34
votes
Accepted
Why create a CSR on my own server to have it signed by a 3rd party?
My question is: What could the reason be that we (the previous sysadmin) would create the CSR etc, instead of just letting the customer create the certificate fully on their side, and when it's ...
- 16.5k
30
votes
How to add X-Frame-Options header to a simple HTML file?
X-Frame-Options is an HTTP header. As such, it's not part of HTML and can't be set inside an HTML document.
One reason why it's an HTTP header only is that clients should be able to decide if the ...
- 45.1k
19
votes
Accepted
How to add X-Frame-Options header to a simple HTML file?
The X-Frame-Options header is added on the server-side, not the client. This is because the header is used to control how the browser should render the page.
Whatever server is hosting your file ...
- 3,322
15
votes
Why create a CSR on my own server to have it signed by a 3rd party?
What could the reason be that we would create the CSR?
In the first phase you do not create just a CSR, but a key pair. The CSR is derived from the public key of that pair, to be signed with the ...
- 19.4k
11
votes
Accepted
Risk of allowing the string "xss" in query string
That is just cargo cult security filling no real purpose.
Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since ...
- 65.8k
6
votes
Accepted
How to defend against web server security scanners?
The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
- 390
6
votes
Accepted
How could ASP.NET forms authentication session leak into a different site?
The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and ...
- 36k
5
votes
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
Neither cipher suite is good. Which one is the least bad depends on your threat model.
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA has two problems:
It uses SHA-1 to authenticate the server's signature. SHA-1 ...
4
votes
Accepted
Can I use an old version of IIS and still be secure?
According to wikipedia IIS 8.5 is included in Windows 8.1 and Windows Server 2012 R2 and both systems are still supported for some time. This way IIS 8.5 also receives updates and if you always update ...
- 208k
4
votes
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
Is there real need of having CMS inside of the CHD (card-holder data) environment? We always recommend to keep the CHD as small as possible. Isn't it possible to design it in another way where your ...
- 1,230
3
votes
.NET extraction and storage of compression files concerns
It has nothing much to do with .NET or IIS and make your mind clear about just you are in risk because of using MS products. When you get input from public, of any kind, you should act pessimistic. ...
- 306
3
votes
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
Going HTTPS-only doesn't help protect you in this case. This other question should help illustrate why. In short, if an attacker can force a client to communicate over HTTP then the attacker can get ...
- 609
3
votes
Can enforcing a website to serve SSL requests only prevent SSLstrip from working?
Will that be sufficient enough to prevent the attacker from using SSLstrip to downgrade HTTPS to HTTP?
No.
I would assume the webserver will fail to serve non HTTPS traffic, correct?
No.
The ...
- 2,105
3
votes
Accepted
Is the CSR and public key the exact same thing?
No, they are not the same. A public key is actually one member of a "key pair", consisting of both a public key and the matching private key. The CSR is a Certificate Signing Request, which is just ...
- 34.7k
3
votes
TLS 1.2 and HTTPS
TLS 1.2 is a protocol. HTTPS is HTTP over TLS. While TLS supports some methods to protect the connection without certificates, browsers don't - the certificate is required to make sure that the ...
- 208k
3
votes
Accepted
Is this test enough to proof that the web application is vulnerable to Login CSRF?
Yep, indeed the scenario is enough to say that the web app is vulnerable to Login/Logout CSRF.
ViewState and EventValidation are not meant to protect against CSRF (I guess it's a .net/asp(x) ...
- 2,677
3
votes
Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?
I agree with @schroeder, I don't think you can do a direct "which is better?" comparison with cipher suites.
That said, Mozilla's TLS Recommendations currently lists DHE-RSA-AES256-GCM-...
- 59.3k
2
votes
Can http referrer value be used to stop spam bots?
Can http referrer value be used to stop spam bots?
No, because the referrer is just a header and is easily forged by a bot.
I noticed that google's noCaptcha feature with the simple check box has ...
- 9,361
2
votes
SSL cert for securing on-premises IIS web application
We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
- 9,462
2
votes
How to defend against web server security scanners?
You "defend" against them by scanning your sites yourself and remediating any vulnerabilities found.
Yourself could mean running a vulnerability scanner (e.g. Nessus in web mode or Burp Suite) or if ...
- 34.4k
2
votes
(Solved) Meterpreter over ASPX webshell
I know basically what you're saying, you need to tunnel your session.
try this:
https://github.com/SECFORCE/Tunna
It's designed to tunnel an installed meterpreter session, through a website. All ...
- 113
2
votes
Accepted
Is a Kerberos ticket valid with only one-way external trust between domains?
from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to ...
- 731
2
votes
Accepted
Invalid CSR when using Let's Encrypt web tools
I needed to remove "New" from the text
-----BEGIN NEW CERTIFICATE REQUEST-----
and
-----END NEW CERTIFICATE REQUEST-----
The second of the tools was using a Regex which wasn't looking for ...
- 1,177
2
votes
Accepted
IIS renew option missing for self-signed certificate
Such a button does not make sense. Renewing a certificate typically means generating a new certificate request (and possibly automatically sending it to a CA). A self-signed certificate does not have ...
- 18.7k
2
votes
Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?
Client certificates are not needed to keep the SSL/TLS connection secure. They are only used to authenticate the client. If your web application does not need to verify that it talks to the correct ...
- 208k
2
votes
Accepted
django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http
If you setup the web server with HTTP only the password will not be protected. The setting of LDAP_AUTH_USE_TLS=True only covers the protection of the connection between the server side part of your ...
- 208k
2
votes
Accepted
Can you start a shell with a service account in Windows?
Yes you can start a shell with a service account . Can they login all depends on what permissions and checkboxes the admin selected when he created the account so yes again it could've be possible . ...
- 1,006
2
votes
Deny access to IIS Server from IP local range
In IIS Manager, (if the sub-feature has been installed) there is a node for IP Address and Domain Restrictions which will allow you to determine which IP addresses you want to allow and/or deny either ...
- 36k
2
votes
Security Log Analyze
There is benefit to using a full-cycle platform that allows SIEM Engineering (e.g., Splunk ES) and Security Automation (e.g., Splunk Phantom), but these can also be performed using open-source ...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible