Hot answers tagged

33

The one and foremost problem with this approach is that in your example, only the first one is actually a syntactically valid email address. The three others are not. This means that one of the two following options holds: The "email address" is merely a suggestion. The system wants a unique login identifier; email addresses are reasonably good identifier ...


29

HEAD is not dangerous in itself, and it does have legitimate uses. The problem is with Java EE. It has a way to set security constraints using web.xml files - but those are only applied to GET and POST, not to HEAD. This means that it is can be possible to bypass authentication using HEAD. There is more information about this and other issues in this paper ...


23

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


18

You can't really prevent it if the data is publicly available. But that doesn't mean that you have to make it extra easy to scrape the data either. Preventing Enumeration By exposing internal, ordered ids you make it extra easy to scrape all products. If you changed it to either product name or a random id, an attacker couldn't retrieve all the data with ...


17

Only the first email address is actually a valid address. Of course, email address validation is hard, so trying to implement perfect validation does not make sense. At a maximum, you can approximate validation, and for usability reasons, you should be lenient with your filter. Because of this, you should not base your security on the validity of email ...


16

I see two options here: Local Access Only Configure MySQL Server to only listen on TCP port 3306 on 127.0.0.1 (localhost). This way an internal web server can still communicate with the database server. Directly connecting to the database is server is no longer available but can be solved by SSH tunneling (as described in mk444's answer) This can be ...


9

Depends entirely on specific sites. I suspect that a lot of sites with known audiences have already started dropping support for XP specific fixes - sites dedicated to OSX software, for example, probably get negligible XP using traffic. They may well have decided that they would rather have better security than worryu about the few users who use XP. On the ...


6

The only way to decide if you are willing to lose the users with XP on your site, is to find out how much of them there are. Start to collect statistics on that. Then you have something to decide on. If you decide to increase security and drop XP support, based on that numbers, you can also show big information banners with guides how to install another ...


5

Generally there are two ways you can upload a shell to a server. Use RFI to execute PHP script that places shell You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways. Use FTP/HTTP/... module of php to download the shell from a ...


5

No. You want to ensure license file's integrity by using a public key to verify. However, if you let your app receive the public key with the license file, an attacker ( who want to change the license file ) could just change the content, generate a new key to sign the content and replace your key with their key. And your app will use attacker's public key ...


5

There are a few reasons that IPv4 addressing is not used in this way: IP addresses are not a foolproof indication of location. IP address blocks are assigned to companies and can be used anywhere they are required. A company in asia may get a block from apnic, but then use part of their allocation in north america Systems get different IP addresses all the ...


4

From strictly a security standpoint, you can do it this way, but it is not ideal. Even though the credentials are only stored temporarily on the server (and perhaps configured to only be stored in memory too), the fact that they are there longer than they potentially need to be poses a risk, albeit a small one. Note that encrypting the credentials in session ...


4

As well as the excellent points in Tim's answer, there are a couple more options Complain to their ISP If scraping your site is a violation of your terms & conditions, then if you complain to the ISPs of scrapers you have identified from their logs, they will generally tell them to stop doing it. Live with it Try to quantify the damage the scraping ...


4

If it's not required then definitely remove that service. It's a possible entry point for attackers and you can see the MySQL version number. The first thing that comes to mind is performing some Nmap scans, vuln-scans, mysql-brute, etc... If you need to use this service there are some good answers in this serverfault post: ...


4

One of the primary concerns to limiting Internet access revolves around downloadable threats. Malware that may be part of a botnet. Viruses Rootkits etc.. These threats can obviously compromise security and is a common methodology used by attackers to gain entry to an environment. If you get an agent based executable installed to your workstation that ...


4

As long as you don't execute files contained in that tarball your on the safe side of the fence. As you seem to have realized there is a potential thread which was called zip bomb in the past and contained heavily compressed content which when extracted without size checking will use a lot of space on the disk. // when you say max size you mean the size ...


3

When you connect to your company's "remote access site", your computer is launching a Virtual Private Network (VPN) connection. This first installs a virtual network adapter called a 'tunnel' which is then configured to securely connect to your company's VPN server; at the company server, the other end of the tunnel emits your packets onto the corporate ...


3

Scrape Artist here. You can't stop me no matter who you are There is no reliable way to do it. You can only make it harder. The harder you make it, the harder you make it for legitimate users. I write web scrapers for fun, and not only have I bypassed all of the above ideas by tim, but I can do it quickly. From my perspective, anything you introduce to ...


3

You have essentially two issues in your process: providing the update and having it installed. Server Auth Firstly, yes you need to authenticate the server. This means that communication to the server must be done on a secure encrypted channel. Make sure to take the time to understand attacks on SSL so you don't use something that's expired. Ship the ...


3

OWASP defines Information Leakage as a vulnerability, so the debate is really on whether or not the specific version information should be classified as "Information Leakage". As @Oasiscircle mentions, this information can be used as a starting point for attackers who know of specific vulnerabilities associated with specific versions. We know attackers use ...


2

Would access need to be gained to the server in question? To read the .htaccess file, yes, assuming the server is properly configured everything else running on the server is secure. Most default apache installations have a rule that files starting with .ht will not be served statically. It could still be served by a buggy application on the server, ...


2

No, if you can't change the part before the colon, you are guaranteed to always produce a HTTP URL, no matter what you append. This follows the Uniform Resource Identifier (URI): Generic Syntax RFC 3986. Each URI begins with a scheme name [...]. The syntax of the scheme part is specified as follows: URI = scheme ":" hier-part [ "?" query ] [ "#" ...


2

This smells like homebrew with all the inherent problems. HTTPS addressed many possible attacks, including the ones you described. It will be naive to assume you/me/{anybody else alone} can come up with better alternatives. Unless such approach is peer-reviewed by large security community and proven by time. Standard HTTPS with strong authentication ...


2

What you are referring to is a split tunneling. Split tunneling allows you to directly access the internet from your device, while the device has the VPN connected to the remote location. There are a number of pro's and con's to split tunneling - in terms of security and other logistics. See ...


2

As other said, start by measuring the statistics, the most relevant the better. By relevant I mean "representative for your users", so I'd consider js-based analytics a bit more relevant than webserver log statistics if your site is meant to be used by humans and the reverse if you have some web APIs that you encourage people to use. Then take those ...


2

Sounds like you're trying to implement something like single sign-on between two of your apps. In this case, you should be able to without any significant security issue. Instead of authenticating with login credentials, you could have App B authenticate with App A's session ID. Obviously give the ID the same protections you'd give login creds, i.e. only ...


2

It depends. If she's the only one user getting this sort of alert, chances are that her machine is infected. If many users report this issue, it's time to get your website checked. Also, if she's getting the alert from her legitimate anti-virus product, it could be the case of false-positive. A simple email to the anti-virus vendor would solve your ...


2

See comments - the licence information is signed with the private key, and validated using the public key. In this case, the public key can be 100% public - no-one else should be able to sign data with the private key (as long as that is kept secret), and there is no (known) way to get back to the private key from a public key. Publish it on your website, ...


2

If there's a way to access data without an audit log, secure the credentials required to access it that way and audit their access. Software such as Vault is geared toward this. Physical control of an MFA token such as storing it on a YubiKey and then putting that in a safe place with somebody who doesn't control the password would provide you with dual ...


2

I think it's going to be extremely difficult, if not impossible to do this. Think about ALL the places where customer data exists, or can be accessed from: Production SQL servers. Development SQL servers. Backup servers. Production webservers. Development webservers. You probably are already auditing production webservers. But what about development ...



Only top voted, non community-wiki answers of a minimum length are eligible