Concerned with software or hardware firewalls

learn more… | top users | synonyms (1)

0
votes
3answers
398 views

Some issues with iptables and nmap

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default. However I can use HTTP or SSH, so that ...
0
votes
1answer
173 views

Windows Firewall accepts a three-second unicast response from any source

I have read this article but still has some doubts may be after that... The Windows Firewall feature in Microsoft Windows XP Service Pack 2 (SP 2) accepts a three-second unicast response from ...
15
votes
4answers
1k views

ESET warns: Skype attempting to communicate with unknown remote computer

I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate: The ...
1
vote
1answer
116 views

Can a router detect transitive/cascaded telnet sessions?

I'm in my LAN segment , my desktops IP is x.x.x.x ; and I'm telneting to router A with its IP y.y.y.y from x.x.x.x .Now telnet session is established between x.x.x.x and y.y.y.y I want to telnet ...
-3
votes
1answer
7k views

windows firewall disabled with Norton Internet security or Norton Smart Firewall? [closed]

My Company decide to Change antiviruses and anti-spywares and firewalls. How to apply changes in all clients and servers safety? Norton say: ( in this article): When you are using Windows ...
4
votes
3answers
13k views

Best practice to block Dropbox usage

We have users sync their data at company with their home computer. What's the best way to block it? Block *.dropbox.com Find out all dropbox IPs and block IPs. For windows users, deploy GPO to ...
0
votes
3answers
3k views

why Windows Firewall in XP cannot block outbound connections

wikipedia say: XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones. another article says: XP defends you with your traffic coming from the web but ...
4
votes
3answers
18k views

Windows Firewall - how to block inbound for all .exe files in a folder

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has ...
3
votes
2answers
2k views

If a port is closed how come you can still use it?

What does it actually mean for a port to be closed or stealthed? According to tests I've run all my ports (tested) are stealthed but clearly I can still use the internet. Also are the terms "blocked" ...
2
votes
1answer
196 views

What security risks are involved with sending data over the internal network on Rackspace Cloud servers?

What are the risks involved with sending unencrypted data over the internal network with Rackspace Cloud Servers? Assume the interfaces use iptables to filter IPs and ports so they only accept data ...
0
votes
2answers
302 views

can a backdoor executable be used on an occupied port?

Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
32
votes
9answers
21k views

Why block outgoing network traffic with a firewall?

In terms of a home network, is there any reason to set up a router firewall so that all outgoing ports are blocked, and then open specific ports for things such as HTTP, HTTPS, etc. Given that every ...
2
votes
1answer
185 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
1
vote
2answers
1k views

How to check if a port can be accessed from the outside

I want to be sure that the firewall protecting the intranet is effectively rejecting/granting access to a port. I have no access to the firewall nor any other external machine. Is that possible at ...
5
votes
3answers
236 views

What are the security implications of allowing unlimited size cookies?

Our application firewall blocks requests if it detects a cookie is present with a value greater than 1024 characters in size. Are there any exploits involving large cookies? i.e. How much more ...
1
vote
3answers
457 views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
4
votes
3answers
13k views

How to bypass tcpwrapped with nmap scan

I'd a scan task and I faced following result Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for 856s PORT STATE SERVICE VERSION 1/tcp open tcpwrapped 3/tcp open ...
2
votes
1answer
7k views

How does pfsense block torrent traffic?

I know that pfsense is a very effective tool for restricting bit torrent traffic. I was wondering how it actually manages to do that ? There's not much information available on this. The more ...
3
votes
3answers
250 views

Security issues in a Dotnet Web application

I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0. It is tracert-able. That may assist for crackers to know network ...
8
votes
1answer
1k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
4
votes
2answers
453 views

Why are simple packet filter firewalls insufficient for the protection of web applications?

I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
44
votes
2answers
22k views

Is it a bad idea for a firewall to block ICMP?

This question was inspired by this answer which states in part: The generic firewall manifest file finishes off by dropping everything I didn't otherwise allow (besides ICMP. Don't turn off ICMP). ...
2
votes
2answers
332 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
8answers
29k views

How to block some websites in a small office?

