 2009)</li>

<li>Re: [WebDNA] PCI Vulnerability testing ("Psi Prime, Matthew A Perosi " <matt@psiprime.com> 2009)</li>

<li><a href="page.dna?numero=102402">Re: [WebDNA] PCI Vulnerability testing</a> (Govinda <govinda.webdnatalk@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102401">Re: [WebDNA] PCI Vulnerability testing</a> ("Psi Prime, Matthew A Perosi " <matt@psiprime.com> 2009)</li>

<li><a href="page.dna?numero=102400">Re: [WebDNA] PCI Vulnerability testing</a> (Govinda <govinda.webdnatalk@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102399">Re: [WebDNA] PCI Vulnerability testing</a> ("Psi Prime, Matthew A Perosi " <matt@psiprime.com> 2009)</li>

<li><a href="page.dna?numero=102398">Re: [WebDNA] PCI Vulnerability testing</a> (William DeVaul <wdevaul@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102397">Re: [WebDNA] PCI Vulnerability testing</a> (Govinda <govinda.webdnatalk@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102396">Re: [WebDNA] PCI Vulnerability testing</a> (Marc Thompson <mthompson@media.utah.edu> 2009)</li>

<li><a href="page.dna?numero=102395">Re: [WebDNA] PCI Vulnerability testing</a> (William DeVaul <wdevaul@gmail.com> 2009)</li>

<li><a href="page.dna?numero=102394">[WebDNA] PCI Vulnerability testing</a> (Bob Minor <bob@cybermill.com> 2009)</li>

</ol>
</td></tr></table>

I arrived at my solution after several months of testing with HackerSafe.I originally had <a target="_parent" href="page.dna?numero=266">[removehtml]</a> but then that was wiping out the ability to use html code in my own forms if I wanted to, and it was a total detriment to <textarea> input in the CMS.Matthew A Perosi JewelerWebsites.com------------------------------by Psi Prime-------Senior Web Developer 323 Union Blvd. Totowa, NJ 07512Pre-Sales: 888.872.0274Service: 973.413.8213Training: 973.413.8214Fax: 973.413.8217http://www.jewelerwebsites.comhttp://en.wikipedia.org/wiki/Psi_Prime%2C_Inchttp://www.psiprime.comGovinda wrote:> Yes, of course.. I looked so quickly at it I didn't pay attention to > the <a target="_parent" href="page.dna?numero=89">[url]</a> and <a target="_parent" href="page.dna?numero=182">[input]</a> contexts.>> Does anyone think there is any need for this level of cleaning if the > data has already been cleaned with <a target="_parent" href="page.dna?numero=266">[removehtml]</a>? I.e. without "<" and > ">" can any serious harm be done?> -G>> On Apr 13, 2009, at 2:01 PM, Psi Prime, Matthew A Perosi wrote:>>> <a target="_parent" href="page.dna?numero=77">[text]</a><a target="_parent" href="page.dna?numero=89">[url]</a>[name][/url]=<a target="_parent" href="page.dna?numero=182">[input]</a>[value][/input][/text]>> ^^^>> This line is used to totally clean the input.>>>> WebDNA manages variables in different levels. Whatever level you are >> in right now will use the most recently declared set of variables. A >> level can be viewed as any looping construct, like <a target="_parent" href="page.dna?numero=245">[loop]</a> or >> <a target="_parent" href="page.dna?numero=93">[founditems]</a>, etc...>>>> So here's how that line of code works...>> <a target="_parent" href="page.dna?numero=249">[formvariables]</a> will give you all the variables incoming to the page.>>>> You can then create another set of identical variables with the same >> name using <a target="_parent" href="page.dna?numero=89">[url]</a>[name][/url].>> This new set of variables will become the actual variables that are >> used on the page, instead of the <a target="_parent" href="page.dna?numero=249">[formvariables]</a>.>>>> When you <a target="_parent" href="page.dna?numero=89">[url]</a> all of the names you effectively kill all attacks >> because all the bad characters are converted to url'd values.>>>> The re-declaration of all the variables will not hurt your variables >> in any way since normal variable names don't have strange >> characters... so they pass right through unharmed.>>>> Matthew A Perosi JewelerWebsites.com>> ------------------------------by Psi Prime------->> Senior Web Developer 323 Union Blvd.>> Totowa, NJ 07512>> Pre-Sales: 888.872.0274>> Service: 973.413.8213>> Training: 973.413.8214>> Fax: 973.413.8217>>>> http://www.jewelerwebsites.com>> http://en.wikipedia.org/wiki/Psi_Prime%2C_Inc>> http://www.psiprime.com>>>>>>>> Govinda wrote:>>>>>> On Apr 13, 2009, at 1:35 PM, Psi Prime, Matthew A Perosi wrote:>>>>>>> This seems to work for me.>>>> It seems to stand up to the attacks from McAfee Secure>>>>>>>> <a target="_parent" href="page.dna?numero=249">[formvariables]</a>>>>> [showif <a target="_parent" href="page.dna?numero=89">[url]</a>[name][/url]^script>][redirect /index.html][/showif]>>>> [showif <a target="_parent" href="page.dna?numero=89">[url]</a>[name][/url]^iframe][redirect /index.html][/showif]>>>>>>>>>>> <a target="_parent" href="page.dna?numero=77">[text]</a><a target="_parent" href="page.dna?numero=89">[url]</a>[name][/url]=<a target="_parent" href="page.dna?numero=182">[input]</a>[value][/input][/text]>>>>>> what is this line ^^^ for in this context?>>>>>>>>>>> [/formvariables]>>>> [showif <a target="_parent" href="page.dna?numero=218">[countchars]</a><a target="_parent" href="page.dna?numero=223">[cart]</a>[/countchars]>18][redirect >>>> /index.html][/showif]>>>>>>>>>> --------------------------------------------------------->> This message is sent to you because you are subscribed to>> the mailing list <talk@webdna.us>.>> To unsubscribe, E-mail to: <talk-leave@webdna.us>>> archives: http://mail.webdna.us/list/talk@webdna.us>> old archives: http://dev.webdna.us/TalkListArchive/>> ---------------------------------------------------------> This message is sent to you because you are subscribed to> the mailing list <talk@webdna.us>.> To unsubscribe, E-mail to: <talk-leave@webdna.us>> archives: http://mail.webdna.us/list/talk@webdna.us> old archives: http://dev.webdna.us/TalkListArchive/>>

