Click here to Skip to main content
15,891,905 members

Comments by SubbZer (Top 11 by date)

SubbZer 19-Jul-19 5:26am View    
Yes it is. But we dont want to change anything. We want to tell our customers how they can protect there users. And if the bad guy logs in and do some critical stuff its ok, as long as we can secure that not the correct user form this company did this..

We currently try do develop an custom login form, copying the very first login request for a new user and always send this request to the server.. so from now on the users have to login 1 time with the real login form to get the encrypted password and from this point on they have to login with our form and with the enrypted password in the password field.
I think with this way we can ensure always the same userid in the html request and we can deny any from other pcs.
SubbZer 19-Jul-19 5:26am View    
Deleted
Yes it is. But we dont want to change anything. We want to tell our customers how they can protect there users. And if the bad guy logs in and do some critical stuff its ok, as long as we can secure that not the correct user form this company did this..

We currently try do develop an custom login form, copying the very first login request for a new user and always send this request to the server.. so from now on the users have to login 1 time with the real login form to get the encrypted password and from this point on they have to login with our form and with the enrypted password in the password field.
I think with this way we can ensure always the same userid in the html request and we can deny any from other pcs.
SubbZer 19-Jul-19 5:07am View    
ok thanks, i understand. But if we ask the user to login 10 times, we have 10 different types of password data and all of them are usable anytime.
Maybe i am wrong but if i use the same enrypting everytime i must always have the same result?
I dont understand how the server can know about all of these datastrings without any token or constant enrypting method.

My problem is that i have to help our customers, if there would be the same datastring anytime i could filter the requests from other pc then the owner ones. But if the owner always generates a new one and none of these will expire it gets hard for me to help..
Software owner is contacted but will need for sure few weeks..
SubbZer 8-Apr-15 8:21am View    
I found a project on myCSharp.de which also contains the source code.
The program reads the html/tcp traffic on your networkcard using WinPcap.
Link: http://www.mycsharp.de/wbb2/thread.php?threadid=74918&hilight=httpsaver
Note: The program doesnt work on my PC but it contains the html translation and the capture events which should work.

I have done some troubleshooting and i found some tcp packets which always contains a null reference.
This ones are outgoing packets, so i asked myself, does WinPcap get the outgoing packages before they get payloaded in tcp format or somthing else?
The incomming http packages are certainly in tcp format, but which format has the outgoing packet?
SubbZer 23-Feb-15 5:25am View    
Thank you, this will help me a lot! I have never read a styling guide before, just learning by doing and asking.