Skip to Content
Web Application Defender's Cookbook
book

Web Application Defender's Cookbook

by Ryan C. Barnett, Jeremiah Grossman
December 2012
Intermediate to advanced
552 pages
13h 16m
English
Wiley
Content preview from Web Application Defender's Cookbook
Recipe 6-10: Detecting Sensitive User Data Leakages
This recipe demonstrates how you can figure out when sensitive user data, such as credit card numbers, is present within outbound response data.
Ingredients
  • ModSecurity
    • @verifyCC operator
  • OWASP ModSecurity Core Rule Set
    • modsecurity_crs_25_cc_known.conf
Leakage of sensitive user data, such as credit card numbers, is a serious issue. This may occasionally happen by accident, but it is most often the result of SQL Injection attacks that aim to extract customer purchasing data from previous transactions. Let’s look at an example of a real-life SQL Injection attack targeting an e-commerce web site:
GET /cart/loginexecute.asp?LoginEmail='%20or%201=convert(int,(select
%20top%201%20convert(varchar,isnull(convert(varchar,OR_OrderDate),'N
ULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_OrderID),'N
ULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_FirstName),
'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_LastName)
,'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_OrderAdd
ress),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_Ord
erCity),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_O
rderZip),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,OR_
OrderState),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(varchar,
OR_OrderCountry),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(var
char,OR_CCardName),'NULL'))%2b'/'%2bconvert(varchar,isnull(convert(v
archar,OR_CCardType ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Web Site Cookbook

Web Site Cookbook

Doug Addison
Web Application Development with PHP 4.0

Web Application Development with PHP 4.0

Tobias Ratschiller, Till Gerken, Zeev Suraski, Andi Gutmans

Publisher Resources

ISBN: 9781118417058Purchase book