Tag Info

New answers tagged

2

I don't know what he is trying to do but returning 400 is fine. It stands for "Bad Request" so you server did not process the request further. You don't need to do anything as this request did just nothing.


0

You have Pin with HPKP : Key1 (Current RSA cert key fingerprint) and Key2 (backup key fingerprint) with a max-age of X days. You want to use a ECC cert (so, with a new key not yet pinned). You need to : Pin with HPKP Key1, Key2 and Key3 (ECC cert key fingerprint) wait at least the same time than the pinning expiration time : X days (to assert that all ...


1

Is there a way to make the server (Apache 2.4.7) always present both certificates? No. This is by design in TLS. The server only presents the certificate after a common cipher suite has been negotiated. And the cipher suite determines the certificate type (ECDSA or RSA). Then the server will know which of the certificates to use. EDIT: See older ...


2

You've misunderstood the cookie issue for Safari/Chrome, I think. Both of them implement the RFC properly, whereas Firefox/IE have been more relaxed in the past. The normal rules are: Setting a cookie for xyz.com does not allow any subdomains to read it. Setting a cookie for .xyz.com allows all subdomains to read it. Setting a cookie for app1.xyz.com only ...


2

How to reproduce the same? There are multiple answers on this site for exactly that question. Typing HTTP method into the Search box pulls up: How to exploit HTTP Methods How to identify the HTTP methods supported by a web server? Testing for HTTP TRACE method How can I test that I have correctly disabled unnecessary HTTP methods? How ...


1

You need a client certificate for each user (or client app if your app is authenticating to the server) that will use mutual auth SSL. You can purchase client certs from an existing CA or create a self-signed CA cert and issue your own certs. If you have many users, purchasing certs can be expensive.


1

The server certificate and the CA certificate used for authenticating your clients are two different things. First, you need to have your server certificate installed (SSLCertificateFile and SSLCertificateFileKey). You should already have that. At this point, you have your server presenting his certificate to clients. Now, you need to generate a CA ...


3

As in the first line is it visible, he tried to use the Shellshock security hole of the bash shell. His idea was probably the following: the Shellschock works by evironment variables, i.e. in some cases the bash would execute an environment variable as a shell function. And apache maps the parameters of the http requests (cookies, query strings, posted ...


0

I got the same case, to check is your server are vulnerable to ShellShock: #!/bin/bash EXITCODE=0 # CVE-2014-6271 CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' | wc -l) echo -n "CVE-2014-6271 (original shellshock): " if [ $CVE20146271 -gt 0 ]; then echo -e ...


2

Evaluate mod_security - see https://www.modsecurity.org/about.html. I don't know off the top of my head if there are rules to help with OP's problem - if there are, of course, use them. If not rules are easily written. Disable rules that are not applicable to reduce the negative performance impact the module will cause. An additional benefit would be ...


2

"Local attacker" means local to the machine. The official CVE states "local users" which is even more specific. Futhermore, this looks like a Debian-only (perhaps systems build on Debian as well) issue. It also looks like this problem was the result of applying a patch to Apache. So you'll need the right version of Apache as well. Of course, the right ...



Top 50 recent answers are included