New answers tagged

0

SSLLabs As @schroeder pointed out in the comments, this site assesses the client capabilities and reports on them in the response: https://www.ssllabs.com/ssltest/viewMyClient.html Disadvantages: The response is designed for human consumption in a browser. It's not crystal clear whether the response requires JavaScript to give a valid response. It ...


1

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames? Absolutely! In fact all access should be denied and only allow known good requests. This is otherwise known as "Default Deny" or "Whitelisting". Marcus Ranum has some great points in The Six Dumbest Ideas in Computer Security. Though closely ...


1

Those credentials have to be placed somewhere. If you decide to place them at a place like /usr/lib/cgi-bin, you'd have to grant your web user access to that directory structure which would in turn make your system more vulnerable. It is more common to place them one level above the web root as a compromise between the two. This way you don't open much of ...


1

Assuming you're using a decent language & framework, the only URLs that are accessible are the routes you defined. Everything else should get 404'd by default, except perhaps static non-sensitive files in a specific directory. Anything sensitive should be out of reach of the web server anyway and should only be proxied by the application should it ...


3

On the web servers I run, I deny access to any type of server log files and sensitive files that contain web app configuration details such as WordPress's wp-config.php file However, if you're running a website, denying access to PHP, HTML, CSS, in addition to some other file types would render your website unusable since browsers need to access those files ...


2

@paj28 appears to have pointed us in a good direction: openssl s_server -tls1_2 You can launch an emulated TLS server and connect to it from your client. I'm not sure what settings you would need, or what, exactly, connecting would tell you, but it is a good, lightweight, and local resource you might be able to use for your needs. https://www.openssl.org/...


3

I can think of following scenarios: Since you are processing your data and then carrying out a DB call, you should ensure that you used prepared statements in your webserver. That will take care of all your SQL Injection attacks If you are presenting the data on your webpage, then ensure you are sanitizing your input to prevent a Stored XSS attack. An ...


0

Proper input validation. I have seen many times that the applications handle special characters in the input fields very well except present in the data in the uploaded excel file. Make sure any error message that you show for invalid data in excel file should be a generic message and should not include unencoded cell value. Otherwise your app will be ...


1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list -...


2

Nobody can access the database or monitoring server directly ... as of now. My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available. On top of that you may run into issues when scanning ...


0

When granting a user access to a database there are a few considerations to be made with advantages and disadvantages in terms of usability and security. Here we have two options for authenticating and granting permission to users. The first is by giving everyone the sa (systems admin) account access and then restricting the permissions manually by retaining ...


3

Where exactly does the problem exist ? Nowhere. There is no problem. With ping you are working only at the network layer and on this layer there is no such thing as a hostname, there are only IP addresses. And crashsafari.com has the same IP address as s3-website-us-east-1.amazonaws.com because this is just an alias (DNS CNAME): $ dig crashsafari.com ......


0

If properly configured, then yes, the IP address of the backend server would be hidden. This is the operating principle behind DDoS protection services like Cloudflare: Hide the real server behind a proxy server that can tolerate a large volume of traffic while filtering out bad requests. That said, if it's imperative that your backend server IP remains ...


0

Using a reverse proxy in web servers allows you many features. One of these is automatic data traversal to multiple servers through reverse proxies and load balancers. The server should be completely anonymous at this point. The only way the attacker could find out the proxied server is if there was a vulnerability in the framework that allows them to run ...


4

(tl;dr at bottom) Encryption is essentially free at this point, even on dial-up connections. Almost every major language has it built-in, or has a library for it, etc. The advantage of not using TLS/SSL is a very small fraction of a second start-up time, a very negligible reduction in CPU usage (a small fraction of a percent), and about 4kb of bandwidth ...


2

You should use secure WebSockets protocol in your product. Given (extremely little) information you provided about the details of your game*. Only general answer is possible to the question**: What is the worst thing that could happen if I don't enable wss? If you design and build a system disregarding common security precautions: at best nothing ...


2

This is a great question! I'm also a developer on a c++ product that handles high sensitivity data, and we face this dilemma almost every day. When a production system starts throwing alarms (especially performance or configuration-related ones, thought misbehaving software / bug ones also apply) we often need stack-trace level debugging turned on ...


1

I've been working as a penetration tester since the late 90's and have seen a lot of applications. It is not uncommon that once in a while an application logs user-identifying data. Most developers declare people having access to the logs as trusted and therefore don't limit the logging. If this might be an issue depends on the business case and the desired ...


2

Search for uploadify on https://www.exploit-db.com and you will notice that the JS-Script is part of your theme and vulnerable to Arbitrary File Upload Vulnerability. You could delete that Script and your theme might still work or better yet use another more secure theme.


5

There are a lot of ways. Judging by the main features of your website, an attacker could have used: SQL injection: it is not necessary to have direct access to the database. If you want technical details, this question and its answers explain different ways to obtain a shell from a SQL injection; credential theft: the attacker could have stolen or ...


6

Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice. Think of it like terrorism-- Timothy McVeigh detonates a bomb in Oklahoma. You ban all white men from America. Does that really stop the problem? The majority of actual attacks I've seen come from botnets and/or anonymous ...


17

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


34

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator did not set a custom error page, and that it will return a default error page with server type and version information. You'll often see really long URLs used to ...


40

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


0

They are about as secure as the next widespread security fiasco, ie if you get hosed by a openssl hole, you are safe in assuming millions others are too. The upside is, the updates and fixes are usually very quick on turnaround.


2

Thomas Pornin has published a command line tool written in C# that does this, among other things. You can find the tool here. You should be able to easily modify this into a library.


1

Typically yes, they're secure. They get patched just like the versions from the project. Most distros issue security advisories as they provide patches: Debian security advisories, Red Hat 6 advisories.


3

The web servers you've menationed as being shipped with Linux distributions (Apache and Nginx) are two of the three most commonly used web servers (stats from the May 2016 Netcraft report). As such it's safe to say that a very large number of companies consider them safe for widespread use on the Internet (which is by definition a fairly hostile environment)...



Top 50 recent answers are included