spoofing question

[Stephanie Stowe]

Hi. I have an ASP page which stores a cookie. That cookie is then read on a
different server. This is the crux of an ASP / JSP bridge I am creating for
allowing a user to seemlessly switch from an ASP service to a JSP service
and have their session state returned to them.

My question is, is there any way a hacker can spoof a cookie in a request?

Thanks

S

[Ray at]

"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:eE******** ******@TK2MSFTN GP09.phx.gbl...

My question is, is there any way a hacker can spoof a cookie in a request?

Yes.

Ray at work

[Stephanie Stowe]

"Ray at <%=sLocation% > [MVP]" <myfirstname at lane34 dot com> wrote in
message news:uL******** ******@TK2MSFTN GP12.phx.gbl...

"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:eE******** ******@TK2MSFTN GP09.phx.gbl...

My question is, is there any way a hacker can spoof a cookie in a request?

Yes.

Ray at work

Darn. How? NOW I do not want to spoof anyone. I want to make sure I do not
create spoofable stuff. I have to understand how the spoof is done. Probably
my idea is not salvagable. (Which is a drag.) But I guess I would still like
to know. I suppose I could encryt...

Thanks

S

[Stephanie Stowe]

"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:OJ******** *****@TK2MSFTNG P11.phx.gbl...

"Ray at <%=sLocation% > [MVP]" <myfirstname at lane34 dot com> wrote in
message news:uL******** ******@TK2MSFTN GP12.phx.gbl...

"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:eE******** ******@TK2MSFTN GP09.phx.gbl...

My question is, is there any way a hacker can spoof a cookie in a request?
Yes.

Ray at work

Darn. How? NOW I do not want to spoof anyone. I want to make sure I do not
create spoofable stuff. I have to understand how the spoof is done.

Probably my idea is not salvagable. (Which is a drag.) But I guess I would still like to know. I suppose I could encryt...

Thanks

S

Never mind. That was a dubm question. I tend to forget that a web browser is
not the only thing capable of creating an http request.

S

[Ray at]

"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:OJ******** *****@TK2MSFTNG P11.phx.gbl...

Darn. How? NOW I do not want to spoof anyone. I want to make sure I do not
create spoofable stuff. I have to understand how the spoof is done. Probably my idea is not salvagable. (Which is a drag.) But I guess I would still like to know. I suppose I could encryt...

I don't really know exactly how, since I'm an honest non-hacking person. ;]
But, I've written some vbscript code before to send http requests to sites
with cookies for legitimate reasons. I could put in bogus values if I
wanted to.

Cookies are a nice convenience tool, but shouldn't really be used as a
security tool if possible.

Ray at work

[Dave Anderson]

"Stephanie Stowe" wrote:

My question is, is there any way a hacker can spoof a cookie
in a request?

Yes.

Darn. How? NOW I do not want to spoof anyone. I want to make
sure I do not create spoofable stuff.

It rather depends on what you mean by "spoofable" . Are you trying to prevent
someone from guessing a cookie value? Are you trying to prevent multiple
users from sharing (knowingly or not) access to the same session/record?

I assume from your original post that this is a session management question,
in which case you may be concerned about either of the above.

If your ASP and JSP services have access to the same data store, you can
pass the session id through the cookie (or even the QueryString) and store
shared session variables in the DB. A SQL Server GUID might be useful for
generating "unguessabl e" session IDs. See this for pros and cons:
http://www.devx.com/dbzone/Article/10167

As for restricting access, the receiving script can compare various Request
headers (REMOTE_HOST, USER_AGENT, HTTP_ACCEPT, etc.) to those stored in the
DB by the sending script (in the record matching the shared session ID).
Some of the headers to consider are in this list of ServerVariables :
http://msdn.microsoft.com/library/en...rvariables.asp

--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms. Please do not contact
me directly or ask me to contact you directly for assistance. If your
question is worth asking, it's worth posting.

[Stephanie Stowe]

"Dave Anderson" <GT**********@s pammotel.com> wrote in message
news:%2******** ********@TK2MSF TNGP12.phx.gbl. ..

"Stephanie Stowe" wrote:

My question is, is there any way a hacker can spoof a cookie
in a request?

Yes.
Darn. How? NOW I do not want to spoof anyone. I want to make
sure I do not create spoofable stuff.

It rather depends on what you mean by "spoofable" . Are you trying to

prevent someone from guessing a cookie value? Are you trying to prevent multiple
users from sharing (knowingly or not) access to the same session/record?

Both. The accessing the same session/record I am concerned about in a
separate post that I will be making after replying to this one. The question
I asked was about guessing the session id.
I assume from your original post that this is a session management question, in which case you may be concerned about either of the above.

