Tag Info

Hot answers tagged

18

In IIS 7 (and 7.5), there are two things to do: Navigate to: Start > 'gpedit.msc' > Computer Configuration > Admin Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order (in right pane, double click to open). There, copy and paste the following (entries are separated by a single comma, make sure there's no line wrapping): ...


17

Using an SSL certificate for your websites primarily gets you two things: Identity proofing that your website is who it says it is Stream encryption of the data between the webserver and the client By doing what you propose, which is normally called self-signing, prevents you from relying on the identity proofing. By using a known trusted CA the client ...


9

I assume that you mean issuing or signing your own certificates, not actually hosting them. From a pure security (encryption/data confidentiality) point of view, an X.509c3 certificate is an X.509c3 certificate and the offer the same security for the same number of bits. So a 2048-bit cert issued by Verisign is as secure as a 2048-bit cert issued by ...


9

A SSL/TLS connection must always end with an alert message of some kind: a connection which is broken (e.g. the underlying TCP socket is closed) without an alert is said to be improperly terminated. The alert message for a normal termination is close_notify. The handshake is only a part of the connection; a handshake occurs at the start and subsequent ...


9

Here's some high level design things to plow through first. There's a couple of ways to skin the cat, and how you set it up will impact the long term sustainability of this system. Issuing and Managing Certificates: So, you'll definitely need to issue each administrator his certificate. As per usual, Microsoft plays well with Microsoft, so if you have ...


9

One possible path would be to try and get it to be included somehow. A lot of add-on frameworks can run an arbitrary PHP code file. If the attacker was able to find such an add-on framework, they could give it the path to the file and it would be executed as PHP regardless of the file extension.


8

Really does depend on your threat model, how valuable is the information and functionality offered by the web service? What type of attackers and specific attacks are you worried about? IP address restriction is the most basic form of protection and really does not give you any security. It is trivial to bypass via a proxy for example. Also if you whitelist ...


8

The right way to do this is to run your own private CA. You can then use Active Directory to push the (self-signed) CA's public key to all of the client computers on your network. If you do this right, then no one should see any cert warnings from their browsers. This is a perfectly reasonable approach for use on an internal network (e.g., an enterprise ...


8

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services. I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular ...


8

I just posted an update to IIS Crypto which is a free tool that sets the schannel registry keys and puts RC4 at the top of the SSL cipher suite order with a single click. This mitigates the BEAST attack on Windows Server 2008 and 2012.


7

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


7

A generic remark is the following: if you can reboot the machine, and the server becomes operational again automatically, without any further human intervention, then, by definition, the machine disk contents contain everything that the machine needs to access the private key. Correspondingly, someone gaining full access to the machine (as "root" on Linux, ...


6

According to the OWASP Top Ten (note that this link is not the latest because they have dumbed down the T10 Project over time) -- using authentication based on IP addresses, IP prefixes, or DNS names should not be relied upon. It's a dangerous practice because A) it is not tied to a single person per credential, and B) it can be spoofed, tricked, proxied, or ...


6

The section on client certificates in the TLS 1.0 specification (RFC 2246) says this: If no suitable certificate is available, the client should send a certificate message containing no certificates. If client authentication is required by the server for the handshake to continue, it may respond with a fatal handshake failure alert. The ...


6

The Center for Internet Security Benchmarks tend to be my go to source for hardening advice. They will, of course, need to be tailored to your environment, but I have found them to be fairly general purpose and easily modified. On the linked download page you will find both IIS and SQL Server documents. As for the other half of your question, it seems like ...


5

No, there is no need to ever encrypt loopback traffic with SSL. Loopback traffic never leaves the machine, since the interface is virtual. The traffic never even reaches a real NIC's device driver. In order to capture the loopback traffic, an attacker would need to execute a capture program on your machine. Once an attacker has code execution on your ...


5

As long as you have taken all the usual security precautions, this isn't anything to worry about. On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of ...


5

I'm not familiar with IIS so I hope what I've found is not the outdated results you already found. But what you need is to set up a Certificate Authority and issue a certificate per User. I found this site talking about how to do it. The the mapping seems to be done between certificate and AD(??) users. You can check here and here about the so-called ...


5

When the machine says that "you have the private key corresponding to this certificate", then this means that you have the private key which corresponds to the certificate, not that the certificate itself contains the private key. Asymmetric keys come in pairs: the public key and the private key. They are mathematically linked to each other, but rebuilding ...


5

I am pretty sure that this is not Apache Synapse, it's some tool build with Ararat Synapse, this is a Delphi TCP/IP library. I downloaded source code from both projects, and as far I can see Apache Synapse have a configurable user-agent, and default is : Synapse-HttpComponents-NIO on the other hand Ararat Synapse have default user agent : Just like one ...


5

This is not XSS. You got hacked. You want to check the settings of auto_prepend_file and auto_append_file. This may be in your php.ini or in .htaccess files. If the attacker had access to the system to the point where he could run arbitrary PHP code, he could have done a lot of worse things. Do find out how the attacker got in if you can, but afterwards, ...


4

This attack would require two requests, one to upload the file and another to execute it. It appears as though the 2nd request is attempting to execute the uploaded payload. My guess is that the first request is generated by the normal function of your application and is likely not the request that uploaded the file. In any case you should try replacing ...


4

Yes, to set up your server with SSL, you'll need a digital certificate. If you're IT is just saying "set up SSL" and not giving you instructions for certificate generation, then it's likely that a self-signed certificate is all you need at the moment. There should be a ton of articles on this - needing to set up a certificate and SSL on the server is a ...


4

I will take an example from OpenSSL, which is used by Apache. There is a mode flag, called SSL_VERIFY_PEER which when set on the server, it will ask for a client certificate at the handshake. The client is free to send it or not. Then the behavior of the server, depends on another flag: SSL_VERIFY_FAIL_IF_NO_PEER_CERT Which is explained as follows ...


4

I would add additional authentication to the mix--perhaps an additional header added by an intermediate proxy or something. Even a header isn't very strong because it can be spoofed, but IP address alone seems a bit weak. While spoofing TCP traffic (and seeing responses) is not trivial, you should look for another layer to add if possible. If you're in ...


4

As with all scenarios it depends on what you are protecting against. Generally speaking, its not wise to host administrative endpoints on public networks. In other words change the site to not be accessible on the internet. Second, some people have problems with domain-joined servers on the internet. If its breached, then attackers have access to your ...


4

I have a suggestion. Why don't you pick one of those web pages that gets visited by these weird visitors and that you don't use for any legitimate purpose, and replace it with a landing page that asks anyone who sees the page to provide information about how they got to that page? Perhaps you could frame it as a user satisfaction survey: (1) How satisfied ...


4

OpenSSL does support Windows. You can download it hehe. This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL). The command is as follows: openssl s_client -connect localhost:443 -ssl2 EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!


4

This log entry means that someone, somewhere, tries to know the names of the directories on your server by the simple but inelegant expedient of trying a lot of possible names -- and that someone is honest enough to let his tool state it plainly. Such attacks are very common. Whenever there is a public-facing server on the Internet, seemingly random attacks ...



Only top voted, non community-wiki answers of a minimum length are eligible