HACK PROOFING COLDFUSION
CONTENTS INTRODUCTION UNDERSTANDING THE TERMS A BRIEF HISTORY OF HACKING TELEPHONE SYSTEM HACKING COMPUTER HACKING WHY SHOULD I THINK LIKE A HACKER? WHAT MOTIVATES A HACKER? ETHICAL HACKING VERSUS MALICIOUS HACKING MITIGATING ATTACK RISK IN YOUR COLDFUSION APPLICATIONS VALIDATING PAGE INPUT FUNCTIONALITY WITH CUSTOM TAGS AND CFMODULE THE TOP COLDFUSION APPLICATION HACKS FORM FIELD MANIPULATION URL PARAMETER TAMPERING CFFILE, CFPOP, AND CFFTP TAG MISUSE SECURITY CONCERNS WITH CFFILE, CFPOP, AND CFFTP COLDFUSION RDS COMPROMISE UNDERSTANDING HACKER ATTACKS DENIAL OF SERVICE VIRUS HACKING TROJAN HORSES WORMS CLIENT-BASED APPLETS CREDIT CARD THEFT IDENTITY THEFT PREVENTING “BREAK-INS” BY THINKING LIKE A HACKER DEVELOPMENT TEAM GUIDELINES QA TEAM GUIDELINES IT TEAM GUIDELINES SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 SECURING YOUR COLDFUSION DEVELOPMENT SESSION TRACKING CFID AND CFTOKEN ISSUES STOP SEARCH ENGINES FROM CATALOGING CFID/CFTOKEN ERROR HANDLING DETECTING AND USING ERRORS PROCESSED CODE IN A CFTRY-CFCATCH BLOCK <CFTHROW> AND <CFRETHROW> VERIFYING DATA TYPES CHECKING FOR DATA TYPES EVALUATING VARIABLES CHAPTER 3 SECURING YOUR COLDFUSION TAGS IDENTIFYING THE MOST DANGEROUS COLDFUSION TAGS PROPERLY (AND IMPROPERLY) USING DANGEROUS TAGS USING THE <CFCONTENT> TAG USING THE <CFDIRECTORY> TAG USING THE <CFFILE> TAG USING THE <CFOBJECT> TAG USING THE <CFREGISTRY> TAG USING THE <CFADMINSECURITY> TAG USING THE <CFEXECUTE> TAG USING THE <CFFTP> TAG USING THE <CFLOG> TAG USING THE <CFMAIL> TAG USING THE CONNECTSTRING ATTRIBUTE USING THE DBTYPE=DYNAMIC ATTRIBUTE KNOWING WHEN AND WHY YOU SHOULD TURN OFF THESE TAGS SETTING UP THE UNSECURED TAGS DIRECTORY CONTROLLING THREADING WITHIN DANGEROUS TAGS WORKING WITH OTHER DANGEROUS AND UNDOCUMENTED TAGS USING THE GETPROFILESTRING() AND READPROFILESTRING() FUNCTIONS USING THE GETTEMPDIRECTORY() FUNCTION USING THE GETTEMPFILE() FUNCTION USING THE <CFIMPERSONATE> TAG USING THE CF_SETDATASOURCEUSERNAME(), CF_GETDATASOURCEUSERNAME(), CF_SETDATASOURCEPASSWORD(), CF_SETODBCINI(), AND CF_GETODBCINI() FUNCTIONS USING THE CF_GETODBCDSN() FUNCTION USING THE CFUSION_ENCRYPT() AND CFUSION_DECRYPT() FUNCTIONS CHAPTER 4 SECURING YOUR COLDFUSION APPLICATIONS CROSS-SITE SCRIPTING URL HACKING COMBATING FORM HACKING VALIDATING BROWSER INPUT MALFORMED INPUT SCRIPTS EXECUTED BY THE CLIENT VALIDATING CONSISTENTLY FROM THE “HIT LIST” USING <CFOUTPUT> USING <CFAPPLICATION> USING <CFHTTP> AND <CFHTTPPARAM> USING (OR NOT USING) <CFINSERT> USING <CFQUERY> WEB-BASED FILE UPLOAD ISSUES TECHNIQUES TO PROTECT YOUR APPLICATION WHEN ACCEPTING FILE UPLOADS URL SESSION VARIABLES SESSION ID SHORT TIMEOUT SESSION CHAPTER 5 THE COLDFUSION DEVELOPMENT SYSTEM UNDERSTANDING THE COLDFUSION APPLICATION SERVER THREAD POOLING CUSTOM MEMORY MANAGEMENT PAGE-BASED APPLICATIONS JIT COMPILER DATABASE