Martijn van Schie

Introduction In order to store use specific information during a ASP.Net session you have to option to place state data in a browser cookie . These cookie are send in plain text and using various tool it is possible to read the content of these cookies. Although reading might not always be a problem, the ability to change the content of a cookie is a big thread. Tampering with the cookie is actually very easy, and i will demonstrate this using a Firefox extension called TamperData . Tampering a Cookie Setup I started by creating a small ASP.NET application that checks the presence of our cookie. If not sets, a cookie is create and filled in the page load. After that i print the values on the page. 1: protected void Page_Load( object sender, EventArgs e) 2: { 3: if (Request.Cookies[" __IGUZA.NET "] == null ) 4: { 5: HttpCookie cookie = new HttpCookie(" __IGUZA.NET "); 6: cookie[" SomeKey "] = " Some...

Introduction A well known service oriented scenario is where a client and service application communicate using message exchange over a channel. This channel is either secured, using for instance SSL, or unsecured where the data is send in plain text. One of the commonly used message bases is XML. XML is a standard way of describing relational data, and can be read by most platforms. This makes XML a interoperable message base. On the downside, this message type is easy to read and it therefore easy to change. If a third party where to intercept the message, for instance using a proxy server, it could easily change the content of the message and send it to the original endpoint. This is called tampering. To detect changes to the content, a message send through the channel can be signed. Signing is a way to provide reliable messaging over a non-secure channel. It also provides some sort of authentication because the message can be validate that is was send from the expected cli...