Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

All Questions

-5
votes
0answers
59 views

How to be a security engineer in india? [closed]

Should I have both network security and software development experience ?
0
votes
0answers
28 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
1answer
69 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
1
vote
1answer
68 views

On-site Whitelisting vs. Off-site Cisco VPN

A company I’m applying to as web software tester is requiring me to be on-site so they could put me on their whitelist. However, I had a previous job which allowed me to work anywhere, using only ...
1
vote
1answer
109 views

Data on VPS is safe, or can accessed on rent VPS Virtual Server?

I rent a VPS server for two months to test a webapp. I insert data into SQL on this server and want to host web app to this virtual server for test. Can that server owner that rents a VPS to me or ...
0
votes
1answer
677 views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
-2
votes
3answers
114 views

Making websites use proxies? [closed]

Recently, I've been thinking about trying to make a website have a hidden ip, and make it so that it is extremely hard to find the real ip. I want to have it use proxies so that you can connect to the ...
3
votes
2answers
597 views

Is my site about to be SQL injected/hacked?

I'm running Opencart, an ecommerce CMS on a public website. About a week ago I noticed a decent spike in direct traffic in Google Analytics (meaning these users input my URL directly rather than ...
4
votes
1answer
174 views

AWS Tenant Restrictions

I'm a sysadmin of a medium sized chain of Italian restaurants. While I'm not dealing with patient health records or financial information I am still security focused. I'm trying to achieve tenant ...
0
votes
2answers
57 views

How could a server know if it is connecting with a particular app via tcp or not?

If a particular app being developed uses tcp to connect with a server, how could the server be sure that the connection is being made from that app? I know that sources can be easily spoofed and ...
0
votes
1answer
90 views

DDos prevention systems behavior for corporate networks [closed]

I asked this question on stackoverflow but couldn't get any answers and I even got a down vote as a present so that I'll try my luck out here. I did some research about this problem and couldn't find ...
2
votes
1answer
904 views

How does the “post/redirect/get pattern” improve security?

How does the "post/redirect/get" (PRG) pattern improve security? I see the "confirmation through redundancy" principle at play, but I don't understand how they could counter-balance the risks. As a ...
1
vote
1answer
115 views

Mobile Website Security

I have a school project with the topic name "Mobile Website security" which is a little confusing. The task is to write a report regarding the type of threats and the defenses against these threats ...
1
vote
2answers
78 views

Is it okay if apps in pre-production environment can be accessed without VPN?

The "for customer" web applications of a company are deployed in their pre-prod environments. The apps in these environments can be accessed without any VPN. All you need is the public url. I doubt if ...
3
votes
1answer
268 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...
0
votes
1answer
101 views

What is Federal and industry regulations PCI, SOX, GLBA, ISO 17799, HIPAA, CA1386?

Often i see in job post they mention like "Federal and industry regulations understanding (e.g., PCI, SOX, GLBA, ISO 17799, HIPAA, CA1386)" But what are those exactly, are those kind of rocket ...
0
votes
1answer
1k views

Best option for DDoS protection on DigitalOcean server?

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data. Is there a CDN that mitigates the security risks that CloudFlare imposes? If not, is ...
1
vote
3answers
563 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
4
votes
3answers
196 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
1
vote
1answer
242 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
4
votes
3answers
20k views

How to use nmap through proxychains?

I am running nmap through proxychains using this command: proxychains nmap -v scanme.namp.org This produced an error: root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3.1 (http://...
1
vote
3answers
670 views

Why limit internet access while connected to a remote desktop?

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential ...
1
vote
1answer
3k views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
11
votes
3answers
2k views

What security measures should be taken when running a Linux web server out of our office?

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
3
votes
2answers
224 views

Custom http server security concerns

I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server ...
2
votes
3answers
686 views

Where is the most secure location to host an admin panel?

I have an admin panel on my site, that enables me to control the content on my website. In order for the admin panel to achieve this, I must have a connection to the site's database. I have two ...
3
votes
1answer
829 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I ...
1
vote
1answer
115 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
3
votes
1answer
108 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
-1
votes
1answer
231 views

How strong exactly is a 3gbps booter?

I heard some people talking about how they had a 3 gigabyte per second drddosser. That sounds all fine and dandy, but what can that actually do? Could it take down a website? To what extent?
0
votes
2answers
6k views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the DMZ(...
0
votes
1answer
84 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
0
votes
1answer
151 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...
9
votes
4answers
452 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
5
votes
2answers
658 views

Has there been any documented cases where hackers have hijacked the phone number to a business?

Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls ...
6
votes
2answers
2k views

Using skype for an attack

I am curious about something; let's say someone randomly added me to Skype and tried to initiate a chat with me and I want to know more about them but I am worried if they can do some damage. My ...
45
votes
4answers
9k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
0
votes
1answer
97 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
6
votes
3answers
18k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
1
vote
1answer
111 views

Securing Downloadable Files on Website Per User

I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
1
vote
1answer
1k views

Using a Web Server to steal NTLM credentials

I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios: 1- I set up a web server on my ...
2
votes
3answers
3k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or www....
1
vote
1answer
731 views

Examples for (Web-)Security-Architectures

I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
3
votes
2answers
1k views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
1
vote
3answers
209 views

How to reverse the communication for security

I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but ...
1
vote
2answers
192 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
2
votes
1answer
627 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
0
votes
1answer
349 views

Where can I practice web-security or network-security? [duplicate]

Possible Duplicate: Servers for penetration testing I'm in a process of learning security of networks and websites. I already practised code reviewing but I want to perform exercise. Is there ...
0
votes
0answers
83 views

Pages restricted to certain IPs, safe? [duplicate]

Possible Duplicate: In what scenarios is relying on source IP address as a security control acceptable/unacceptable? If a website has a page which only renders for certain IPs, is there anything ...
6
votes
2answers
2k views

Is Access Control Through MAC ADDRESS a practical/secure solution

I run a small local gaming website with a custom admin panel I coded to let trusted members do administrative tasks through the software's API. Since their IP Address is dynamic, can I authenticate ...