Hack Proofing ColdFusion

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9781928994770 | 1928994776
Cover: Paperback
Copyright: 5/25/2002

Buy New

Print on Demand: 2-4 Weeks. This item cannot be cancelled or returned.

$49.40
eBook

Available Instantly

Online: 1825 Days

Downloadable: Lifetime Access

*To support the delivery of the digital material to you, a digital delivery fee of $3.99 will be charged on each digital item.

$59.94*

The only way to stop a hacker is to think like one! ColdFusion is a Web application development tool that allows programmers to quickly build robust applications using server-side markup language. It is incredibly popular and has both an established user base and a quickly growing number of new adoptions. It has become the development environment of choice for e-commerce sites and content sites where databases and transactions are the most vulnerable and where security is of the utmost importance. Several security concerns exist for ColdFusion due to its unique approach of designing pages using dynamic-page templates rather than static HTML documents. Because ColdFusion does not require that developers have expertise in Visual Basic, Java and C++; Web applications created using ColdFusion Markup language are vulnerable to a variety of security breaches. Hack Proofing ColdFusion 5.0 is the seventh edition in the popular Hack Proofing series and provides developers with step-by-step instructions for developing secure web applications. Teaches strategy and techniques: Using forensics-based analysis this book gives the reader insight to the mind of a hacker Interest in topic continues to grow: Network architects, engineers and administrators are scrambling for security books to help them protect their new networks and applications powered by ColdFusion Unrivalled Web-based support: Up-to-the minute links, white papers and analysis for two years at solutions@syngress.com

Foreword

xxiii

Thinking Like a Hacker

(46)

Introduction

(1)

Understanding the Terms

(7)

A Brief History of Hacking

(1)

Telephone System Hacking

(1)

Computer Hacking

(3)

Why Should I Think Like a Hacker?

(1)

What Motivates a Hacker?

(1)

Ethical Hacking versus Malicious Hacking

(1)

Mitigating Attack Risk in Your ColdFusion Applications

(5)

Validating Page Input

(1)

Functionality with Custom Tags and CFMODULE

(1)

The Top ColdFusion Application Hacks

(13)

Form Field Manipulation

(4)

URL Parameter Tampering

(3)

CFFILE, CFPOP, and CFFTP Tag Misuse

(1)

Security Concerns with CFFILE, CFPOP, and CFFTP

(2)

ColdFusion RDS Compromise

(1)

Understanding Hacker Attacks

(11)

Denial of Service

(2)

Virus Hacking

(2)

Trojan Horses

(1)

Worms

(1)

Client-Based Applets

(1)

Credit Card Theft

(2)

Identity Theft

(1)

Preventing ``Break-ins'' by Thinking Like a Hacker

(3)

Development Team Guidelines

(2)

QA Team Guidelines

(1)

IT Team Guidelines

(1)

Summary

(1)

Solutions Fast Track

(2)

Frequently Asked Questions

(2)

Securing Your ColdFusion Development

(26)

Introduction

(1)

Session Tracking

(7)

CFID and CFTOKEN Issues

(2)

Stop Search Engines from Cataloging CFID/CFToken

(2)

Error Handling

(8)

Detecting and Using Errors

(1)

Processed Code in a CFTRY CFCATCH Block

(5)

(2)

Verifying Data Types

(4)

Checking for Data Types

(1)

Evaluating Variables

(3)

Summary

(2)

Solutions Fast Track

(1)

Frequently Asked Questions

(3)

Securing Your ColdFusion Tags

(36)

Introduction

(1)

Identifying the Most Dangerous ColdFusion Tags

(3)

Properly (and Improperly) Using Dangerous Tags

(21)

Using the <CFCONTENT> Tag

(2)

Using the <CFDIRECTORY> Tag

(1)

Using the <CFFILE> Tag

(3)

Using the <CFOBJECT> Tag

(2)

Using the <CFREGISTRY> Tag

(2)

Using the <CFADMINSECURITY> Tag

(2)

Using the <CFEXECUTE> Tag

(1)

Using the <CFFTP> Tag

(2)

Using the <CFLOG> Tag

(3)

Using the <CFMAIL> Tag

(2)

Using the connectstring Attribute

(1)

Using the dbtype=dynamic Attribute

(1)

