WebApp Sec: Re: Protecting posted variables

["Brian Rectanus" <brectanu () gmail com>]

On 21 Jul 2006 05:31:01 -0000, billy.sailing () gmail com
<billy.sailing () gmail com> wrote:
> Outside of encrypting in SSL, how can variables being posted from the browser back to the server be protected from 
> prying eyes?
Hello,

As stated by many others, there is not much you can do about user
entered data fields.  However, if you want to do something about
securing and/or tamper-proofing hidden form fields and various forms
of session and state sent to the client, then check out
isecauditors.com and their paper (Advanced Web Application Defense
with ModSecurity) on adding crypto and signing features to
mod_security for apache httpd.  This looks to be a promising new
addition to mod_security...

http://www.isecauditors.com/eng/des-presentaciones.html

later,
-B

-------------------------------------------------------------------------
Sponsored by: Watchfire

AppScan 6.5 is now available! New features for Web Services Testing, 
Advanced Automated Capabilities for Penetration Testers, PCI Compliance 
Reporting, Token Analysis, Authentication testing, Automated JavaScript 
execution and much more. 
Download a Free Trial of AppScan today!
https://www.watchfire.com/securearea/appscancamp.aspx?id=70150000000CYkc
-------------------------------------------------------------------------