WebApp Sec: Re: When GET = POST?

[Alonso Robles <kha0z () earthlink net>]

Comments inline...

On Tuesday, November 5, 2002, at 02:54  AM, Chris Thomas wrote:

> Hi,
>
> This has been troubling me for  a while.
>
> When pen testing web apps where a page POSTs data it often seems just as
> effective (and easier) to encode the data in the URL (i.e. use and HTTP
> GET ). Is guess this is because many server-side languages do not
> differentiate how a variable is set?
Yes they do. While the retrieval mechanism can make the differentiation 
completely transparent for the web application developer, it is always 
good practice to call the expected variable from the header that is 
expected.
> Whilst, from a pen test perspective,  I can see there both positive and
> negative aspects to doing this, I'd like to understand it a bit better
> from the application designer's/ coder's viewpoint:
There are two reasons to consider using POST vs GET methods that come to 
mind from a developer perspective.
	1. Obfuscation: POST hides the variables from the URL that can be 
easily seen in any web browser. This makes any possible attacker have to 
work harder to check what variables and data types are passed in a post 
form.
	2. Amount of data and non-text data types: You can not pass binary 
data in the query string of a URL. Additionally, the HTTP RFCs limit the 
amount of data that can be passed in a GET header significantly to that 
in a POST header.
> - Why does it happen? Is it just lazy coding or do languages like ASP
> offer no way to differentiate if data was POSTed or GETed?
It is lazy coding and not secure.

> - How is this situation handled in common server side languages such
> PHP, etc?
Turn globals off!!! That is a major security issue anyway. You can refer 
to a POST variable in PHP by using the $_POST array to access the data. 
For example, if you are expecting a value for a variable you named 
"article" you can reference that data by using $_POST['article']. If you 
are expecting it in a GET header you can do it the same by referencing 
$_GET['article'].
> Chris