From: Ken Schaefer (Ken@adOpenStatic.com)
Date: Mon Sep 18 2006 - 02:54:05 EDT
: -----Original Message-----
: From: listbounce@securityfocus.com
: [mailto:listbounce@securityfocus.com] On Behalf Of Darryl Stevens
: Subject: Hardcoded Database IP in ASP
:
: Question: I have ASP script that points to a backend database residing
: on separate physical server. Is there any known way of getting around
: using a hard-coded IP address to point to the database? Would
: utilizing the OS hosts file serve my purposes of and satisfy
: secure code practices? Thanks guys.
:
: Darryl
What threats, exactly, are you trying to secure against here?
You are changing from having the DB server's IP address directly in your code
to using a hostname in your code, and storing the corresponding IP address in
the hosts file. Are you afraid someone might get hold of the IP address? If
they did get this IP address, what would they do with it? And would storing
it in a hosts file help? A malicious attacker could simply connect using the
hostname, and Windows will resolve it to the IP address via a hosts file
lookup...
Cheers
Ken
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:58 EDT