encryption - Is there a way to hide this AES URL php -
is there way hide aes url ? fiddler , softwares alike? it's fine if see final url when scan it, dont want them see encryption. because script, using view-source, can't view source...but when scanning fiddler. shows content header(location: xxx
i hope, clear enough in want , please can me out. thank you.
<?php /** * xml protecting * */ include("uye/baglanti.php"); $diger_eleman = $_server['http_user_agent']; $kullanici_adi = $_get["username"]; $parola = $_get["pass"]; $sorgula = mysql_query("select * uyeler kullanici_adi='{$kullanici_adi}' , parola='{$parola}'") or die (mysql_error()); $uye_varmi = mysql_num_rows($sorgula); if( strstr($diger_eleman, 'mozilla/5.0 (windows nt 6.1; wow64; rv:19.0) gecko/20100101 firefox/19.0') , $uye_varmi > 0) { header("location: 35kkpunrq6rzb/ifzcimnhat4+rcndifnywvg6tjdqw="); #is there way can hide url/content? appearing on fiddler! exit; } else { echo str_repeat("<br>", 8)."<center><img src=uye/images/hata.gif border=0 /> need anything? email me @ xxxx@gmail.com</center>"; } mysql_close(); ?>
from basic premise: encrypting url parameters bad idea. url scheme vulnerable chosen-ciphertext attacks.
however, point of encryption ciphertext can made public without revealing original message. why want obfuscate ciphertext unclear. have incorrect threat model of problem you're trying solve.
do need store data in url, if it's sensitive? can't place in session variable read during next http request? that's do.
Comments
Post a Comment