Re: Hacking CGI - security and exploitation

I didn't really see too too much that was new on that article that couldn't have been found here.

Many of the vulnerabilities mentioned are things that should set off alarms in a programmers head in the first place. I can't imagine anyone actually providing a direct portal to files via a form. The SSI, VB and Javascript stuff was interesting, but I'd already read about that sort of thing here.

There was a tone in the article that implied Perl was not suited for CGI as it was not written with the net in mind, but neither was much else. I felt like b0iler was placing the responsibility on the language as opposed to the programmer. I didn't like that.

Every language has its vulnerabilities and good coding practice in any language is important. 'Twas a nifty little article and it had some valid points, but anyone who does anything in CGI should study the topic very closely before they use a script anyway.

Comment on Re: Hacking CGI - security and exploitation

Replies are listed 'Best First'.
Re: Re: Hacking CGI - security and exploitation by cjf (Parson) on Jun 24, 2002 at 21:07 UTC
I can't imagine anyone actually providing a direct portal to files via a form. There have been two recent cases on this site where someone has linked to code they've inherited/written that has done this (and more). Luckily, in both cases they were very open to suggestions and took the code down immediately and went off to learn more about security. anyone who does anything in CGI should study the topic very closely before they use a script anyway. Should and do are two very different things. It's no secret that many people first come into contact with Perl by trying to write a script for their website. Saying "well you should have studied security" after the fact is of little use. The more that is written on the subject, and the more commonplace it becomes, the better.	[reply]
Re: Re: Re: Hacking CGI - security and exploitation by meraxes (Friar) on Jun 25, 2002 at 00:27 UTC
Fair enough. I guess it was a bit of a knee jerk reaction. I'm just not fond of those who blame the tool instead of the user (and to me that seemed to be what the author was doing). The presentation seemed a little cavalier to me. I'm mediocre at best (but improving, thanks perl monks) and tend to be very paranoid. However, it still seems horrifically lax not to look up these sorts of things (to me at least). I do mostly data munging so I'm hardly an expert. You are right though. Consider me properly chastised. :)	[reply]
Re: Re: Hacking CGI - security and exploitation by IlyaM (Parson) on Jun 24, 2002 at 19:31 UTC
I didn't really see too too much that was new on that article that couldn't have been found here. I agree. There is nothing really new but I've never seen before one paper which summaries several different vulnerabilities like this one. I like this article because it is good introduction for newbie programmers as it covers several topics at same time. -- Ilya Martynov (http://martynov.org/)	[reply]