Re: nmap..... via web

["David G. Andersen" <danderse () cs utah edu>]

Lo and Behold, ajax said:
> > This doesn't look very sufficent to me.  For example, the banned chars
> > don't include space or '-'.  So what is to stop someone from giving an IP
>
> i added the '-' check... its hard to embed a %0D%0A because '%' is already
> checked.  also added checking for '/'. i'll make the script have
> clickable

[...]

  You're taking the wrong approach here.  Fyodor alluded to the right
way to go about this in his message.  Repeat the first mantra of
security after me:

  "Deny everything which is not explicitly allowed."

  Then, apply it to your CGI script:

  if ($ip_addr =~ /[^a-zA-Z0-9\.\-]/) {
        die "Invalid IP address.  Go away, don't try to hack me.\n";
  }

  (A valid hostname or IP address may only contain alphanumerics and
the dash character.  So why even bother checking for badness, when
there's such a simple test for goodness?)

    -Dave, "two scoops of goodness in every package"

--
work: danderse () cs utah edu                     me:  angio () pobox com
      University of Utah                            http://www.angio.net/
      Computer Science - Flux Research Group