Documents
Resources
Learning Center
Upload
Plans & pricing Sign in
Sign Out

Bypassing VBAAC with HTTP Verb Tampering

VIEWS: 43 PAGES: 9

  • pg 1
									                                              



        
          
                   
          
                     
                        
                                









    <security-constraint>
       <web-resource-collection>
          <url-pattern>/admin/*</url-pattern>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
       </web-resource-collection>
       <auth-constraint>
          <role-name>admin</role-name>
       </auth-constraint>
     </security-constraint>




















                                                                                                              
                                               




     
     
     





    •   
    •   
    •   

















    http://yourcompany.com/admin/admin.jsp?fn=deleteUser


















                                                                                                                
                                              






























    •   
    •   
    •   















                                                                                                               
                                               










    •   
    •   
    •   
    •   
    •   
    •   











                                                     
                                                       
                   

                                                 

                                              

                                              
                                                                   

                                               












                                                                                                          
                                             


    <security-constraint>
       <display-name>Example Security Constraint</display-name>
       <web-resource-collection>
          <web-resource-name>Protected Area</web-resource-name>
          <!-- Define the context-relative URL(s) to be protected -->
          <url-pattern>/security/protected/*</url-pattern>
          <!-- If you list http methods, only those methods are protected -->
          <http-method>DELETE</http-method>
          <http-method>GET</http-method>
          <http-method>POST</http-method>
          <http-method>PUT</http-method>
       </web-resource-collection>
      ...
     </security-constraint>




















<security-constraint>
    <web-resource-collection>
      <web-resource-name>site</web-resource-name>
      <url-pattern>/*</url-pattern>
      <http-method>GET</http-method>
    </web-resource-collection>
     ...
</security-constraint>

<security-constraint>
    <web-resource-collection>
      <web-resource-name>site</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
     ...
</security-constraint>





                                                                                                              
                                              








<authorization>
  <allow verbs="GET" users="*"/>
  <allow verbs="POST" users="Kim"/>
  <deny verbs="POST" users="*"/>
</authorization>








<authorization>
  <allow verbs="GET" users="Admin"/>
  <allow verbs="POST" users="Kim"/>
  <deny verbs=”POST,GET” users=”*” />
</authorization>










<authorization>
  <allow verbs="GET" users="Admin"/>
  <allow verbs="POST" users="Kim"/>
  <deny verbs=”*” users=”*” />
</authorization>
















                                                                                                              
                                              










                                                                           

                                    















                                           

                                       

                                          





                                                                                                            
                                              



                                              

                                               












     
     
       
       
       
     
     
       
     
       
       
     
       

















                                                                                                               
                                             


































                                                                                                          

								
To top