"Psi Prime, Matthew A Perosi " <matt@psiprime.com>

<a href="page.dna?numero=169">
DOWNLOAD WEBDNA NOW!
</a>

<h3>Top Articles:</h3>

<a href="page.dna?numero=55">Talk List</a>
 
The WebDNA community talk-list is the best place to get some help: several hundred extremely proficient programmers with an excellent knowledge of WebDNA and an excellent spirit will deliver all the tips and tricks you can imagine...

<h3>Related Readings:</h3>
 
<a href="page.dna?numero=13567">WebCat Emailer & Liststar (1997)</a>
 
<a href="page.dna?numero=20311">Forwarding Orders Via Email (1998)</a>
 
<a href="page.dna?numero=10783">WebCat2b15MacPlugin - [protect] (1997)</a>
 
<a href="page.dna?numero=10702">WebCat2b15MacPlugIn - [authenticate] not [protect] (1997)</a>
 
<a href="page.dna?numero=32052">Append..... doesn't (2000)</a>
 
<a href="page.dna?numero=68445"> Obtaining a dice result (2007)</a>
 
<a href="page.dna?numero=10636">PCS Customer submissions ? (1997)</a>
 
<a href="page.dna?numero=12462">[delete] problem (1997)</a>
 
<a href="page.dna?numero=17224">listfiles, moving files (1998)</a>
 
<a href="page.dna?numero=29301">Setting user/password with a form. (2000)</a>
 
<a href="page.dna?numero=12007">form data submission gets truncated (1997)</a>
 
<a href="page.dna?numero=10358">Help! WebCat2 bug (1997)</a>
 
<a href="page.dna?numero=18487">two of the same named db's open at once (1998)</a>
 
<a href="page.dna?numero=10583">[AppendFile] problem (WebCat2b13 Mac .acgi) (1997)</a>
 
<a href="page.dna?numero=11254">international time (1997)</a>
 
<a href="page.dna?numero=21716">shipCost (1998)</a>
 
<a href="page.dna?numero=10635">PSC recommends what date format yr 2000??? (1997)</a>
 
<a href="page.dna?numero=12266">More questions about serial number dishing (1997)</a>
 
<a href="page.dna?numero=24154">Setheader question (1999)</a>
 
<a href="page.dna?numero=12493">Another question (1997)</a>

</div>
</body>
</html>