I had a wireless connection in my office with one laptop. Now I bought two more laptops for my employees, and I give them Internet access. I want to block a few websites. My current connection is ...
2
votes
2answers
360 views

Why wouldn't the reverse shell connect back using the same port that exploited the server?

The reverse shell payload from msf use a new port to connect back to the attacker, therefore if the target server has outgoing filters, attack would fail. i.e established server:ftp <-> ...
3
votes
1answer
365 views

SSL VPN placement strategies

I wanted to know the advantages and disadvantages of placing an SSL VPN with respect to CIA in different locations: with firewall within the internal network within the DMZ Any reference also ...
0
votes
2answers
432 views

Any open source software firewall with country based ip blocking feature? [closed]

I am looking for an open source firewall with country based ip blocking feature for Linux OS.
4
votes
3answers
4k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
1answer
408 views

How did my homepage get changed in IE?

I have rarely used IE in the past. I just use it to test how a website looks. Today all of a sudden when I went on to open IE, it opened with a homepage that wasn't set by me. It was an address of a ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
3
votes
3answers
6k views

How to create ssh tunnel using netcat?

I want to create reverse connection between two machines, but these is a firewall in the middle preventing all connections, except ssh. I want to create ssh tunnel using netcat, could you please tell ...
2
votes
6answers
575 views

How do I prevent data from leaving my network?

I have a network of about 10 computers and I want to prevent sensitive data and source code leaks. To achieve that, I would like to block all file uploading / attaching. What are the options ...
2
votes
2answers
427 views

Does an equivalent for netconf exist in the Cisco ASA world?

I'm looking for a method to send instructions to a Cisco ASA without writing scripts to execute on the CLI over SSH. Cisco doesn't seem to support netconf or xml-pi on the physical ASAs (only their ...
2
votes
1answer
4k views

How to block all access to Akami deploy servers and Apple push servers?

I no longer blindly trust the numerous connections that occur at night and during the day that always go to "content" and "push" servers like: a23-33-37-54.deploy.akamaitechnologies.com ...
13
votes
5answers
961 views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
1
vote
4answers
16k views

How can attackers bypass firewalls? [closed]

I have read the Wikipedia article on firewalls but don't understand firewall security and how an attacker from the outside can bypass the firewall to hack target system. We all know it happens but ...
2
votes
2answers
413 views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
1answer
223 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
0
votes
1answer
289 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
2
votes
3answers
1k views

Effectively limiting outgoing firewall traffic to frequently-changing IPs

PCI DSS 1.2.1 states: Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment. Verify that all other inbound and outbound traffic is ...
6
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
2
votes
3answers
787 views

Firewall Migration: NetScreen NS500 to FortiGate [closed]

I have recently been tasked with doing a firewall migration from an old NetScreen NS500 box to a FortiGate device (I believe it will be a 60C). I am sure most of you aware that NetScreen boxes are no ...
3
votes
1answer
154 views

Why strip accept-encoding?

It seems that there are multiple "security" products which strip or mangle 'Accept-encoding' headers, thus forcing non-compressed responses from HTTP servers. I've been trying to imagine if there's ...
8
votes
3answers
1k views

Evasion techiques for WAFs

Is there any documented techniques for evading Web application firewall for testing WAF rule configurations.
2
votes
2answers
272 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
0
votes
1answer
140 views

How to secure unprotected Telnet Server on Droid 3

I have a Droid 3 and for whatever reason it has a Telnet Server running on port 23. It requires no credentials and it has root permissions. It bothers me when I'm connected to wifi networks because my ...
-1
votes
1answer
1k views

How to bypass firewall protection to hack windows server 2003? [closed]

I am trying to hack windows server 2003 sp2, i can see a lot of services running on target, there is also a lot of backdoors listing on ports like netbus, remote-everything .... But Firewall (as i ...
1
vote
1answer
206 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
1
vote
2answers
139 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
1
vote
3answers
4k views

windows firewall turns OFF automatically

It seems pretty weird but for some reason, the Windows 7 firewall turns off. After I turn the firewall on in the control panel, it seems that it turns itself off when I go back to the control after I ...