Trustwave Application Penetration Test Digitaltransactions-080815

More documents

Recommendations

Info

CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY Trustwave Application Penetration Test The following URLs produced similar ColdFusion exceptions (malicious input highlighted): GET http://digitaltransactions.net/index.cfm?pageid=%27 POST /searchcollaction.cfm (collection=digitrans&searchstring=%27&search1=Search) POST /searchcollaction.cfm (collection='&searchstring=trustwave&search1=Search) GET /clickthru.cfm?adid=' GET http://www.digitaltransactions.net/newsstory.cfm?newsID=%27 POST http://www.digitaltransactions.net/searchdbaction.cfm (searchstring=%3E) Recommendation • At the template level, ensure all code that may cause an error or exception condition is properly wrapped in a cftry and cfcatch blocks. • At the application level, define custom templates for error conditions with the tag in the Application.cfm file. • Site-Wide error handling pages and Missing Template Handlers can be configured through the ColdFusion Administrator Server Settings page. In addition, the cferror tag can be used to specify ColdFusion pages to handle specific types of errors. • Consider logging error messages using the cflog tag. Related Information http://livedocs.adobe.com/coldfusion/7/htmldocs/wwhelp/wwhimpl/ common/html/wwhelp.htm?context=ColdFusion_Documentation& file=00001138.htm - 24 - Copyright © 2008 Trustwave. All Rights Reserved. CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY
CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY Trustwave Application Penetration Test - 25 - Copyright © 2008 Trustwave. All Rights Reserved. CONFIDENTIAL INFORMATION – FOR INTERNAL USE ONLY
Page 1 and 2: Boland Hills Application Penetratio
Page 3 and 4: CONFIDENTIAL INFORMATION - FOR INTE
Page 23: CONFIDENTIAL INFORMATION - FOR INTE

Trustwave Application Penetration Test Digitaltransactions-080815

Create successful ePaper yourself

Delete template?

Save as template?