1

i am working on security and other stuff about my web sites.
in my country online payments work like paypal.
mean you should pass some parameters such as Amount,MerchantID,ReturnURL,ResNum(OrderID) by post method to bank and bank will pass some parameters such as MID,Status,ResNum to you after payment.
during this requests and responses somebody can use the software below to sniff and tamper:
http://www.fiddler2.com/fiddler2/
please see this video:
http://www.fiddler2.com/fiddler/help/video/
i test it and it also works on https by using a certificate.
wow...

  1. how can i prevent this sniffing and tampering?
    there is a function in bank site named VerifyTransaction that is called on Seller side after payment and this function returns amount.
    this function is on a web service on bank side.
    the main question is :
  2. can somebody sniff and tamper web service between bank and seller?
    mean can fiddler do that or the other tool?
    if yes, how can we prevent this sniffing and tampering (web services)?

really appreciate for attention

SilverLight
  • 19,668
  • 65
  • 192
  • 300
  • possible duplicate of [How to prevent HTTPS man-in-middle attack from the server side?](http://stackoverflow.com/questions/3078677/how-to-prevent-https-man-in-middle-attack-from-the-server-side) – Steve May 08 '12 at 08:17
  • hi, i do n't think so, the main question is about web servises. – SilverLight May 08 '12 at 08:34

1 Answers1

3

Fiddler is running on the same client that the web browser runs on, both under the control of the same user, so it can't do anything that you couldn't do with just a browser (but maybe much more effort).

There is never a guarantee that data coming from clients to your server has been sent by the HTML/JavaScript/etc. that you served them. That is why you should never trust user input, e.g. always do data validation on the server side (and only additionally on the client side for improved usability). And that is the reason for the web service calls between the bank and the seller, to ensure that the transaction details are correct.

Tampering and sniffing of traffic between the seller-server and the bank-server can be prevented by proper TLS setup.

David Tischler
  • 2,642
  • 22
  • 13
  • hi thanks for the answer, would you please give some info about TLS setup. about sniffing and tampering web sercies i think there should be a way. xml format communication between tow servers and our system as a man in the middle.what do you think about that? – SilverLight May 08 '12 at 09:02