All Questions
68,281
questions
10
votes
3
answers
2k
views
How to open a file from the Internet in a secure way?
Sometimes I have to open files (doc, zip, txt, pdf and some other) downloaded from the Internet (from unproven sites) on my computer.
How could I mitigate the risk and open them in a more or less ...
- 2,117
33
votes
6
answers
3k
views
Are online password managers secure?
Can online password managers be used for storing and managing passwords? I mean from the security point of view. I understand that those systems can be different and some deserves more trust than the ...
- 2,117
24
votes
3
answers
8k
views
How does a crypter for bypassing antivirus detection work?
I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
- 2,020
22
votes
4
answers
7k
views
Malwares source repositories. Where? [closed]
As the best way to learn is to read the code, do you know where I can find malware/virus/whatever source code to read?
- 2,020
12
votes
2
answers
2k
views
How to test against DDoS in a controlled enviroment?
Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
- 2,020
10
votes
1
answer
5k
views
Management Network Best Practices
I am looking at setting up a Management vlan, on which I will put all the Management interfaces for my various networkable devices (Firewall Mgmt Interfaces, Server RAC, WAP Mgmt Interfaces, etc).
...
- 1,387
28
votes
11
answers
9k
views
Resources to learn about security
I am currently just finishing a undergrad computer science degree, but I know very little about computer security.
What are some good resources (aside from this site) to learn the fundamentals of ...
- 381
21
votes
4
answers
12k
views
What is the benefit with using encrypted RAM?
I sometimes hear that encryption is used for the RAM, but I don't really understand why this is needed.
Why is RAM needed to be encrypted? And is this done by the hardware, the operating system or ...
- 5,183
12
votes
4
answers
7k
views
How effective are reverse proxies as a web application security measure?
How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they?
For example are they more effective in preventing ...
- 1,277
82
votes
13
answers
26k
views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
- 5,089
12
votes
3
answers
2k
views
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/...
- 2,237
15
votes
3
answers
5k
views
How do I get started using ESAPI WAF?
I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
- 351
11
votes
1
answer
1k
views
Are browsers still vulnerable to Cross-Site Cooking?
The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk.
The mechanism for preventing ...
- 372
23
votes
4
answers
21k
views
Does a webserver need an antivirus software installed?
In what cases does a webserver need an antivirus software installed?
When it is not required?
If it is required sometimes, what should be considered when choosing the right one to install?
(In my ...
- 2,117
11
votes
2
answers
1k
views
Recently had a virus, can I use backed up files on clean system?
I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in ...
- 233
36
votes
2
answers
8k
views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
- 2,237
11
votes
4
answers
525
views
Defending site against being abused by phishing
Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
- 1,870
26
votes
3
answers
9k
views
What steps should be taken to validate user uploaded images within an application?
Recently I have worked on a number of applications that need to process user uploaded images steps have been taken to validate the extension and the mime type.
But what else can be done to ensure ...
- 9,457
15
votes
13
answers
77k
views
How can I intercept and modify HTTP requests?
Are there any free tools available that let me intercept and modify HTTP requests for testing?
I am looking for tools which allow me to send custom HTTP headers.
- 1,883
34
votes
8
answers
7k
views
When a sysadmin leaves what extra precautions need to be taken?
If a user leaves an organisation who knew most of the top credentials are there any other precautions that need to be taken other than changing those credentials?
Obviously there is also the standard ...
- 739
22
votes
3
answers
893
views
Startup security
I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
AviD♦
- 73.1k
19
votes
6
answers
6k
views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
AviD♦
- 73.1k
22
votes
3
answers
6k
views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
AviD♦
- 73.1k
14
votes
4
answers
295
views
Is external vuln scanning sufficient?
Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it?
From the original Area51 proposal.
AviD♦
- 73.1k
941
votes
11
answers
321k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.1k
11
votes
2
answers
2k
views
Online SQL Server database for a Business app. Security considerations
A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
- 2,117
36
votes
11
answers
13k
views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
- 3,352
11
votes
5
answers
2k
views
Encrypting a disk that has stuff on it?
Ok, so a pretty big disk ~1-2TB (90% full, multiple partitions + 2 operating systems on it), needs to be encrypted and zeroed-out, and it's a bit too much data for backing it all up before encryption. ...
- 3,352
9
votes
7
answers
3k
views
If I suspect my server is compromised then should I disconnect it immediately or not? From Power or Network?
According to Mandiant, you should not:
Mistake #1: Immediately entering “remediaton mode” – also known as playing “Whack-A-Mole”
... as described here: http://blog.mandiant.com/archives/1525
...
- 13.8k
9
votes
5
answers
3k
views
Creating tunnel with most ports closed?
How can I create a proxy tunnel from a network that has all ports but port 80 closed? I guess I'd have to bind SSH on my server to port 80, but would that introduce problems to my home network since ...
- 3,352
50
votes
5
answers
10k
views
New XSS cheatsheet? [closed]
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
- 1,125
13
votes
3
answers
2k
views
How do you defend specifically against attackers utilizing any or all of the commercial exploit kits?
There are several commercial exploit kits available containing 0day vulnerabilities:
White Phosphorus Exploit Pack http://www.immunityinc.com/products-whitephosphorus.shtml
Agora Exploit Pack http:...
- 13.8k
36
votes
5
answers
43k
views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
- 1,125
20
votes
4
answers
4k
views
What type of content better not to transfer by email?
Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure?
I have always wondered how sensible it is ...
- 2,117
16
votes
6
answers
3k
views
What are a few good lists of threats to use to kick-off conversations with others about what worries them?
To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
- 13.8k
24
votes
4
answers
2k
views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
- 2,117
5
votes
2
answers
4k
views
Do you know any crawler/spider software, which is able to go through an ASP.NET site?
Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event?
If ...
- 1,870
14
votes
5
answers
13k
views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
- 2,117
13
votes
4
answers
3k
views
What kinds of SSL certificates are usable for encryption?
I know that Verizon SSL certificates cost close to $600.
There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
- 713
62
votes
12
answers
50k
views
How long should the maximum password length be?
The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
- 1,404
30
votes
8
answers
19k
views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
- 713
29
votes
7
answers
9k
views
What are some good website security scanning solutions? [closed]
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
- 481
11
votes
3
answers
2k
views
What free tools or techniques exist to discover anomalies in network flows?
I have been using FlowMatrix. What do others do on the cheap?
- 13.8k
15
votes
1
answer
2k
views
Is there a list of default, standard or third-party "users" for Oracle?
When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of schemas/...
- 904
11
votes
2
answers
4k
views
Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code
Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality.
Apart from the generic arguments about 'security through obscurity' are there ...
- 904
25
votes
8
answers
33k
views
Can I detect web app attacks by viewing my Apache log file? [closed]
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
- 13.8k
8
votes
3
answers
2k
views
How to determine whether site is secure from common user's point of view?
What should be done (or at least declared) so end-users, visitors will start trusting your website?
Some thoughts:
secured login (via https)
privacy policy (hidden email and other private ...
- 1,292
80
votes
5
answers
37k
views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
- 5,183
14
votes
2
answers
2k
views
What is the best way to verify the SSL configuration of my web server?
How do I ensure I have my SSL configuration setup securely?
- 13.8k
12
votes
3
answers
2k
views
What are the pros/cons of using a threat detection system?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects ...
- 3,242