Hacking: The Next Generation by Nitesh Dhanjani;Billy Rios;Brett Hardin

Author:Nitesh Dhanjani;Billy Rios;Brett Hardin
Format: mobi
Tags: COMPUTERS / Security / General
Publisher: O'Reilly Media
Published: 2009-08-28T23:00:00+00:00

Ignoring the fact that the credentials could possibly be sent to a clear-text email account, one piece of the message is particularly interesting from a security standpoint. SalesForce.com not only provides the username and password for the newly created account, but it also provides a link that passes the username and password in the URL. Figure 5-21 shows the username and password being provided in the URL.

Figure 5-21. SalesForce.com username and password in link

Passing sensitive data in URLs brings about some unique security challenges. One of the potential security issues involved with passing sensitive data in the URL is the possibility that Google (or some other search engine) may cache the sensitive data. Having a basic understanding of how to craft a Google query comes in handy. Here the attacker is looking for the following: pw= in the query string, and results filtered to the SalesForce.com domain. Here is the resulting Google query:

http://www.google.com/search?

q=inurl:%22pw%3D%22+site:salesforce.com&hl=en&filter=0

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.