Knowing When and Why You Should Turn Off These Tags

(1)

Setting Up the Unsecured Tags Directory

(1)

Controlling Threading within Dangerous Tags

(1)

Working with Other Dangerous and Undocumented Tags

100

(4)

Using the GetProfileString() and ReadProfileString() Functions

100

(1)

Using the GetTempDirectory() Function

100

(1)

Using the GetTempFile() Function

101

(1)

Using the <CFIMPERSONATE> Tag

101

(1)

Using the CF_SetDataSourceUsername(), CF_GetDataSourceUsername(), CF_SetDataSourcePassword(), CF_GetODBCINI() Functions

102

(1)

Using the CF_GetODBCDSN() Function

102

(1)

Using the CFusion_Encrypt() and CFusion_Decrypt() Functions

102

(2)

Summary

104

(1)

Solutions Fast Track

105

(2)

Frequently Asked Questions

107

(2)

Securing Your ColdFusion Applications

109

(36)

Introduction

110

(2)

Cross-Site Scripting

112

(7)

URL Hacking

114

(3)

Combating Form Hacking

117

(2)

Validating Browser Input

119

(6)

Malformed Input

122

(1)

Scripts Executed by the Client

123

(2)

Validating Consistently from the ``Hit List''

125

(9)

Using <CFOUTPUT>

125

(2)

Using <CFAPPLICATION>

127

(2)

Using <CFHTTP> and <CFHTTPPARAM>

129

(2)

Using (or Not Using) <CFINSERT>

131

(1)

Using <CFQUERY>

132

(2)

Web-Based File Upload Issues

134

(2)

Techniques to Protect Your Application when Accepting File Uploads

134

(2)

URL Session Variables

136

(3)

Session ID

137

(1)

Short Timeout Session

137

(2)

Summary

139

(1)

Solutions Fast Track

140

(2)

Frequently Asked Questions

142

(3)

The ColdFusion Development System

145

(26)

Introduction

146

(1)

Understanding the ColdFusion Application Server

146

(11)

Thread Pooling

146

(5)

Custom Memory Management

151

(1)

Page-based Applications

151

(1)

JIT Compiler

151

(1)

Database Connection Manager

152

(3)

Scheduling Engine

155

(1)

Indexing Engine

156

(1)

Distributed Objects

157

(1)

Understanding ColdFusion Studio

157

(8)

Setting Up FTP and RDS Servers

158

(1)

Configuring Scriptable Project Deployment

159

(6)

Thinking of ColdFusion as Part of a System

165

(2)

Securing Everything to Which ColdFusion Talks

165

(2)

Summary

167

(1)

Solutions Fast Track

167

(2)

Frequently Asked Questions

169

(2)

Configuring ColdFusion Server Security

171

(58)

Introduction

172

(1)

Setting Up the ColdFusion Server Using ``Basic Security''

173

(17)

Employing Encryption under the Basic Security Setup

181

(1)

Application Development

181

(1)

Application Runtime

182

(1)

Authentication under the Basic Security Setup

182

(1)

Application Development

183

(2)

Application Runtime

185

(1)

Customizing Access Control under the Basic Security Setup

186

(3)

Accessing Server Administration under the Basic Security Setup

189

(1)

Setting Up the ColdFusion Server Using ``Advanced Security''

190

(28)

Employing Encryption under the Advanced Security Setup

193

(1)

Application Development

193

(2)

Application Runtime

195

(1)

Authentication under the Advanced Security Setup

195

(1)

Application Development

196

(1)

Application Runtime

197

(1)

Customizing Access Control under the Advanced Security Setup

198

(3)

User Directories

201

(3)

Protecting Resources with a Policy

204

(2)

Security Contexts

206

(3)

Security Sandbox

209

(1)

Application Development

210

(7)

Setting Up RDS Security

217

(1)

Performance Considerations When Using Basic or Advanced Security

218

(6)

Caching Advanced Security Information

219

(1)

File and Data Source Access

220

(1)

LAN, FTP, and RDS File Access Comparisons

221

(3)

Summary

224

(1)

Solutions Fast Track

224

(2)

Frequently Asked Questions

226

(3)

Securing the ColdFusion Server after Installation

229

(32)

Introduction

230

(1)

What to Do with the Sample Applications

230

(8)

