147 reputation
5
bio website
location
age
visits member for 2 years
seen Oct 24 '12 at 13:33

Oct
23
comment Using an IPS as an alternative to mod_security
I actually live chatted you guys when I made the OP. Your WAF seems to be a great (although expensive) product. Not sure what our organization is going to do but we might be ordering from you. The sales rep couldn't give me a clear answer but can the virtual appliance be used as a replacement for the hardware appliance as we have pretty beefy hardware laying around. The DOCs seem to state that your VI is more for protecting virtual hosts. I don't see why you couldn't just route traffic through it and use it as a pseudo-hardware appliance which if i had to guess is just a beefy linux box
Oct
22
comment What is the best way of securing a website logon without SSL or preshared keys?
To make it even easier just have the server generate a random number challange, concat with the password, and hash using md5 (yes I know md5 is broken, use SHA if you care). As stated above this won't stop a MITM from modifying the javascript. If you instruct the users to view source all the time then you should be ok
Oct
16
comment Using an IPS as an alternative to mod_security
I'm not saying a WAF is an excuse for poor code... It's just another link in the chain. Thanks for the info. Do you have any experience with any of the appliance products such as Barracuda.
Oct
16
comment Is it good practice to manually lock down ports on each host
That's part of the plan :), I'm actually playing with it right now. I noticed that there weren't many local configuration checks although nessus does have the ability. For example I do not see a plugin that does not check php.ini to check for things like disabled functions.
Oct
16
comment Is it good practice to manually lock down ports on each host
Thanks. As I mentioned in my previous comment do you know of a good "best practices" security checklist. I know a lot of them are common sense but would like a systematic way of auditing each host that is backed by industry standards.
Oct
16
comment Is it good practice to manually lock down ports on each host
Do you know of a good overall checklist of things such as this (disable unnecessary services, disable ports, etc) just so I can systematically check things off and make sure I'm not missing any?
Oct
12
comment Sample vulnerable web apps to test Pentesting platforms
Thanks. I found one called Mutillidae. So Metasploit is an alternative to Nessus? I've seen Nessus plugins that integrate Nessus with Metasploit.
Oct
12
comment Sample vulnerable web apps to test Pentesting platforms
Anything that is simply PHP\MySQL?
Oct
12
comment Sample vulnerable web apps to test Pentesting platforms
Thanks. Have an upvote. I'm new to using tools for web app scanning. I've always wrote pretty thorough code and had several people audit it, server configurations, and manually find vulnerabilities. There are so many of them out there. There's standalone scanners such as what I mentioned above. Then there's pen testing packages such as Nessus and Metasploit which have their own webapp plugins. Then theres plugins for those pentesting applications to interface with the standalone scanners (i.e. Nessus + Accunetix).... So many options. Any recommendations?