Security

Ask something
Discussion Locked

Webpage

0 helpful
4 replies

by don_c 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am currently studying for my mcsa in W2K I setup a webpage so my tutor can view it. after veiwing the webpage he told me that it was not very secure and wanted me to fix it I am LOST on were to start i have look in Internet Service Manager were i set the webpage up and didnt find much in there that i could tell my network consist of cable connection Dlink router with dmz configure to let server to seen out

here's my question can someone ster me in the right direction so i can fix my security on the webpage

4 replies

by timthetoolman

Firstly never us a router's "DMZ" setting unless you have to. Its much safer to map ports individually. In your case you'd map port 80 to your webserver directly.

Secondly, the Microsoft IIS lockdown tool is the one you want to secure IIS itself. I suggest you google for it and have a good read on what it does.

Finally to the webpage itself. I dont know what it does, but you must ensure that if it has textboxes for entry of data which becomes part of select statements in SQL...then you MUST validate the information entered.

I'll give you an example. Suppose you have a textbox for entry that takes the value "Customer Name"

The the SQL in the background might be something like "select * from customers where customername = '" + textbox.value + "'"

Now suppose I enter into that textbox not my name but the following...

SOMENAME'; UPDATE CREDITTABLE SET CREDITAMOUNT=1000000 WHERE CUSTOMERNAME=''MyName

Notsure on the exact syntaxes there (ie whether that will work as written exactly...but I'm sure you get the picture.

This discussion is closed to new replies.