Tag Info

Hot answers tagged

25

In IIS 7 (and 7.5), there are two things to do: Navigate to: Start > 'gpedit.msc' > Computer Configuration > Admin Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order (in right pane, double click to open). There, copy and paste the following (entries are separated by a single comma, make sure there's no line wrapping): ...


17

Using an SSL certificate for your websites primarily gets you two things: Identity proofing that your website is who it says it is Stream encryption of the data between the webserver and the client By doing what you propose, which is normally called self-signing, prevents you from relying on the identity proofing. By using a known trusted CA the client ...


15

I just posted an update to IIS Crypto which is a free tool that sets the schannel registry keys and puts RC4 at the top of the SSL cipher suite order with a single click. This mitigates the BEAST attack on Windows Server 2008 and 2012.


10

When you type the URL in your browser, the browser will mainly do two things with it: Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server, Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case ...


9

I assume that you mean issuing or signing your own certificates, not actually hosting them. From a pure security (encryption/data confidentiality) point of view, an X.509c3 certificate is an X.509c3 certificate and the offer the same security for the same number of bits. So a 2048-bit cert issued by Verisign is as secure as a 2048-bit cert issued by ...


9

A SSL/TLS connection must always end with an alert message of some kind: a connection which is broken (e.g. the underlying TCP socket is closed) without an alert is said to be improperly terminated. The alert message for a normal termination is close_notify. The handshake is only a part of the connection; a handshake occurs at the start and subsequent ...


9

Here's some high level design things to plow through first. There's a couple of ways to skin the cat, and how you set it up will impact the long term sustainability of this system. Issuing and Managing Certificates: So, you'll definitely need to issue each administrator his certificate. As per usual, Microsoft plays well with Microsoft, so if you have ...


9

One possible path would be to try and get it to be included somehow. A lot of add-on frameworks can run an arbitrary PHP code file. If the attacker was able to find such an add-on framework, they could give it the path to the file and it would be executed as PHP regardless of the file extension.


8

Really does depend on your threat model, how valuable is the information and functionality offered by the web service? What type of attackers and specific attacks are you worried about? IP address restriction is the most basic form of protection and really does not give you any security. It is trivial to bypass via a proxy for example. Also if you whitelist ...


8

The section on client certificates in the TLS 1.0 specification (RFC 2246) says this: If no suitable certificate is available, the client should send a certificate message containing no certificates. If client authentication is required by the server for the handshake to continue, it may respond with a fatal handshake failure alert. The ...


8

The right way to do this is to run your own private CA. You can then use Active Directory to push the (self-signed) CA's public key to all of the client computers on your network. If you do this right, then no one should see any cert warnings from their browsers. This is a perfectly reasonable approach for use on an internal network (e.g., an enterprise ...


8

The obvious answer (if we accept your premise) is: routinely port-scan your own machines to see if they are running any unexpected services. I'm not too sure about the premise that the best way to defend against this risk is to try to detect use of IIS Express. I wonder if you have considered an alternative approach, which is not specific to any particular ...


8

I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is : Synapse-HttpComponents-NIO On the other hand, Ararat Synapse has default user agent : ...


8

A generic remark is the following: if you can reboot the machine, and the server becomes operational again automatically, without any further human intervention, then, by definition, the machine disk contents contain everything that the machine needs to access the private key. Correspondingly, someone gaining full access to the machine (as "root" on Linux, ...


7

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


6

According to the OWASP Top Ten (note that this link is not the latest because they have dumbed down the T10 Project over time) -- using authentication based on IP addresses, IP prefixes, or DNS names should not be relied upon. It's a dangerous practice because A) it is not tied to a single person per credential, and B) it can be spoofed, tricked, proxied, or ...


6

As long as you have taken all the usual security precautions, this isn't anything to worry about. On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of ...


6

The Center for Internet Security Benchmarks tend to be my go to source for hardening advice. They will, of course, need to be tailored to your environment, but I have found them to be fairly general purpose and easily modified. On the linked download page you will find both IIS and SQL Server documents. As for the other half of your question, it seems like ...


6

OpenSSL does support Windows. You can download it hehe. This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL). The command is as follows: openssl s_client -connect localhost:443 -ssl2 EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!


5

No, there is no need to ever encrypt loopback traffic with SSL. Loopback traffic never leaves the machine, since the interface is virtual. The traffic never even reaches a real NIC's device driver. In order to capture the loopback traffic, an attacker would need to execute a capture program on your machine. Once an attacker has code execution on your ...


5

I'm not familiar with IIS so I hope what I've found is not the outdated results you already found. But what you need is to set up a Certificate Authority and issue a certificate per User. I found this site talking about how to do it. The the mapping seems to be done between certificate and AD(??) users. You can check here and here about the so-called ...


5

This log entry means that someone, somewhere, tries to know the names of the directories on your server by the simple but inelegant expedient of trying a lot of possible names -- and that someone is honest enough to let his tool state it plainly. Such attacks are very common. Whenever there is a public-facing server on the Internet, seemingly random attacks ...


5

When the machine says that "you have the private key corresponding to this certificate", then this means that you have the private key which corresponds to the certificate, not that the certificate itself contains the private key. Asymmetric keys come in pairs: the public key and the private key. They are mathematically linked to each other, but rebuilding ...


5

This is not XSS. You got hacked. You want to check the settings of auto_prepend_file and auto_append_file. This may be in your php.ini or in .htaccess files. If the attacker had access to the system to the point where he could run arbitrary PHP code, he could have done a lot of worse things. Do find out how the attacker got in if you can, but afterwards, ...


5

You are absolutely correct. This is a very well known problem with NTLM authentication and the resulting attack is known as Pass the Hash. There is in fact a very handy tool called Pass-The-Hash toolkit that makes exploiting this really easy.


5

No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be accessible to other applications. If you control the system, then you can do whatever you want, including just decrypting the section. There is no protection ...


5

Installing more software on any machine (almost) always increases the number of ways the machine can be attacked. So it is generally good practice to segregate components when possible. Suppose there is an attacker can use a flaw in the wordpress blog to execute PHP code, now the server hosting your main site is owned. Another issue that comes to mind with ...


4

How does one disable CBC 'mode' on IIS6? You disable all ciphers that have CBC in their name. http://support.microsoft.com/default.aspx?scid=kb;EN-US;245030 describes how; https://www.nartac.com/Products/IISCrypto/Default.aspx provides a tool to do it for you. Also, from that second website: Note - Windows Server 2003 does not support the ...


4

This attack would require two requests, one to upload the file and another to execute it. It appears as though the 2nd request is attempting to execute the uploaded payload. My guess is that the first request is generated by the normal function of your application and is likely not the request that uploaded the file. In any case you should try replacing ...



Only top voted, non community-wiki answers of a minimum length are eligible