Improving Web Application Security: Threats and - CGISecurity

Chapter 2: Threats and Countermeasures 41Attacker Reveals Implementation DetailsOne of the important features of the .NET Framework is that it provides richexception details that are invaluable to developers. If the same information is allowedto fall into the hands of an attacker, it can greatly help the attacker exploit potentialvulnerabilities and plan future attacks. The type of information that could bereturned includes platform versions, server names, SQL command strings, anddatabase connection strings.Countermeasures to help prevent internal implementation details from beingrevealed to the client include:● Use exception handling throughout your application’s code base.●●Handle and log exceptions that are allowed to propagate to the applicationboundary.Return generic, harmless error messages to the client.Denial of ServiceAttackers will probe a Web application, usually by passing deliberately malformedinput. They often have two goals in mind. The first is to cause exceptions that revealuseful information and the second is to crash the Web application process. This canoccur if exceptions are not properly caught and handled.Countermeasures to help prevent application-level denial of service include:● Thoroughly validate all input data at the server.● Use exception handling throughout your application’s code base.Auditing and LoggingAuditing and logging should be used to help detect suspicious activity such asfootprinting or possible password cracking attempts before an exploit actually occurs.It can also help deal with the threat of repudiation. It is much harder for a user todeny performing an operation if a series of synchronized log entries on multipleservers indicate that the user performed that transaction.Top auditing and logging related threats include:● User denies performing an operation● Attackers exploit an application without leaving a trace● Attackers cover their tracks