How secure is your Recruitment website? Part 2 - URL Manipulation
Posted By: Thomas Shaw, 1:20pm Saturday 06 June 2009
URL manipulation is a common issue faced in all database driven sites such as job boards, resume databases, blogs or any other site where parameters are passed via the URL. By manipulating certain parts of a URL, users may be able to access files they are not supposed to have access to.
URL manipulation, also called URL rewriting, is the process of altering parameters in a URL.
In this example below, the website stores data files on the server with a parameter "resumeid". If the script is not written correctly, we can edit the number and return another resume we may or may not have access to
URL/clientdata.aspx?resumeid=233
Change the "233" to another numeric number, easy!
URL/clientdata.aspx?resumeid=545
If the programmer has not anticipated this possibility, the user may potentially obtain data legitimately. This manipulation is not limited to numbers, you can try letters or special characters. See previous blog post on HTML Special Character #39 - The Apostrophe
To secure your website against URL manipulation, you should check on the following
- Make sure the server accurately interprets dynamic pages
- Delete unnecessary script interpreters
- Prevent HTTP viewing of HTTPS accessible pages. Make sure the server - Protects access to directories containing sensitive data
- Delete unnecessary configuration options