Tag Info

New answers tagged

9

How can I defend against malicious GET requests? These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of ...


5

In conjunction with what @SakamakiIzayoi suggested: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any ...


4

The easiest defense solution would be to install a Web Application Firewall. You can find in-depth descriptions regarding them on OWASP and Wikipedia. I doubt the requests would slow down your site. Attackers would most likely request existing items as it would be far more effective in wasting your web-server's resources.


17

What stops a malicious site from obtaining the anti-CSRF token is the Same Origin Policy. The Same Origin Policy, or SOP, is at the browser level, and defines where JavaScript is allowed to communicate. JavaScript on example.com cannot call example.org to get data. Also, JavaScript on http://www.example.com/ cannot call http://www.example.com:8080/ as the ...


1

Your interpretation is incorrect. WPA2-PSK doesn't completely encrypt layer 2 information. Management frames are unencrypted (except in cases where management frame protection is implemented). MAC addresses of all communicating parties can also be observed, which somewhat helps to analyze communication flows and gain general information on the network. The ...


3

I would personally do 3 things in this situation: Show the client the data on the percentage of major breaches that are a result of phishing (Something like 95-97%) Further show that phishing can directly lead to an attacker to sniffing traffic on the network and he/she can view every bit of data passing to and from those services. Identify the quantity ...


2

There will eventually be a case where an action that is perfectly authorized at the proxy level will be able to cause unexpected behavior in a backend component. It's a matter of when, not if. This is a terrible idea. Your instincts on this are correct. Do anything you can to convince your client that they should not proceed down this path.


6

Based on my understanding, I think you don't even need to get inside the internal network to prove that's it's a terrible idea. An attacker (who can be an ex-employee, third party contractor or an existing disgruntled employee) having some context about this insecure internal application, including details such as internal host address where the application ...


5

This is how a approach your situation in general. Speak to the business There are three things that I think clients can really relate to when discussing the security of their applications. (90% of the time the users are a footnote). IP (Intellectual Property). No customer want their secrets available to their competition. Image. Companies can be kindly ...


2

The most common cyberattacks are summarized very well in the annual Verizon Breach Report: http://www.verizonenterprise.com/DBIR/ As can be read therein, phishing and credential theft attacks are two of the most common threats. Thus, if an internal system is compromised by someone accidentally clicking on a malicious link, an attacker is now inside the ...


0

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background ...


5

An internal user with a browser that also connects to the outside provides routes between the intranet and the public internet. I'm constantly pointing this out to people who tell me, "don't worry this is an internal web app". HTTPS is necessary in your case. This not only protects against the threat you mention, someone who has broken into the network, ...


2

regarding question 1: You can setup most webservers as a reverse proxy(IIS, Apache, Nginx and even NodeJS all work). IIS and Nginx are preferable(but not necessary) as they are faster(just my opinion - this may not always be true). Instructions for setting up IIS as a proxy can be found here Instructions for setting up Nginx as reverse proxy there are ...


1

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.


3

It seems that "gvt1.com" its owned by Google (whois shows:) Registrant Name: DNS Admin Registrant Organization: Google Inc. Registrant Street: 1600 Amphitheatre Parkway Registrant City: Mountain View Registrant State/Province: CA Registrant Postal Code: 94043 Registrant Country: US Registrant Phone: +1.6506234000 Registrant Phone Ext: Registrant Fax: ...


6

I think your question is a bit too broad. Session hijacking can be done on different levels, and it's not just copying something between browsers. For example: A malicious network admin / proxy admin could intercept your session ID and re-use this also. A vulnerable website could be exploited using cross site scripting, where an attacker can gain ...


2

It's a malicious bot, that is trying to scan web application for security vulnerabilities. Look at these links for more information about blocking it: http://serverfault.com/questions/700404/huge-traffic-from-post-123-249-24-233-post-ip-port-php https://gist.github.com/renancouto/0ad35842f1c536c1dbbe


2

When I hear this question, my first response is don't. If you are at all concerned about your personal network and your personal data, don't expose any part of it directly to the internet by hosting services. If you feel you must, here are some steps: Host the website on an entirely separate machine with nothing else on it Put that machine on a DMZ (most ...


-1

Imagine, that your company has some CRM, which has "friendly" (suggestive) urls. And imagine, that employees click on embedded links. Now, everyone with access to logs of linked domains can see your referers: crm.internal/list-of-customers-to-block-if-no-purchase.php crm.internal/list-of-customers-with-stupid-annoying-and-problematic-representatives.php ...


6

site is only available in HTTPS HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site. The secure flag for cookies ...


6

How exactly is this protecting against a malicious DNS routing? Not at all. If an evil guy has a valid certificate (e.g. from a hacking a CA) and then manages to man-in-the-middle you, then your connection is hacked. I was expecting a challenge response using the public key of the server, but I cannot find it. In order to do this you would have ...



Top 50 recent answers are included