You are not protected. That parameter is a standard thing to try, along with various variations of it. You may need to vary the number of ..'s, you may need to fool an RE or two, but there are a finite number of combinations to use, and eventually you will hit one.
You see there are a limited number of basic attacks the attacker will be trying to get to happen. There are a collection of ways to fool standard code with standard mistakes into falling for something interesting. And your code has a set of input parameters. So the script kiddie is going to list your parameters, and then plug a series of inputs in, until something interesting happens, and this attack will be on the list of obvious things to try.
Were your code written in C an attacker could similarly pass longer and longer parameters until they got evidence something crashed. Once it crashes then you play around figuring out at what length it crashes. Once you know that then you start putting interesting exploits at that position. Again, it takes virtually no knowledge of the specifics of the code to figure out how to abuse it. Perl is virtually immune to buffer overflows, but they make up the most commonly reported security errors.
And that is the key. Identify an easy to make mistake, start trying it out in random places. Eventually you find a way in. The key is not to analyze any one target in depth and break in there, rather it is to rattle a lot of doors until one falls apart. And once you break one door, probably lots more have the same flaw...
Another fun one is default passwords. For instance Microsoft's SQL Server had a default login for the longest time. It has been fixed for a year now, but plenty of sites still have the login. So go, try that key on enough sites, and eventually you will get a database of credit cards.
It is as easy as that!
Really. :-( | [reply] |
| [reply] |
How would any hacker/cracker/punk know to try that parameter with my script? Am I not protected by obscurity?
Not if they realized it came from Matts Script Archive...
--Chris
e-mail jcwren | [reply] |
He he... I liked this answer. Say you foolishly put an ad on your site for the legendary archive. Hacker gets idea... This guy doesn't write secure code... lets find the holes! ++ for jcwren
| [reply] |
Maybe because due to an unrelated security hole the
bad guy got your script code to be displayed?
TIMTOWTDI applies to cracking too, the bad guys can
get in through a single gaping hole but also through
a series of just slightly insecure features in your
code
| [reply] |
Still playing the Devil's Advocate here. (Thank's Ovid for recognizing the usefulness of playing dumb. )
But no one sees this code...
Except your co-worker that wants you fired cause your oversized paycheck puts a real damper on the funds available for raises. Or the new site Admin accidentally re-configured Apache to display CGI scripts as text files instead of running them. The list goes on. ++ for mirod
| [reply] |
