Hot answers tagged

71

Yes, you should hash your passwords. Storing passwords in plaintext is not acceptable. No, it does not affect the amount of traffic your site require. The hashing should be done server side, so it does not affect what is transmitten from the client. Hashing the passwords protect them from theft once they are stored in your database. To protect them from ...


70

Should i block Yandex Why? First, if the bot is a legitimate search engine bot (and nothing else), they won't hack you. If not, blocking a User agent won't help, they'll just use another one. If your password is good, fail2ban is configured, the software is up to date etc., just let them try. If not, you need to fix that, independent of any Yandex bots. ...


61

If Bob is trying to type products and mistypes product, he already knows there's a URL in the website for products and so you're not telling him anything he doesn't know. If you don't suggest URLs that shouldn't be public, you won't have any issues. Why use a 404 message though, and not do an immediate redirect?


39

This source says that it is almost impossible to avoid user enumeration in this situation and delaying an attacker is the best you can do: If you are a developer you might be wondering how you can protect your site against this kind of attack. Well, although it's virtually impossible to make an account signup facility immune to username enumeration, it ...


31

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


18

The alternative to allowing multiple users to have the same user name is far worse! Really what happens with that system User requests a new password You now have to check passwords to make sure no collisions happen The user can use this to brute force other accounts That's bad. So you need to prevent multiple users from having the same username. You do ...


13

However, it led me to wonder if this is considered bad practice, as the server might expose URL's the admin of the website might not want to show publicly. This suggests that the feature is implemented by checking a list of all possible valid URLs (a list the server may not even have or be easily able to get), to include non-public ones, and comparing ...


12

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


12

I would say that keeping a URL secret is not really the best security practise. You may have some links, whether it's hidden, or generated by Javascript, that will show the admin URL or whatever to anyone who takes a look at it. This is even more true for SPA (Single Page Application) applications I think. I don't think there is any point of hiding URLs of ...


9

Along with agreeing with @deviantfan 's answer and specifically with this point First, if the bot is a legitimate search engine bot (and nothing else), they won't hack you. If not, blocking a User agent won't help, they'll just use another one. I would like to point out that as Yandex as well as another search engine bots in general might not ...


9

When a user tries to log in, he or she enters their username. When registering, you are told if a username is taken or not. If you find a taken username, you can try to log in with it and possibly hack it. Solution which is also another problem: If they had to log in with an email, the knowledge if a username is taken won't help - you log in with an email ...


7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


6

Using os.urandom() is perfectly alright. It generates a cryptographically secure random stream of bytes. This would be impossible to guess for anyone. Using guid() is also pretty secure, although not totally random. Using XOR to encode parameters into your token is a bad idea. For one, it is vulnerable to bit flipping attacks. Even if the user can not ...


6

Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


5

Any information about the internals of a system or application helps an attacker craft a specific attack. For instance, that error message includes table names, which means it becomes far easier to craft a SQLi attack. In addition, with detailed error messages, I could try to trigger different errors to map out the function of the backend, and even find ...


5

There's a big gap between "does not require" and "implemented by the lowest bidder". why do we even use full-power database software and SQL queries Because if you're already running a SQL database for your transactional data, implementing a second technology stack with appropriately trained development and support staff for a very specific function is ...


4

The attacker could add some onclick event attribute on the different link of the page. When the user click on a link, he'll think he got a simple disconnection bug, instead of that, you're onclick event loaded a fake connection page. But, you're still on the domain and you can even manipulate the url with history.pushState(); as an example.


3

I believe they do this in order to prevent spammers from entering random usernames and obtaining a list of email addresses, while still reminding the set address to the legitimate user (who might have more than one account). I personally don't see any major problem with that. Of course, someone might set up an account with an old email address, forget ...


3

Uploading a virus won't infect something. Interpreting the virus in the interpreter the virus was meant to exploit will (i.e. Acrobat opening a PDF; the OS launching an x86_64 binary; etc). This is something to think about when you evaluate your threat model. The importance of extensions File extensions are only hints to handling instructions. Only Windows ...


3

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you are using will not work with a proxy and depending on the implementation will either fail or will bypass the proxy. You have to limit yourself to only the kind ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


3

No, there's no other way to know if the file exists or not. However, if you can find out what OS is running on the system, then often you will be able to find the right path to certain files quite easily. In rare cases websites have a script or page which iterates through files in a folder specified by a POST or GET parameter which you could manipulate to ...


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


3

Allowing a user (or an attacker) to find out whether usernames exist or not is known as a "username enumeration" vulnerability. This is summed up well here: As an attacker if I can use your login or forgotten password page to narrow my list from 10000 targets to 1000 targets, I will. You can add "sign-up page" to that list. This aids an attacker in ...


3

I think the best answer here is to treat the necessary activity as a 301 (permanent) redirect. If you can anticipate misspellings and common issues and catch those in your webserver configuration (whether Apache, Nginx, or IIS), the entire activity should be completely transparent to the user. In your web application you could add some additional handling ...


2

I have a hypothesis that it is an identifier (non-social security number) that companies will sell to each other to track everything you do. So far I have been asked by: Vanguard, Fidelity, Bank of America, eBay, Amazon, Netflix, Yahoo, Google, LinkedIn. I think there are more, but I forget. It may be centralized because they all ask in the same manner, with ...


2

Very broad question, but here is a baseline of security additions I would add Firewall rules to block ALL except authorized sources Remote syslog/event logs Web Application security test This is beyond broad, and scattered. The reasoning? I have no idea what your risk is. Only you and your organization can determine that. So a quick risk analysis on a ...


2

Careful! Based on what you're saying, you've already donned the Hat, and now it's up for interpretation whether it's a Black, Grey, or White Hat. Depending on localities, you may actually have already committed a felony. System administrators can get very protective of their systems, and they don't always see the honest-guy-shows-you-your-lock-is-broken ...


2

Using os.urandom() uses accepted cryptographically secure sources, so continue to use that if you can, otherwise there should be another way to access the same, or similarly secure random sources in the implementation you are using (php java). The most important thing is that it cannot be predictable, which means any sort of seeding done manually (for ...


2

There are Yara rules submitted by SANS ISC to detect BeEF, and these could be repurposed by yarashop for the network layer as a early-warning detection system. The author shows how to utilize Volatility to read into a memory capture and look for BeEF-related signatures and communications -- ...



Only top voted, non community-wiki answers of a minimum length are eligible