[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 940
  • Last Modified:

Brute Force Attacks On AJAX

if someone knows how to spoof all the server variables e.g. http_referer, how do you stop them from writting a loop based on your ajax backend page?

if they look into the ajax frontend page, they will see something like

http://mysite/backend.aspx?=variable

How do I stop them from using a brute force attach to loop through the above address with all possible querystrings?  For example, their loop might do something like this

http://mysite/backend.aspx?=a
http://mysite/backend.aspx?=b
http://mysite/backend.aspx?=c

....

http://mysite/backend.aspx?=x
http://mysite/backend.aspx?=y
http://mysite/backend.aspx?=z
http://mysite/backend.aspx?=aa
http://mysite/backend.aspx?=ab

...

http://mysite/backend.aspx?=nami
http://mysite/backend.aspx?=namj
http://mysite/backend.aspx?=namk

So on eventually returning lost of info they can steal.

Can an attach like this be done on gmail if you first login??

If no, how are they stopping brute force attacks like this???
0
narmi2
Asked:
narmi2
  • 2
  • 2
2 Solutions
 
Michel PlungjanIT ExpertCommented:
How does this differ from any other url to dynamic content?

Michel
0
 
narmi2Author Commented:
no idea.

do they also have the same problem?

if yes, any idea how to stop such a loop from stealing your data?
0
 
Michel PlungjanIT ExpertCommented:
Yes all server have these problems

1. look at the referrer - should be your homepage - can be spoofed
2. set a session variable in the page that uses the ajax and read it in the ajax process
3. look at the speed they come in - do not allow them to come in fast (hard to code - there are programs out there to handle this
0
 
TSmoothCommented:
You could also add forms authentication to your site and thus require a user to be logged in before viewing any other pages. This would prevent the brute force attacks by redirecting them to a login page everytime they tried to request "backend.aspx?something".
0
 
narmi2Author Commented:
I will be having authentication, but cannot have it on all sections.  the part where the authentication exists i am not worried about.  unfortunately, we need to give them nice ajax functionality without them having to login...

any idea how google-suggest does it?  can a brute force attack be used on their page?

thanks for all the suggestions
0

Featured Post

Prep for the ITIL® Foundation Certification Exam

December’s Course of the Month is now available! Enroll to learn ITIL® Foundation best practices for delivering IT services effectively and efficiently.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now