# Attack
**URL:** https://talk.remobjects.com/t/attack/24424
**Category:** Remoting SDK
**Created:** [March 19, 2021, 11:08am UTC](https://talk.remobjects.com/t/attack/24424 "2021-03-19T11:08:31Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@allinco1](https://talk.remobjects.com/u/allinco1)
#### Post date: [March 19, 2021, 11:08am UTC](https://talk.remobjects.com/t/attack/24424/1 "2021-03-19T11:08:31Z")
A customer reported that there is a attempt by hacker to access my webservice.
The hacker tried to send a php script to my webservice by http post and got a response 200
My IIS webservice is protected by AES encryption ROAESEncryptionEnvelope.
Should I be worried?
Also,
Is it possible that a php script is executed by my webservice?
The logging implies that the webservice accepted this script (according by the SA)
I forget to mention that only the binary channel is used.
---
### Author:  [@EvgenyK](https://talk.remobjects.com/u/EvgenyK)
#### Post date: [March 19, 2021, 1:27pm UTC](https://talk.remobjects.com/t/attack/24424/2 "2021-03-19T13:27:55Z")
Hi,
I think, you can answer to this q by yourself.
Open the `Message Envelopes` sample (`C:\Users\Public\Documents\RemObjects Samples\RemObjects SDK for Delphi\Message Envelopes`).
update the `TMessageEnvelopes_ClientMainForm` unit as:
- add `uROBinaryMemoryStream` to uses section
- add the `ROChannel`.`OnReceiveStream` event:
```auto
procedure TMessageEnvelopes_ClientMainForm.ROChannelReceiveStream(aStream: TStream);
var
a: TROBinaryMemoryStream;
begin
a := TROBinaryMemoryStream.Create;
a.CopyFrom(aStream);
Log(a.ToReadableString);
a.Free;
end;
```
- launch both projects
- [optionally] remove all envelopes from client project
- press `Run Test Once` with enabled envelope on server-side and with disabled:
Note:
- `ROENV` - header for protected stream
- `RO107` - header for unprotected stream
---
### Author:  [@allinco1](https://talk.remobjects.com/u/allinco1)
#### Post date: [March 19, 2021, 3:09pm UTC](https://talk.remobjects.com/t/attack/24424/3 "2021-03-19T15:09:52Z")
Thanks,
I run the example, my conclusion:
yes, you can send stuff to the webservice but it’s not processed on the server if you do not have the right security AES etc.
The only thing I do not understand that according to the SA there was a response 200.
---
### Author:  [@EvgenyK](https://talk.remobjects.com/u/EvgenyK)
#### Post date: [March 19, 2021, 4:28pm UTC](https://talk.remobjects.com/t/attack/24424/4 "2021-03-19T16:28:27Z")
Hi,
[Message Envelopes](https://docs.remotingsdk.com/Servers/Concepts/MessageEnvelopes/) are designed for protecting **outgoing** streams only.
if you want to process encrypted requests only, you can use `ROMessage.OnBeforeProcessIncomingEnvelopes` event:
```auto
procedure TMessageEnvelopes_ServerMainForm.ROMessageBeforeProcessIncomingEnvelopes(aStream: TStream);
var
a: TEnvelopeSignature;
pos: Int64;
begin
pos := aStream.Position;
if aStream.Size > Length(EnvelopeSignature) then begin
aStream.Read(a,Length(EnvelopeSignature));
if not CompareMem(@EnvelopeSignature, @a,Length(EnvelopeSignature)) then raise Exception.Create('Encrypted request is required');
end;
aStream.Position := pos;
end;
```
pls retest this example again with included and excluded envelopes on client-side
---
### Author:  [@allinco1](https://talk.remobjects.com/u/allinco1)
#### Post date: [March 22, 2021, 10:11am UTC](https://talk.remobjects.com/t/attack/24424/5 "2021-03-22T10:11:56Z")
Thanks again, I am starting to understand what is going on.
Is the url hidden when the client sends a AES call?
---
### Author:  [@EvgenyK](https://talk.remobjects.com/u/EvgenyK)
#### Post date: [March 22, 2021, 10:27am UTC](https://talk.remobjects.com/t/attack/24424/6 "2021-03-22T10:27:44Z")
Typical url is `http://host:port/path` .
You can change `port` (8099 by default) and/or `path` (`bin` by default).
also is possible to work w/o hardcoded `path`.
in this case, you need to implement [OnCustomResponseEvent](https://docs.remotingsdk.com/API/Delphi/Classes/TROBaseHTTPServer/#OnCustomResponseEvent).
see more at [Using OnCustomResponseEvent in a ROSDK Server](https://talk.remobjects.com/t/using-oncustomresponseevent-in-a-rosdk-server/6767).
in this event you can check incoming stream and depending on some conditional, allow/disallow to process it.
for example, you can have conditional: envelope marker should be the same as `path`.
you read from stream envelope marker and compare with `path`.
from [Message Envelopes: Wire Specification](https://docs.remotingsdk.com/Servers/Concepts/MessageEnvelopes/#wire-specification), you know:
> Each envelope will add the following preamble to messages as they are enveloped:
>
> - 5 ASCII characters `ROENV` as a marker.
> - The envelope marker, as 1-byte binary length, followed by the UTF-8-encoded envelope name (maximum of 255 characters). The length bytes indicates the number of bytes, not UTF-8 characters.
so you can easily to implement this checking.