TamperProof: a server-agnostic defense for parameter tampering attacks on web applications

Parameter tampering attacks are dangerous to a web appli-cation whose server performs weaker data sanitization than its client. This paper presents TamperProof, a methodol-ogy and tool that offers a novel and efficient mechanism to protect Web applications from parameter tampering attacks. TamperProof is an online defense deployed in a trusted environment between the client and server and requires no access to, or knowledge of, the server side codebase, making it effective for both new and legacy applications. The paper reports on experiments that demonstrate TamperProof’s power in efficiently preventing all known parameter tamper-ing vulnerabilities on ten different applications