Hot answers tagged

40

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


34

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator did not set a custom error page, and that it will return a default error page with server type and version information. You'll often see really long URLs used to ...


17

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


6

Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice. Think of it like terrorism-- Timothy McVeigh detonates a bomb in Oklahoma. You ban all white men from America. Does that really stop the problem? The majority of actual attacks I've seen come from botnets and/or anonymous ...


5

There are a lot of ways. Judging by the main features of your website, an attacker could have used: SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection; credential theft: the attacker could have stolen or ...


4

(tl;dr at bottom) Encryption is essentially free at this point, even on dial-up connections. Almost every major language has it built-in, or has a library for it, etc. The advantage of not using TLS/SSL is a very small fraction of a second start-up time, a very negligible reduction in CPU usage (a small fraction of a percent), and about 4kb of bandwidth ...


3

On the web servers I run, I deny access to any type of server log files and sensitive files that contain web app configuration details such as WordPress's wp-config.php file However, if you're running a website, denying access to PHP, HTML, CSS, in addition to some other file types would render your website unusable since browsers need to access those files ...


3

I can think of following scenarios: Since you are processing your data and then carrying out a DB call, you should ensure that you used prepared statements in your webserver. That will take care of all your SQL Injection attacks If you are presenting the data on your webpage, then ensure you are sanitizing your input to prevent a Stored XSS attack. An ...


3

Where exactly does the problem exist ? Nowhere. There is no problem. With ping you are working only at the network layer and on this layer there is no such thing as a hostname, there are only IP addresses. And crashsafari.com has the same IP address as s3-website-us-east-1.amazonaws.com because this is just an alias (DNS CNAME): $ dig crashsafari.com ......


3

The web servers you've menationed as being shipped with Linux distributions (Apache and Nginx) are two of the three most commonly used web servers (stats from the May 2016 Netcraft report). As such it's safe to say that a very large number of companies consider them safe for widespread use on the Internet (which is by definition a fairly hostile environment)...


2

This is a great question! I'm also a developer on a c++ product that handles high sensitivity data, and we face this dilemma almost every day. When a production system starts throwing alarms (especially performance or configuration-related ones, thought misbehaving software / bug ones also apply) we often need stack-trace level debugging turned on ...


2

Thomas Pornin has published a command line tool written in C# that does this, among other things. You can find the tool here. You should be able to easily modify this into a library.


2

Nobody can access the database or monitoring server directly ... as of now. My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available. On top of that you may run into issues when scanning ...


2

You should use secure WebSockets protocol in your product. Given (extremely little) information you provided about the details of your game*. Only general answer is possible to the question**: What is the worst thing that could happen if I don't enable wss? If you design and build a system disregarding common security precautions: at best nothing ...


2

Search for uploadify on https://www.exploit-db.com and you will notice that the JS-Script is part of your theme and vulnerable to Arbitrary File Upload Vulnerability. You could delete that Script and your theme might still work or better yet use another more secure theme.


2

@paj28 appears to have pointed us in a good direction: openssl s_server -tls1_2 You can launch an emulated TLS server and connect to it from your client. I'm not sure what settings you would need, or what, exactly, connecting would tell you, but it is a good, lightweight, and local resource you might be able to use for your needs. https://www.openssl.org/...


1

Those credentials have to be placed somewhere. If you decide to place them at a place like /usr/lib/cgi-bin, you'd have to grant your web user access to that directory structure which would in turn make your system more vulnerable. It is more common to place them one level above the web root as a compromise between the two. This way you don't open much of ...


1

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames? Absolutely! In fact all access should be denied and only allow known good requests. This is otherwise known as "Default Deny" or "Whitelisting". Marcus Ranum has some great points in The Six Dumbest Ideas in Computer Security. Though closely ...


1

Assuming you're using a decent language & framework, the only URLs that are accessible are the routes you defined. Everything else should get 404'd by default, except perhaps static non-sensitive files in a specific directory. Anything sensitive should be out of reach of the web server anyway and should only be proxied by the application should it ...


1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list -...


1

Typically yes, they're secure. They get patched just like the versions from the project. Most distros issue security advisories as they provide patches: Debian security advisories, Red Hat 6 advisories.


1

I've been working as a penetration tester since the late 90's and have seen a lot of applications. It is not uncommon that once in a while an application logs user-identifying data. Most developers declare people having access to the logs as trusted and therefore don't limit the logging. If this might be an issue depends on the business case and the desired ...



Only top voted, non community-wiki answers of a minimum length are eligible