Tag Info

New answers tagged

1

The string length of a bcrypt hash isn't compatible as an AES key because of length and illegal characters such as periods and dollar signs. How does one deal with this problem? Base64 encoding is your friend. Base64 encoded character are all legal characters with AES When it comes to decrypting Enc_KEY1, I have to first generate KEY2 from a hash ...


0

Here a list of mitigation actions you can perform to avoid disclosing the database's path: Internet Information Services & Server Make sure you do not list the C:\inetpub\wwwroot content, otherwise s/he might be able to navigate through all folders Disable any kind of FTP and just use SSH (if needed at all). Needless to say that FTP is insecure. Keep ...


2

So assuming here that the database is only intended to be accessible by the ASP code and not clients of the web application a better alternative to keeping the database in a "random" directory under the web root, would be to keep the database outside of the webroot altogether. That way it would not be possible for an attacker to directly address the ...


0

Indeed the title of the article you linked to is misleading/confusing. Storing passwords in plain text is a very bad thing to do, yes; but storing them hashed in a DB is not a problem because, by principle, hashing functions are a one way process. It is better to deal with forgotten passwords as StackExchange websites do because: Hashed passwords are ...


3

As the linked article states, you should hash the password, and then store that in the database. bcrypt is the current standard recommendation in terms of password hashing, and has easily-used implementations in many languages. The intent behind "never store passwords in the database" is not "store it outside of the database"; the intent is "never store ...


0

There are several standard algorythm used for hashing passwords securely (PBKDF2, BCrypt, SCrypt. See this question for more details). As for using a library for this, you can do it but you need to take into consideration how the code has been audited. Well-known and maintained open source libraries can usually be used pretty safely.


1

You didn't provide too much details, so in general: One of the biggest risks in using cryptography is its inappropriate use, leading to several security vulnerabilities, eg. private key leak, known plaintext attack etc. Unless you're an cryptography expert (and you don't seem like one), it's generally wise to use APIs of the highest possible level, that ...


1

There are quite a lot of vulnerability DBs out there. In the good old days, those were Milw0rm and 0day. Now you probably look at http://www.rapid7.com/db/ as well as https://www.exploit-db.com/


1

NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild. So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.


2

Are you thinking of a phishing attack? A phishing attack involves tricking a user into entering credentials into a website that looks much like a legitimate one. For example, suppose First World Bank has the domain name of firstworldbank.com. Eve, the attacker, might create firstw0rldbank.com or flrstworldbank.com. She then sends an email to Bob that ...


1

Alasjo already provided a good answer, but I think some additional information could help you grasp the difficulties you have and how to address them. In you question you suggested encryption. Just encrypting the uploaded data cannot be enough to secure them. Since encrypted data is useless without a mean to decrypt them, your application would have to ...


0

I think Docker would be a possible solution for this. I am not an expert on Docker. So this is a concept idea solution. I am thinking that you could create a few containers for the database and fig up. So say you build 3 containers (1-master, 1-internal and 1-webapp) with containing the same database in each. Then you could get them to be scanned before ...


2

There are numerous questions with answers on this site as well as Owasp guidelines that cover the risks of allowing file uploads and how to store files properly. You may want to check the legislation that applies to your application and take necessary action to store files accordingly (encryption, access rights, data integrity, logging). As for your idea ...



Top 50 recent answers are included