Reducing Uncontrolled Access

234

(3)

Configuring ColdFusion Service User

237

(1)

Choosing to Enable or Disable the RDS Server

238

(6)

Limiting Access to the RDS Server

239

(1)

Using Interactive Debugging

240

(4)

Securing Remote Resources for ColdFusion Studio

244

(6)

Creating a Security Context

246

(2)

Setting Rules and Policies

248

(2)

Debug Display Restrictions

250

(4)

Using the mode=debug Parameter

252

(1)

Assigning One Specific IP Address

253

(1)

Microsoft Security Tool Kit

254

(2)

MS Strategic Technology Protection Program

255

(1)

Summary

256

(1)

Solutions Fast Track

256

(3)

Frequently Asked Questions

259

(2)

Securing Windows and IIS

261

(76)

Introduction

262

(1)

Security Overview on Windows, IIS, and Microsoft

262

(1)

Securing Windows 2000 Server

263

(21)

Avoiding Service Pack Problems with ColdFusion

265

(1)

Understanding and Using Hotfixes, Patches, and Security Bulletins

266

(2)

Using Windows Services (``Use Only What You Need'')

268

(2)

Stopping NetBIOS

270

(2)

Working with Users and Groups

272

(2)

The Administrators Group

274

(1)

The Users Group

275

(1)

The Power Users Group

275

(1)

Understanding Default File System and Registry Permissions

276

(2)

Securing the Registry

278

(1)

Modifying the Registry

278

(1)

Protecting the Registry against Remote Access

278

(1)

Assigning Permissions/User Rights to the Registry

279

(1)

Other Useful Considerations for Securing the Registry and SAM

279

(1)

Removing OS/2 and POSIX Subsystems

280

(1)

Enabling Passfilt

280

(1)

Using the Passprop Utility

281

(1)

SMB Signing

281

(1)

Encrypting the SAM with Syskey

282

(1)

Using SCM

283

(1)

Logging

283

(1)

Installing Internet Information Services 5.0

284

(6)

Removing the Default IIS 5.0 Installation

285

(3)

Creating an Answer File for the New IIS Installation

288

(2)

Securing Internet Information Services 5.0

290

(26)

Setting Web Site, FTP Site, and Folder Permissions

290

(1)

Configuring Web Site Permissions

291

(2)

Configuring NTFS Permissions

293

(2)

Using the Permissions Wizard

295

(3)

Using the Permission Wizard Template Maker

298

(4)

Restricting Access through IP Address and Domain Name Blocking

302

(2)

Configuring Authentication

304

(1)

Using Anonymous Authentication

305

(8)

Configuring Web Site Authentication

313

(3)

Examining the IIS Security Tools

316

(12)

Using the Hotfix Checker Tool

317

(2)

Using the IIS Security Planning Tool

319

(1)

Using the Windows 2000 Internet Server Security Configuration Tool for IIS 5.0

320

(1)

The IIS Lockdown Tool

320

(1)

The Interviewing Process

321

(1)

Configuring the Template Files

322

(5)

Deploying the Template Files

327

(1)

Auditing IIS

328

(2)

Summary

330

(1)

Solutions Fast Track

331

(4)

Frequently Asked Questions

335

(2)

Securing Solaris, Linux, and Apache

337

(90)

Introduction

338

(1)

Solaris Solutions

338

(34)

Overview of the Solaris OS

339

(1)

Considerations for Installing Solaris Securely

339

(4)

Understanding Solaris Patches

343

(1)

Solaris Patch Clusters

344

(1)

Securing Default Solaris Services

344

(1)

Evaluating the Security of Solaris Services at Startup

345

(16)

Security Issues for Solaris 2.6 and Later

361

(1)

Understanding the Solaris Console

362

(3)

Other Useful Considerations in Securing Your Solaris Installation

365

(1)

Adding SSH Source to Your Server

365

(7)

Linux Solutions

372

(38)

Understanding Linux Installation Considerations

372

(1)

Updating the Linux Operating System

373

(1)

Selecting Packages for Your Linux Installation

374

(1)

Considering Individual Package Installation

375

(1)

Understanding More About Linux Bug Fixes: A Case Study

376

(1)

Hardening Linux Services

377

(1)

