Questions tagged [filtering]
The filtering tag has no usage guidance.
33
questions
0
votes
1
answer
87
views
Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?
I've heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any ...
- 3,398
1
vote
2
answers
187
views
Bypass network security filters with CDN
I read about Domain Fronting technique, it bypasses network security filters but requires a relatively complex configuration (having evil.com pointing to a.cdn.net, and good.com pointing to b.cdn.net, ...
- 13
0
votes
1
answer
2k
views
PHP 7.4.3 preg_match bypass
I want to filter user input like this:
$data = file_get_contents('php://input');
if ($data != null && $data !=='') {
$parsedData = json_decode($data, true);
}
// find quickmodule name
$...
0
votes
1
answer
182
views
Is an IP based whitelist practical for controlling internet use?
I have to set up internet controls for our schools study hall/testing center. The idea is that computers on that network should only be able to access the school's webportal and learning platform ...
- 113
0
votes
0
answers
105
views
Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious
Backstory:
I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about ...
0
votes
2
answers
169
views
Blocking online file conversion tools
I have found myself with the need to block online conversion tools for pdf files and such, but I can't think of a nice catch-all (or even catch most) solution (without blocking all file uploads in ...
- 45
0
votes
0
answers
157
views
How to dump the input of a seccomp BPF filter?
I am writing a program that creates BPF seccomp filters. These filters are supposed to check syscalls and their arguments against predefined allowed values. The logic to check the syscall by its ...
- 197
-1
votes
1
answer
540
views
How Zscaler enables system wide proxy?
I have Zscaler service installed on my system and it does a good job of filtering content and malicious websites.
I was wondering how does Zscaler manage to do this? I read that it creates a PAC file ...
- 99
1
vote
1
answer
102
views
XSS Prevention Code [closed]
I was just wondering if this code is enough to prevent XSS vulnerability in my web app?
/**
* Escape HTML string to prevent XSS.
*/
export const escapeHtml = (string: string): string => {
if (...
- 143
1
vote
1
answer
817
views
Suricata and rules based on MAC address
I'm working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address.
Since I've read that Snort only works in ...
- 113
1
vote
0
answers
386
views
Is XSS possible when using htmlspecialchars and https prefix check in href?
There is a standard XSS exploitation technique where one can use javascript keyword in <a href=""> to execute javascript code. Example:
<a href="javascript:alert(42);">please clickme</...
- 572
1
vote
1
answer
1k
views
Can I intercept DNS-over-HTTPS (DoH) or -TLS (DoT) in my home network?
Right now I am redirecting all local network DNS traffic to my Pi-hole install, since some device do or may in the future use hardcoded DNS servers to bypass filtering.
Since DNS-over-HTTPS and DNS-...
- 323
1
vote
1
answer
3k
views
XSS filter bypass < and/or <
On a homepage I can inject HTML-text in the URL. After som T-and-E I was able to send in this thing; ?type=<script<script>>alert(1)</script<script>>
Which gave me a homepage ...
- 25
1
vote
1
answer
2k
views
How to prevent XSS when inserting untrusted data into a textarea?
I want to prevent XSS in my demo chat application (written in PHP) that I've created for blog posts. The chat insert messages into a textarea. The problem is that it's vulnerable to XSS. Somone can ...
- 209
1
vote
2
answers
368
views
Preventing XSS by filtering data from the server to the client
Before you immediately comment "you can't trust the client!", please read the whole question.
I've been reading about how to prevent XSS attacks lately, and everything I've found says that the server ...
- 113
1
vote
0
answers
83
views
Emails Bypassing Exchange Transportation Rules
So here is the situation, we are trying to filter out spam emails within our organizations Exchange 2010 mail server and for the most part we have been pretty successful. Except for a few emails.
...
- 433
-1
votes
1
answer
1k
views
Spam/Phishing detection when there is no MX record
While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?
How do spam or phishing filters treat emails ...
- 127k
1
vote
1
answer
304
views
Filtering Obfuscated Spam Emails In Exchange
So the past few weeks we have been trying to cut back on the amount of spam reaching our users in our organization. We have been successful in implementing hard filtering rules like if an email ...
- 433
1
vote
2
answers
614
views
How can I use Message-ID in header to screen (filter) Emails?
Recently started receiving torrent of spam emails immediately after ISP (Charter-Spectrum) switched to an upgraded Email system. Five of my ISP email addresses getting the same spam every day. Some ...
- 11
-1
votes
1
answer
33k
views
Does an employer see if you try to access a blocked site? [duplicate]
Today while browsing on my mobile phone connected to my employer's wifi, I clicked on the link to a tumblr page. I then got an error message saying the web filter had blocked the page deeming it ...
- 1
2
votes
2
answers
37k
views
XSS with URL encoding
If a website URL gets encoded then is the website still vulnerable to XSS or no?
For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
- 61
1
vote
0
answers
123
views
Odd rails filter allows <script> tag but not <% %>
I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
- 43
-1
votes
1
answer
726
views
Bypass Censorship and Filtering Using Blockchain Technology [closed]
I heard some people and companies (like Telegram) claiming it's possible to bypass censorship & filtering of internet using Blockchain technology, for example to prevent censorship of a certain ...
- 115
1
vote
3
answers
134
views
Why isn't email filtered when using contact form
When I send a non-gmail email to someone (company email) for the first time, there's a chance it will get filtered into the ether, never to be heard from again.
However, if I use their website's ...
- 121
1
vote
1
answer
116
views
Port filtering for Ubuntu-Nginx minimal server environment
I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way:
ufw ...
- 269
2
votes
2
answers
395
views
Remove domain from web filter blacklists
A domain with a checkered past
I work at a company that purchased a .com domain around a year ago, and it uses this domain for its web site and e-mail now. However, the previous owner had a site (...
- 4,302
3
votes
1
answer
2k
views
How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?
Quote from Activating CleanBrowsing
Activating CleanBrowsing is pretty simple and only takes 5 minutes. We
do our work via DNS, so you have to switch your DNS servers to go
through our Network ...
- 1,445
1
vote
0
answers
2k
views
How do I bypass TCP and UDP filters (all ports for TCP and UDP are blocked) [closed]
I really want to play online games that use TCP/UDP, but the protocol is blocked. I can't use any VPN. I can use Tor and Psiphon, but they don't tunnel TCP and UDP (unless I use VPN mode but that ...
0
votes
1
answer
627
views
What ports should I filter on a default Magento installation
I have recently installed a Magento on Ubuntu 14.04 on Digital Ocean and I'm wondering what ports should I filter to keep it safe. Well, actually the question should be: what ports I keep open to the ...
- 103
2
votes
3
answers
820
views
Is this filter safe enough to mitigate XSS?
I have an application that escapes the following special characters.
& < > " '
The application heavily displays HTTP request parameters throughout the application. The request parameters ...
- 143
2
votes
2
answers
5k
views
MAC filtering the internet traffic?
I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
- 21
3
votes
2
answers
334
views
how does iran blocks domains in tls connection but not based on ip
recently (last week?) internet in iran has started blocking https websites again.
they did this before but that was, as far as I know, ip based. but it seems that the new blockage in not ip based but ...
- 31
1
vote
1
answer
178
views
Can any web proxies differentiate between JScript and Javascript files?
Its a relatively common best practice to filter executables and scripts from a standard user at the proxy/gateway level in corporate environment. While EXE/BAT/CMD files are easy enough, and arguably ....
- 610