Didnt really thing you could...

You can use Global error handlers (we do that on all our servers,
found in the CFAdministrator), thus giving a nice looking error...
'this error was sponsored by'

You can also use the missing template handler so that 404 pages return
a nice looking page.


but a simple

nslookup {websitehere}

will give you the IP address

On 07/10/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
> I heard a challenge from a security consultant that "if you are using 
> ColdFusion you do not have a secure server."  He maintains that CF is full of 
> things a hacker can access.  For example he gave the following example.   If 
> you attempt to open a CF website with the following command it will generate 
> an error message that gives you the IP address of the CF server:
>
> sitename.org/*.cfm
>
> I tried this on a wide variety of sites and found that most CF sites return 
> the error with the IP address.  Some, however appear to trap this error 
> somehow.
>
> What should be done on a CF server to prevent that type of error exposing the 
> IP address of a CF server?
>
> This error is occuring prior to the execution of an application.cfm file in 
> the host root directory so you cannot programatically trap it.
>
> 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
Purchase Studio MX with Flash Pro from House of Fusion, a Macromedia Authorized 
Affiliate and support the CF community.
http://www.houseoffusion.com/banners/view.cfm?bannerid=51

Message: http://www.houseoffusion.com/lists.cfm/link=i:10:5564
Archives: http://www.houseoffusion.com/cf_lists/threads.cfm/10
Subscription: http://www.houseoffusion.com/lists.cfm/link=s:10
Unsubscribe: 
http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.10
Donations & Support: http://www.houseoffusion.com/tiny.cfm/54

Reply via email to