Tag Info

Hot answers tagged

24

HTTPS is HTTP over SSL. SSL first connects to the host, so the host name and port number are transferred as clear text. When the host responds and the challenge succeeds, your client will encrypt the HTTP request. This is said, and by putting in mind how the communication between layers in the OSI model occurs: As SSL acts in the Session layer (5) and ...


17

What stops a malicious site from obtaining the anti-CSRF token is the Same Origin Policy. The Same Origin Policy, or SOP, is at the browser level, and defines where JavaScript is allowed to communicate. JavaScript on example.com cannot call example.org to get data. Also, JavaScript on http://www.example.com/ cannot call http://www.example.com:8080/ as the ...


9

HTTPS is just HTTP going over SSL - the HTTPS just signifies to the browser (or other network stack) that the HTTP protocol needs to be tunneled over an SSL channel. There is nothing else "special" about HTTPS... Well, except the CONNECT method. To be specific, the CONNECT method is not anything special in HTTPS, it is part of the HTTP spec. This method ...


9

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


6

Based on my understanding, I think you don't even need to get inside the internal network to prove that's it's a terrible idea. An attacker (who can be an ex-employee, third party contractor or an existing disgruntled employee) having some context about this insecure internal application, including details such as internal host address where the application ...


6

I think your question is a bit too broad. Session hijacking can be done on different levels, and it's not just copying something between browsers. For example: A malicious network admin / proxy admin could intercept your session ID and re-use this also. A vulnerable website could be exploited using cross site scripting, where an attacker can gain ...


5

An internal user with a browser that also connects to the outside provides routes between the intranet and the public internet. I'm constantly pointing this out to people who tell me, "don't worry this is an internal web app". HTTPS is necessary in your case. This not only protects against the threat you mention, someone who has broken into the network, ...


5

This is how a approach your situation in general. Speak to the business There are three things that I think clients can really relate to when discussing the security of their applications. (90% of the time the users are a footnote). IP (Intellectual Property). No customer want their secrets available to their competition. Image. Companies can be kindly ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


3

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: ...


3

I would personally do 3 things in this situation: Show the client the data on the percentage of major breaches that are a result of phishing (Something like 95-97%) Further show that phishing can directly lead to an attacker to sniffing traffic on the network and he/she can view every bit of data passing to and from those services. Identify the quantity ...


2

There will eventually be a case where an action that is perfectly authorized at the proxy level will be able to cause unexpected behavior in a backend component. It's a matter of when, not if. This is a terrible idea. Your instincts on this are correct. Do anything you can to convince your client that they should not proceed down this path.


2

The most common cyberattacks are summarized very well in the annual Verizon Breach Report: http://www.verizonenterprise.com/DBIR/ As can be read therein, phishing and credential theft attacks are two of the most common threats. Thus, if an internal system is compromised by someone accidentally clicking on a malicious link, an attacker is now inside the ...


2

It's a malicious bot, that is trying to scan web application for security vulnerabilities. Look at these links for more information about blocking it: http://serverfault.com/questions/700404/huge-traffic-from-post-123-249-24-233-post-ip-port-php https://gist.github.com/renancouto/0ad35842f1c536c1dbbe


2

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...


2

regarding question 1: You can setup most webservers as a reverse proxy(IIS, Apache, Nginx and even NodeJS all work). IIS and Nginx are preferable(but not necessary) as they are faster(just my opinion - this may not always be true). Instructions for setting up IIS as a proxy can be found here Instructions for setting up Nginx as reverse proxy there are ...


1

Your interpretation is incorrect. WPA2-PSK doesn't completely encrypt layer 2 information. Management frames are unencrypted (except in cases where management frame protection is implemented). MAC addresses of all communicating parties can also be observed, which somewhat helps to analyze communication flows and gain general information on the network. The ...


1

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.



Only top voted, non community-wiki answers of a minimum length are eligible