CONNECTION MANAGER SCHEDULING ENGINE INDEXING ENGINE DISTRIBUTED OBJECTS UNDERSTANDING COLDFUSION STUDIO SETTING UP FTP AND RDS SERVERS CONFIGURING SCRIPTABLE PROJECT DEPLOYMENT THINKING OF COLDFUSION AS PART OF A SYSTEM SECURING EVERYTHING TO WHICH COLDFUSION TALKS CHAPTER 6 CONFIGURING COLDFUSION SERVER SECURITY SETTING UP THE COLDFUSION SERVER USING “BASIC SECURITY” EMPLOYING ENCRYPTION UNDER THE BASIC SECURITY SETUP APPLICATION DEVELOPMENT APPLICATION RUNTIME AUTHENTICATION UNDER THE BASIC SECURITY SETUP CUSTOMIZING ACCESS CONTROL UNDER THE BASIC SECURITY SETUP ACCESSING SERVER ADMINISTRATION UNDER THE BASIC SECURITY SETUP SETTING UP THE COLDFUSION SERVER USING “ADVANCED SECURITY” EMPLOYING ENCRYPTION UNDER THE ADVANCED SECURITY SETUP AUTHENTICATION UNDER THE ADVANCED SECURITY SETUP CUSTOMIZING ACCESS CONTROL UNDER THE ADVANCED SECURITY SETUP USER DIRECTORIES PROTECTING RESOURCES WITH A POLICY SECURITY CONTEXTS SECURITY SANDBOX SETTING UP RDS SECURITY PERFORMANCE CONSIDERATIONS WHEN USING BASIC OR ADVANCED SECURITY CACHING ADVANCED SECURITY INFORMATION FILE AND DATA SOURCE ACCESS LAN, FTP, AND RDS FILE ACCESS COMPARISONS CHAPTER 7 SECURING THE COLDFUSION SERVER AFTER INSTALLATION WHAT TO DO WITH THE SAMPLE APPLICATIONS REDUCING UNCONTROLLED ACCESS CONFIGURING COLDFUSION SERVICE USER CHOOSING TO ENABLE OR DISABLE THE RDS SERVER LIMITING ACCESS TO THE RDS SERVER USING INTERACTIVE DEBUGGING SECURING REMOTE RESOURCES FOR COLDFUSION STUDIO CREATING A SECURITY CONTEXT SETTING RULES AND POLICIES DEBUG DISPLAY RESTRICTIONS USING THE MODE=DEBUG PARAMETER ASSIGNING ONE SPECIFIC IP ADDRESS MICROSOFT SECURITY TOOL KIT MS STRATEGIC TECHNOLOGY PROTECTION PROGRAM CHAPTER 8 SECURING WINDOWS AND IIS SECURITY OVERVIEW ON WINDOWS, IIS, AND MICROSOFT SECURING WINDOWS 2000 SERVER AVOIDING SERVICE PACK PROBLEMS WITH COLDFUSION UNDERSTANDING AND USING HOTFIXES, PATCHES, AND SECURITY BULLETINS USING WINDOWS SERVICES (“USE ONLY WHAT YOU NEED”) STOPPING NETBIOS WORKING WITH USERS AND GROUPS THE ADMINISTRATORS GROUP THE USERS GROUP THE POWER USERS GROUP UNDERSTANDING DEFAULT FILE SYSTEM AND REGISTRY PERMISSIONS SECURING THE REGISTRY MODIFYING THE REGISTRY PROTECTING THE REGISTRY AGAINST REMOTE ACCESS ASSIGNING PERMISSIONS/USER RIGHTS TO THE REGISTRY OTHER USEFUL CONSIDERATIONS FOR SECURING THE REGISTRY AND SAM REMOVING OS/2 AND POSIX SUBSYSTEMS ENABLING PASSFILT USING THE PASSPROP UTILITY SMB SIGNING ENCRYPTING THE SAM WITH SYSKEY USING SCM LOGGING REMOVING THE DEFAULT IIS 50 INSTALLATION CREATING AN ANSWER FILE FOR THE NEW IIS INSTALLATION SETTING WEB SITE, FTP SITE, AND FOLDER PERMISSIONS CONFIGURING WEB SITE PERMISSIONS CONFIGURING NTFS PERMISSIONS USING THE PERMISSIONS WIZARD USING THE PERMISSION WIZARD TEMPLATE MAKER RESTRICTING ACCESS THROUGH IP ADDRESS AND DOMAIN NAME BLOCKING CONFIGURING AUTHENTICATION USING ANONYMOUS AUTHENTICATION CONFIGURING