View/Open - JUWEL - Forschungszentrum Jülich

Hacking and Protecting a Cultural Website : The Case ofCVC
Authorization from the development point of view
Once the system has authenticated the entrance of a user, depending on the user's
profile, one setting or another will be accessed. Moreover, depending on the access level
some operations will be carried out and others won't.
Talking about the different profiles a student could have in our Spanish course, I'll say
that we have got two different setting .
Administration setting.
User's setting.
Each user who enters in each setting has gos a specific profile which allows him to enter
a specific private module.
When talking about the administration setting the profiles a user can have are the
following ones :
Administrator
Deputy Head of the Cervantes Institute
Deputy Head of linguistic technology
Administrative officer
Depending on their profile, each user will do more or less restricted operations .
Measures to take when developing a web page :
Html comments
The navigator ignores all the html comments when showing the page, but the comments
can be seen when having a lot at the page code. So in this case we must be careful with
the comments we write .
Links
The links can help us to understand the logic of the application. Moreover, used
technologies can be identified.
E-mail addresses
Many pages have got references to e-mail addresses. They could be used by Spammers
to obtain addresses to which they could send virus .
Hidden fields
You must be careful because the hidden fields can show parameters ofthe application.
Measures to take against invalid entrance attacks
Canonization
Files inclusions containing the route " . ./" due to security primary route accesses are not
allowed .
Buffer overflow
When developing certain functions care must be taken because they can provoke
overflow which would change the return address .
8 8