Repudiation Attack - Revision history

Achim: more lein break corrections

2013-12-19T16:23:54Z

more lein break corrections

2013-12-19T16:22:59Z

expose parameter names

2013-12-19T16:20:37Z

line breaks in code sample corrected

2009-05-27T18:29:18Z

Reverting to last version not containing links to www.textgetpasace.com

2009-05-22T16:09:35Z

2009-04-23T11:48:48Z

2009-04-07T23:24:05Z

2009-02-16T20:36:06Z

‎Description

2009-02-16T20:35:32Z

‎Description

2009-02-16T20:34:49Z

@@ Line 23: / Line 23: @@
    POST <nowiki>http://someserver/Upload_file.jsp</nowiki> HTTP/1.1
    Host: tequila:8443
-   User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4)
+   User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
-  Gecko/20070515 Firefox/2.0.0.4
+   Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
    Accept-Language: en-us,en;q=0.5
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

@@ Line 19: / Line 19: @@
 ==Examples ==
-Consider a web application that makes access control and authorization based on SESSIONID, but registers user actions based on a user parameter defined on the Cookie header, as follows:
+Consider a web application that makes access control and authorization based on ''JSESSIONID'', but registers user actions based on a ''user'' parameter defined on the Cookie header, as follows:
    POST <nowiki>http://someserver/Upload_file.jsp</nowiki> HTTP/1.1

@@ Line 32: / Line 32: @@
    Connection: keep-alive
    Referer: <nowiki>http://someserver/uploads.jsp</nowiki>
-   '''Cookie: JSESSIONID=EE3BD1E764CD6EED280426128201131C;
+   '''Cookie: JSESSIONID=EE3BD1E764CD6EED280426128201131C; user=leonardo'''
-  user=leonardo'''
+   Content-Type: multipart/form-data; boundary=---------------------------263152394310685
    Content-Length: 321

← Older revision		Revision as of 11:48, 23 April 2009
Line 2:		Line 2:
	<br>		<br>
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]
		+
		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 7: / Line 7: @@
 ==Description==
-A repudiation attack happens when an application or system does not adopt controls to properly track and log users actions, thus permitting malicious manipulation or forging the identification of new actions.
+A repudiation attack happens when an application or system does not adopt controls to properly track and log users' actions, thus permitting malicious manipulation or forging the identification of new actions.
 This attack can be used to change the authoring information of actions executed by a malicious user in order to log wrong data to log files. Its usage can be extended to general data manipulation in the name of others, in a similar manner as spoofing mail messages.
 If this attack takes place, the data stored on log files can be considered invalid or misleading.

@@ Line 2: / Line 2: @@
 <br>
 [[Category:OWASP ASDR Project]]
-[[ASDR Table of Contents]]__TOC__
+[[ASDR Table of Contents]]
@@ Line 13: / Line 13: @@
 == Risk Factors==
 TBD
-[[Category:FIXME|need content]]
 ==Examples ==