WEB SITE AUTHENTICATION EXAMINING THE IIS SECURITY TOOLS USING THE HOTFIX CHECKER TOOL USING THE IIS SECURITY PLANNING TOOL THE IIS LOCKDOWN TOOL THE INTERVIEWING PROCESS CONFIGURING THE TEMPLATE FILES DEPLOYING THE TEMPLATE FILES AUDITING IIS CHAPTER 9 SECURING SOLARIS, LINUX, AND APACHE SOLARIS SOLUTIONS OVERVIEW OF THE SOLARIS OS CONSIDERATIONS FOR INSTALLING SOLARIS SECURELY UNDERSTANDING SOLARIS PATCHES SOLARIS PATCH CLUSTERS SECURING DEFAULT SOLARIS SERVICES EVALUATING THE SECURITY OF SOLARIS SERVICES AT STARTUP SECURITY ISSUES FOR SOLARIS 26 AND LATER UNDERSTANDING THE SOLARIS CONSOLE OTHER USEFUL CONSIDERATIONS IN SECURING YOUR SOLARIS INSTALLATION ADDING SSH SOURCE TO YOUR SERVER LINUX SOLUTIONS UNDERSTANDING LINUX INSTALLATION CONSIDERATIONS UPDATING THE LINUX OPERATING SYSTEM SELECTING PACKAGES FOR YOUR LINUX INSTALLATION CONSIDERING INDIVIDUAL PACKAGE INSTALLATION UNDERSTANDING MORE ABOUT LINUX BUG FIXES:A CASE STUDY HARDENING LINUX SERVICES EVALUATING THE SECURITY OF LINUX AT STARTUP SECURING YOUR SUID APPLICATIONS APPLYING RESTRICTIVE PERMISSIONS ON ADMINISTRATOR UTILITIES UNDERSTANDING SUDO SYSTEM REQUIREMENTS LEARNING MORE ABOUT THE SUDO COMMAND DOWNLOADING SUDO INSTALLING SUDO CONFIGURING SUDO RUNNING SUDO RUNNING SUDO WITH NO PASSWORD LOGGING INFORMATION WITH SUDO OTHER USEFUL CONSIDERATIONS TO SECURING YOUR LINUX INSTALLATION CONFIGURING AND USING OPENSSH COMPARING SSH WITH OLDER R-COMMANDS TCP WRAPPERS HARDENING THE SYSTEM WITH BASTILLE APACHE SOLUTIONS CONFIGURING APACHE ON SOLARIS AND LINUX LIMITING CGI THREATS TO APACHE USING APACHE VIRTUAL HOSTS MONITORING WEB PAGE USAGE AND ACTIVITY CONFIGURING APACHE MODULES RUNNING COLDFUSION ON APACHE CHOOSING APACHE SSL EVALUATING FREE AND COMMERCIAL APACHE SSL ADD-ONS CHAPTER 10 DATABASE SECURITY DATABASE AUTHENTICATION AND AUTHORIZATION AUTHENTICATION AUTHENTICATION SETTINGS AUTHORIZATION LIMITING SQL STATEMENTS IN THE COLDFUSION ADMINISTRATOR DATABASE SECURITY AND COLDFUSION DYNAMIC SQL EXPLOITING INTEGERS STRING VARIABLES LEVERAGING DATABASE SECURITY MICROSOFT SQL SERVER SECURING THE DATABASE FROM THE NETWORK SECURING THE ADMINISTRATIVE ACCOUNT CREATE A NON-ADMINISTRATIVE USER REMOVE ALL RIGHTS FROM THAT USER GRANT PERMISSIONS REQUIRED TO SELECT DATA GRANT PERMISSIONS FOR INSERTING, UPDATING, OR DELETING DATA MICROSOFT ACCESS ORACLE SECURING THE ADMINISTRATIVE ACCOUNTS CHAPTER 11 SECURING YOUR COLDFUSION APPLICATIONS USING THIRD-PARTY TOOLS FIREWALLS TESTING FIREWALLS USING TELNET, NETCAT, AND SENDIP TO PROBE YOUR FIREWALL DNS TRICKS PORT SCANNING TOOLS DETECTING PORT SCANNING BEST PRACTICES INSTALL PATCHES KNOW WHAT’S RUNNING DEFAULT INSTALLS CHANGE PASSWORDS AND KEYS BACKUP, BACKUP, BACKUP CHAPTER 12 SECURITY FEATURES IN COLDFUSION MX WHO’S RESPONSIBLE FOR SECURITY? A LOOK AT SECURITY IN COLDFUSION MX NEW AND IMPROVED TOOLS NEW TAGS OVERVIEW OF CFML CHANGES