Application security, https, web security, sniffing, cryptography, owasp, vulnerability, threat, exploit, webgoat, samurai WTF, webscarab, w3af, zed proxy, acunetix, burpsuite, secure authentication, parameter modification, sql injection, session ID prediction, session management, cross site scripting, reflected xss, stored xss, application security proxy, xst, csrf

1. PARAMETER Tampering
HOW VULNERABLE IS MY WEB APPLICATION
FROM A DEVELOPER’S ANGLE…
Dilan Warnakulasooriya Asanka Fernandopulle
Information Security Engineer Senior Software Engineer
99X Technology 99X Technology

2. What is it?
 Parameters are altered in an unexpected way
 Lots of areas for tampering!!!
 Query string, cookies, form fields, database fields
 Can result in other attacks (SQL Injection, XSS
for ex)
January 1, 2013 99X Technology(c) 2

3. How it is exploited?
 Many times simple „playing‟ with parameters in
the query string
 Fiddler can intercept data
 Proxies can be attacked (Man in the middle)
 Plug-ins can show data
 Demos
January 1, 2013 99X Technology(c) 3

4. Prevention mechanisms
Demo – Preventing Tampering in MVC
January 1, 2013 99X Technology(c) 4

5. How do you prevent it?
 Web forms has „some‟ built in protection, MVC
doesn‟t
 EnableRequestValidation can be restrictive
 Use regular expressions to limit or validate data
 Ensure an input from the user is compared
against known server side information
 NEVER completely trust page data
 If you get an OrderId, validate the user has access to
that order
 If you get any form data, check it to make sure that
the user was supposed to have that as a viable
option
January 1, 2013 99X Technology(c) 5

6. Caution
 Caution of Request.Params[“parameterName”]
 Code may validate against
Request.Form[“CustomerId”]
 Code reads Request.Params[“CustomerId”]
 Attacker uses QueryString forged value which is
read first by Request.Params
 Caution of code methods returning IQueryable
to unknown callers
 Gives „evil code‟ a potential way to query your data
source
January 1, 2013 99X Technology(c) 6