Evaluating the Security of Linux at Startup

378

(1)

Securing Your Suid Applications

379

(1)

Applying Restrictive Permissions on Administrator Utilities

379

(2)

Understanding Sudo System Requirements

381

(1)

Learning More About the Sudo Command

381

(1)

Downloading Sudo

382

(1)

Installing Sudo

383

(4)

Configuring Sudo

387

(2)

Running Sudo

389

(2)

Running Sudo with No Password

391

(1)

Logging Information with Sudo

392

(2)

Other Useful Considerations to Securing Your Linux Installation

394

(1)

Configuring and Using OpenSSH

394

(4)

Comparing SSH with Older R-Commands

398

(4)

TCP Wrappers

402

(1)

Hardening the System with Bastille

402

(8)

Apache Solutions

410

(10)

Configuring Apache on Solaris and Linux

411

(2)

Limiting CGI Threats to Apache

413

(2)

Using Apache Virtual Hosts

415

(1)

Monitoring Web Page Usage and Activity

416

(2)

Configuring Apache Modules

418

(1)

Running ColdFusion on Apache

418

(1)

Choosing Apache SSL

419

(1)

Evaluating Free and Commercial Apache SSL Add-Ons

419

(1)

Summary

420

(1)

Solutions Fast Track

421

(3)

Frequently Asked Questions

424

(3)

Database Security

427

(36)

Introduction

428

(1)

Database Authentication and Authorization

428

(2)

Authentication

429

(1)

Authentication Settings

429

(1)

Authorization

430

(1)

Limiting SQL Statements in the ColdFusion Administrator

430

(1)

Database Security and ColdFusion

430

(13)

Dynamic SQL

431

(3)

Exploiting Integers

434

(3)

String Variables

437

(6)

Leveraging Database Security

443

(17)

Microsoft SQL Server

444

(1)

Securing the Database from the Network

445

(1)

Securing the Administrative Account

445

(1)

Create a Non-Administrative User

446

(1)

Remove All Rights from That User

446

(1)

Grant Permissions Required to Select Data

447

(1)

Grant Permissions for Inserting, Updating, or Deleting Data

448

(4)

Microsoft Access

452

(1)

Oracle

453

(1)

Securing the Database from the Network

453

(1)

Securing the Administrative Accounts

453

(1)

Create a Non-Administrative User

453

(1)

Remove All Rights from That User

454

(1)

Grant Permissions Required to SELECT Data

455

(1)

Grant Permissions for Inserting, Updating, or Deleting Data

456

(4)

Summary

460

(1)

Solutions Fast Track

460

(2)

Frequently Asked Questions

462

(1)

Securing Your ColdFusion Applications Using Third-Party Tools

463

(20)

Introduction

464

(1)

Firewalls

464

(5)

Testing Firewalls

465

(1)

Using Telnet, Netcat, and SendIP to Probe Your Firewall

466

(3)

DNS Tricks

469

(2)

Port Scanning Tools

471

(3)

Detecting Port Scanning

473

(1)

Best Practices

474

(4)

Install Patches

474

(1)

Know What's Running

474

(1)

Default Installs

474

(1)

Change Passwords and Keys

475

(1)

Backup, Backup, Backup

476

(1)

Firewalls

477

(1)

Summary

478

(1)

Solutions Fast Track

478

(2)

Frequently Asked Questions

480

(3)

Security Features in ColdFusion MX

483

(14)

Introduction

484

(1)

Who's Responsible for Security?

484

(1)

A Look at Security in ColdFusion MX

485

(9)

New and Improved Tools

487

(2)

New Tags

489

(2)

Overview of CFML Changes

491

(3)

Summary

494

(1)

Solutions Fast Track

494

(1)

Frequently Asked Questions

495

(2)

Index

497

Please wait while the item is added to your bag...

FREE SHIPPING

Rent More, Save More! Use code: BBRENTAL

5% off 1 book, 7% off 2 books, 10% off 3+ books

Hack Proofing ColdFusion

Summary

Table of Contents

Supplemental Materials

FREE SHIPPING

Rent More, Save More! Use code: BBRENTAL

5% off 1 book, 7% off 2 books, 10% off 3+ books

Hack Proofing ColdFusion

Summary

Table of Contents

Supplemental Materials

Digital License