Tag Info

New answers tagged

0

Since you are building a web-application a good place to start is the OWASP Top Ten. Once you believe that you've done well to harden your code look into doing both static and dynamic analysis on it. Static analysis tools will vary according to the framework your using. Again, OWASP can get you started. After that, check the Terms of Service for AWS ...


1

The biggest challenge in developing secure (web) applications is implementing a secure (or security) development lifecycle process that is both effective and measurable. Enumerating all of the facets of such an undertaking is not possible here; but suffice it to say there are hundreds of books and white papers written to address the subject.


0

Apart from the OWASP top 10, I think one of the biggest challenge, related to web applications, is JavaScript Cryptography. I would highly recommend reading the following two related articles, if you're interested in exploring more about it and looking for something challenging: What’s wrong with in-browser cryptography? Javascript Cryptography Considered ...


2

Ideally the application would be written to conform to a 3 tier architecture. In this scenario it is common for the Presentation Layer to reside in a WebDMZ, the Application Layer to reside in an AppDMZ and the Data Layer to reside on the internal network. If this isn't feasible for some reason or another, I recommend the database reside in a ...


2

For a reasonable level of security, the answer is really neither. The database should be housed in it's own zone, not the DMZ with the web server, or in the internal network zone. This allows additional levels of protection both against intrusion from the public Internet should the web server or web application be compromised, and against attacks from the ...


0

You can't get a nice notification to the user without establishing the TLS connection first. This means that your server or some middlebox (load balancer) in between must still be able to talk TLS 1.0. But you then could then check the protocol version of the client inside your web application and show the nice notification there. But, if and how this can be ...


0

A good load balancer, such as a Citrix Netscaler can offload SSL and redirect traffic based on the ability to encrypt or redirect according to what is minimally acceptable.


-1

It is not definitely malware. At least, not in the sense it's intended for malicious reasons... In the case you are using cpanel and you have used its IP Deny Manager to block access to 121.54.58.159 then this will automatically be written to your .htaccess file with the intended purpose of blocking that IP (and any others you may wish to enter): ...


0

If the compromised computer is on a windows domain and the attacker gets system access he can dump local password hashes. So if you have the same administrator accounts on all machines youre entire network is compromised. Also the attacker can lay low and wait for a domain user to log on and steal that password so that probably also gives access to log ...


2

Let's try to tackle two problems at once. First of all yes you will take a performance hit, especially if you are logging onto the same machine. The idea is that you do not log everything locally but instead use an encrypted syslog connection (or similar) to log every request to a seperate logging server. This will relieve the webserver from being busy with ...


0

In general a compromised device on the LAN is a pretty serious risk to the rest of the devices on the network. An attacker can launch probes from the compromised machine to look for weaknesses in other machines - for example, do you have remote desktop enabled anywhere? File & Printer sharing? A machine that is not fully patched and up to date, which ...


3

Without a defense in depth security strategy, once the perimeter defense of your network has been penetrated through your compromised server there are a few threats to the rest of your network. The vulnerability exploited by the attacker could be available on other machines on your network, allowing an attacker to move to another machine with ease. A poor ...


1

You need to do a risk assessment for each site. and consider likelihood as well as consequences. It could be that some of your sites have a much higher likelihood than others. If this is the case, you could consider slightly modified approaches, such as keeping the high risk sites on their own system and only putting the lower risk ones on the shared system. ...


0

@scuzzy-delta has a great overview above, but I thought I might answer a little more preventatively. General Security for Online Services One of the best ways to avoid harm from bugs like this is by using a password manager like KeePass (KeePassx for Mac and Linux). Password managers can generate and store completely unique passwords for all the websites ...


4

First, may I ask why you think the app is not as secure as the website? Generally speaking, from a security perspective, one of the worse things you can possibly do is to involve PHP, which has more security pitfalls then, well, probably all of the other common technologies combined. Additionally: if you're any sensitive traffic from the app to the ...


3

As long as you don't setup the server yourself you cannot be sure that what you are seeing with ssh is actually what is happening on the server. At the end your ssh access could just be a well built honeypot and nothing you see there relates to real server activity. Even if you've setup the server yourself you cannot be sure, because there is still the ...


1

Iptables can do this without any difficulty. Create a chain for the target IP address(es) and within that chain, modify the inbound request packet so that the request is for a different file. Alternatively, you could modify the outgoing packets so that they contain the target file instead of the original contents of index.html. None of the binaries or ...


0

The MySQL SO_PEERCRED authentication is fairly recent, it was added in version 5.5.10, March 2011. The similar Postgres authentication is a lot older. (Note that Postgres also supports ident, RFC 1413, authentication; MySQL does not, that would be another plugin, perhaps someone will write it.) The relative newness of the feature in MySQL would be one reason ...


2

I will answer the question in a generic way, as well as the question was asked. If is the railway local web site that is being attacked and not you, you can not do anything to avoid this. No matter the speed of your internet or if you are using a VPN. To be clear, I am not considering a lot of factors here, because the question does not permits me.


0

Running a packet sniffing tool like wireshark or tcpdump will let you clearly examine the traffic between the source IP and your web server.


0

Blocking an IP address at the firewall typically means dropping or rejecting the initial packet of a TCP connection during connection setup. The virtual host that the client is trying to connect to isn't known until much later, once the TCP connection is established and the client starts sending the HTTP request (specifically, you're looking for the Host: ...


0

Check the web server (HTTP) logs and filter by the IP address. That will show what resources (i.e. files, scripts, etc) are being requested.



Top 50 recent answers are included