Hot answers tagged

97

They are not the same at all. A ping request is an ICMP packet which just sends by default null data to check if the host is up (You can change around the parameters being sent (read more here).) When you visit a website in the browser you are using the HTTP protocol which requests data and so you have a CLIENT/SERVER setup here (data is served to the ...


32

The cameras are often designed for ease-of-use by people who want to watch the streams of their goldfish or children. To make it easy to use, the cameras often call home to the manufacturer's website for remote viewing. Often these sites are insecure. Another method is UPnP sets up automatic port forwarding: https://en.wikipedia.org/wiki/...


25

Is that more or less like visiting the website by typing the hostname into your browser and letting it load? Short answer, no ... it's not even close. When you run whois you are doing a lookup of an IP or Domain's publicly registered information. In many cases the whois request will not even communicate with the target server. Rather whois databases are ...


16

Typically this happens with in a few scenarios End-user puts the device in the DMZ because they want to access it remotely and can't be bothered trying to figure out port-forwarding rules. This might happen if a user is Torrenting or has a NAS or other device they want to access from the public internet. User has allowed direct access to the device via ...


10

You can't ping a web site. You can ping a network interface; this sends ICMP ECHO request packets to that interface (and summarizes the replies received). A web site (in this context) is a server answering HTTP and/or HTTPS requests on one or more TCP ports on the interface (normally port 80 for HTTP and port 443 for HTTPS). A given interface may or may ...


10

Pinging a website and viewing it in a browser are two absolutely different processes which involve different protocols altogether. Ping sends an ICMP request (response won't be malicious) while viewing a webpage sends a request to get the index page (possibly malicious) of the website. In your case, you have nothing to worry about. Firstly, it was a ...


5

I work for CloudFlare so maybe I can shed some light on how we do things. Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different ...


4

In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser will ignore both the builtin pinning and also the pinning done with HPKP header. This is explicitly done this way to make legal SSL interception (in firewalls, ...


3

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, ...


3

As a client your basic countermeasure is to use a VPN. Since you don't have a good way to baseline anything about the multitude of Wifi access points you might have to use, your ability to spot a real one vs a Wifi Pineapple is pretty minimal. Your only hope, really, is to immediately route all traffic through a properly authenticated VPN which will resist ...


3

DNS does not use ICMP. It uses UDP (and rarely TCP) port 53. The firewall/router the captive portal contols either does not block that port or it is the DNS server and is responding. All other traffic are of course blocked until you log in. Response to comment: For 2), UDP has no session control, i.e. it just sends a packet without checking if it has ...


3

OSI layers do not care where the check happens, but at which layer the information used in the check reside. If the check is doing whitelisting by IP address only it does not matter where the check is configured, because the decision is always purely based on the IP address, i.e. OSI layer 3. But, depending on the setup and the validation code the check ...


3

A NAS is not necessarily connected to the Internet, e.g. my NAS has a local 192.168 address which is not routed. In addition I have blocked that IP address from getting Internet access through the DSL router. The NAS itself is protected via username and password. There are a few attack vectors, of course: the DSL router can be hacked. Getting root access ...


3

No. I would say running ping or traceroute on a domain is not a security risk. Furthermore, the ping is done by who.is and not by your computer.


3

This is an extremely broad question. When you're learning about security and penetration-testing, you're supposed to learn all these techniques. There are loads of techniques each with it's own purpose, situation,... To give a small answer on your question, Social engineering is often used, and so are backdoors. Lastly I had to write a PoC (Proof of concept)...


3

You should check out this question including the accepted answer: A port isn't open if something isn't listening for a connection on it. The reason it is bad form to have all ports open to everywhere is that it exposes those services that are listening on those ports to exploits. That is why firewalls exist, to limit what is allowed to connect to ...


2

It depends on what you want to protect, and when. If your server hosts a number of services, or a number of websites, then you would want the control closest to the target so as to not deny the IP from the other services/sites. If your server hosts a website and an email server, and someone pentesting you rightly triggers a block, you don't want them ...


2

Large scale DDoS attacks usually aggregate at a target's access router where their impact is strongest. Whether multiple DDoS attacks of 500Gbps or multiple DDoS attacks of 1Tbps should be handled by network providers' DDoS defenses ideally.Here's an interesting article on the professionalisation of attacks and service providers/managed service providers ...


2

Attackers employ a variety of techniques to compromise networks, however I would argue that in many (if not most cases) social engineering is involved. Spear Phishing has an overwhelming success ratio when executed properly and skilled social engineers are always going to be something to be feared. Spear Phishing typically also relies in a weakness in the ...


1

You are right in saying the ability to stop ddos attacks are a function of finance. Cloudflare's use of anycast DNS returns DNS answers based on geography. You can quench attacks by nxdomaining clients that exhibit high bursty connection or DNS queries. There are a few ways to return DNS queries based on geographic fencing. One way is to incorporate geoip ...


1

The purpose of the DMZ is to do not expose your DB directly to Internet. Instead you expose it to your web application, and your web application to Internet. But you need to take care of the security of both the web app and the DB. If your web application gets compromised, it doesn't mean that the DB is as well. There are various vectors here, for example, ...


1

In addition to the book references left in my comment, I think you can set the following as your high-level steps. OSINT (includes recon on the company, DNS records recon, etc) IP Scans Banner checking for vulnerabilities Web application scans & testing (Burp, Nikto, etc) Social engineering of employees Privilege escalation (if required because ...


1

There's no straight way to develop a product. It is non-trivial thing. I'd start from the top with the learning of the networking which is basically switching, routing, load-balancing, proxying, fail-overing, firewalling (so that would be Computer Network Course), and then I'd proceed to enterprise grade programming language which aids in things like Big ...


1

It is generally assumed that your NAS is set for local access and not exposed to the external network via port forwarding or DMZ ... if this is not the case please update your question accordingly. Given this assumption, the NAS can be considered as vulnerable as the rest of your internal network. If you download a virus on a computer with access to the ...


1

First all packages are going through the TLS encrypted VPN. Then all apps could communicate over another encrypted connection (for example https). So these packages are encrypted multiple times. If you want to sniff, the simplest way doing this is install the sniffer directly on your device and install your own root certificate (this is a high security risk)...


1

It's a good method of detection, to repeat: Memory check for hidden processes Network traffic check Filesystem check The above solution is flexible, scalable and secure, however it's not your average scripting if large scale is involved, for which this is best suitable solution. But this doesn't mean it would not work on smaller scales, however effort ...


1

Depending on what kind of service you are running you might want to do it in different places. The advantage of iptables is that it runs on linux kernel and prevents data from ever reaching your processes. Meaning that if something like heartbleed or shell shock ever happens again, attacker will never be able to reach vulnerable application. It is very ...


1

All Linux and BSD-based firewalls are just a management UI over their respective IS kernel's firewall feature. If you want remote access and scripting functions, you can use standard remote management and scripting tools of the base OS, namely, SSH and shell scripts. The firewall products that support web administration can also be remotely accessed by ...


1

Is there another way to get around this problem? Yes, you can configure your SSL interception tool to delete any HPKP headers in responses. You'll need all users to start with a dedicated browser profile, that's only ever used under SSL interception. If the same browser profile is ever used without SSL interception, the real server may pin their ...


1

In general, I agree with your implication that if you only have a single web application there is little security benefit to moving the DB onto a separate server. That being said, there could be some contrived scenarios where there might be a security benefit. For example, if the web application does not have full admin rights to the DB, then a compromised ...



Only top voted, non community-wiki answers of a minimum length are eligible