Well heres one suggestion (Just a theory). 1. You use Javascript to execute your login form, so in way it restricts the user to a Javascript/Browser friendly program. 2. You randomly create a session.string value in CFMX (Seed Value); 3. You set this string value to a Javascript Variable named "foo" or whatever you want. 4. You randomly create 3x session.string value in CFMX (1=Key, 2=Username, 3=Password); 5. Using these random strings, create 3 form fields on the page (1st Hidden, 2,3 text); 6. Make an OnClick to either button type, or image to basically take the Javascript Seed Value and place it into the hidden form field value. 7. Make a call to action to a page (that invokes a cfc). 8. based on your session variables, compare them against to the form.variables for starters. 9. If they match then do a database lookup/handshake. 10. Do a simple 3 strikes and your out system against the session.ip (if they use a proxy cycler, well log the proxy IP.. eventually you may block the proxy ips before any damage is done)
Now this isn't 100% full proof and un-tested, but the theory is, try and make it a randomly generated form of some kind, in that keep vars names random so that any text pattern searching on the cfm page aren't allways the same (even mixup where they lie in response to line positions). What this in theory does is basically say to the hacker, if you can: a) have a attackscript/program that can simulate javascript / or know how to read the page, find the random field names, then simulate a form post on those names. b) have a way to edit/updated your own header packets c) have a way to map to the correct seed against form values d) have a way to cycle through proxies Then your welcome to hack the shit out of my site :D In a nutshell, its just a crazy whacky security theory i have had and in truth not allot of thought has gone into it... One theory i also had, and once again this is just a theory is: 1. You have a frontline of say 5 call to action pages (cloned off of the original) that all point to the one package cfc 2. You rename these files randomly each day 3. You have 5 login pages (cloned off of the original) that are stored in randomfolder/randomname.cfm format 4. These are stored in their own unique application scope that timeout daily 5. You then redirect the user to one of the 5 each time the user hits the "login area" 6. You apply the above to prevent formpost similiators 7. You pray your client hasn't got a password of "ima/egghead" format. 8. You hope they don't have ftp access :D Like i said all theories, how useful they are is beyond my time :D never put it into place until Spike scared the shit out of me at the preso of his.. man i was torn between Spike and Jesse... hard call to make, so i only caught first half of spikes and last half of jesses... DAMN YOU MXDU :D SO much to learn so little time. "Adam Chapman" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > > Hey Everyone.. > > At the hack-proofing CFMX session at MXDU, Spike > Mentioned a 'dictionary attack' or something similar > Where someone will pound your cf templates with lots-o > Username/password combos.. > > What are some of the methods peoples use to try and > Safeguard against this kind of thing..? > > Regards, > Adam Chapman > > Virtualtours.com.au > mailto:[EMAIL PROTECTED] > Phone: 1300 366 122 > (Int: +61 3 9720 5733) > Fax: +61 3 9720 6377) > > > --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
