Testing Your Forms for Hijacking Vulnerability

By Will Bontrager
2005-10-07


Testing Your Forms for Hijacking Vulnerability

DISCLAIMER: Experience has taught me it is impossible to know everything in cracker minds. Common sense security precautions when programming software go a long way to reducing vulnerabilities. And I've learned to anticipate things and reduce vulnerabilities ahead of time. But I can not, and I do not claim to, know everything software crackers have tried and will try in the future.

Look at this article as a "how-to" for testing your forms for a specific vulnerability, hijacking by inserting certain information into the header of email your form processing software sends out.

These tests may not be exhaustive. Crackers have devious minds and may even now be thinking of hijacking methods I haven't considered.

This article will, however, show you how to discover currently targeted vulnerabilities your form processing software might have, vulnerabilities mentioned in the "Web Page Form Anti-Hijacking Considerations" article found at http://willmaster.com/hijack1 (demonstrates how to modify software to close the hijacking vulnerability).

Tutorial Pages:
» Testing Your Forms for Hijacking Vulnerability
» Want To Skip Testing?
» Is a Spammer Spider On the Loose?
» Why Should I Test?
» Won't Spammers Use this Article To Find Vulnerable Forms?
» How Do I Test?
» Now What?


Copyright 2004 Bontrager Connection, LLC

Related Tutorials: » Enrich Your Web Applications » Microsoft Complicates HTML Emails With Outlook 2007 » Control Your Domain Registration Data » HTML Forms POST, GET » HTML Tables » Navigation Bar and Bulleted Lists