If your ASP and JSP services have access to the same data store, you can
pass the session id through the cookie (or even the QueryString) and store
shared session variables in the DB. A SQL Server GUID might be useful for
generating "unguessabl e" session IDs. See this for pros and cons:
http://www.devx.com/dbzone/Article/10167
I am not at liberty to do this as I do not have SQL Server. We use DB2 on
the iSeries. More in a new post this am.
As for restricting access, the receiving script can compare various Request headers (REMOTE_HOST, USER_AGENT, HTTP_ACCEPT, etc.) to those stored in the DB by the sending script (in the record matching the shared session ID).
Some of the headers to consider are in this list of ServerVariables :
http://msdn.microsoft.com/library/en...rvariables.asp

Thanks.

S

[Dave Anderson]

"Stephanie Stowe" wrote:

http://www.devx.com/dbzone/Article/10167

I am not at liberty to do this as I do not have SQL Server. We use
DB2 on the iSeries. More in a new post this am.

The GUID suggestion was merely one way of creating an "unguessabl e" session
id. You don't need SQL Server to create one:

[JScript example]
Server.CreateOb ject("Scriptlet .TypeLib").GUID .replace(/[{}]/g,"")
(The object has a .GUID string property)

You certainly can implement your own, for that matter. For example, you
could randomly generate a string of digits and check your db for uniqueness.

How many digits would suffice? Suppose you use the GUID as an example of a
sufficient space. There are (2^8)^16 (or
3.4028236692093 846346337460743 177e+38) possible values. Using just the
characters [0-9], you would need 38.53 characters to cover the same range of
values. Using [A-Z], you would need 27.23 characters. Combining them,
[A-Z0-9] requires strings of length 24.76, [a-zA-Z] needs 22.45, [A-Za-z0-9]
needs 21.50 characters.

Obviously, there is no such thing as a string of length 38.53. But by
choosing 39 character strings of [0-9], you guarantee a space at least as
large as the GUID space. Does that seem like ling strings? Consider that it
takes 32 hex characters to express a 16-byte GUID value.

Some of the same pitfalls apply to self-generated session ids as to GUIDs,
BTW. Their length makes them make poor primary keys, for example.

For what it's worth, script-based random number generation is not exactly
random.
--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms. Please do not contact
me directly or ask me to contact you directly for assistance. If your
question is worth asking, it's worth posting.

[Mark Schupp]

You can create a GUID in an ASP script using the scripting.typel ib object. I
don't have the exact code handy but it should be on some of the ASP sites.

One thing to note however is that a GUID is built according to specific
rules so it is not "unguessabl e". It is very unlikely to be guessed however.

--
Mark Schupp
Head of Development
Integrity eLearning
www.ielearning.com
"Stephanie Stowe" <st***@whackthi svsac.org> wrote in message
news:%2******** ********@TK2MSF TNGP09.phx.gbl. ..

"Dave Anderson" <GT**********@s pammotel.com> wrote in message
news:%2******** ********@TK2MSF TNGP12.phx.gbl. ..

"Stephanie Stowe" wrote:

My question is, is there any way a hacker can spoof a cookie
in a request?
>
> Yes.

Darn. How? NOW I do not want to spoof anyone. I want to make
sure I do not create spoofable stuff.
It rather depends on what you mean by "spoofable" . Are you trying to

prevent

someone from guessing a cookie value? Are you trying to prevent multiple
users from sharing (knowingly or not) access to the same session/record?

Both. The accessing the same session/record I am concerned about in a
separate post that I will be making after replying to this one. The

question I asked was about guessing the session id.

I assume from your original post that this is a session management

question,

in which case you may be concerned about either of the above.

If your ASP and JSP services have access to the same data store, you can
pass the session id through the cookie (or even the QueryString) and store shared session variables in the DB. A SQL Server GUID might be useful for generating "unguessabl e" session IDs. See this for pros and cons:
http://www.devx.com/dbzone/Article/10167

I am not at liberty to do this as I do not have SQL Server. We use DB2 on
the iSeries. More in a new post this am.

As for restricting access, the receiving script can compare various

Request

headers (REMOTE_HOST, USER_AGENT, HTTP_ACCEPT, etc.) to those stored in

the

DB by the sending script (in the record matching the shared session ID).
Some of the headers to consider are in this list of ServerVariables :
http://msdn.microsoft.com/library/en...rvariables.asp

Thanks.

S

[Dave Anderson]

"Mark Schupp" wrote:

One thing to note however is that a GUID is built according to
specific rules so it is not "unguessabl e". It is very unlikely
to be guessed however.

I would think the ability to guess it would be considerably easier if the
MAC address used to generate it is known. So here's a challenge -- tell me
the MAC Address that generated this GUID:

89C9B0FE-2EDE-4BA9-96F0-84C629EA1146
--
Dave Anderson

Unsolicited commercial email will be read at a cost of $500 per message. Use
of this email address implies consent to these terms. Please do not contact
me directly or ask me to contact you directly for assistance. If your
question is worth asking, it's worth posting.