Hot answers tagged

28

In IIS 7 (and 7.5), there are two things to do: Navigate to: Start > 'gpedit.msc' > Computer Configuration > Admin Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order (in right pane, double click to open). There, copy and paste the following (entries are separated by a single comma, make sure there's no line wrapping): ...


27

X-Frame-Options is an HTTP header. As such, it's not part of HTML and can't be set inside an HTML document. One reason why it's an HTTP header only is that clients should be able to decide if the document is allowed to be embedded in a frame before parsing the HTML code. Hence, you can't achieve that by editing the file but you need to modify the server's ...


25

Using an SSL certificate for your websites primarily gets you two things: Identity proofing that your website is who it says it is Stream encryption of the data between the webserver and the client By doing what you propose, which is normally called self-signing, prevents you from relying on the identity proofing. By using a known trusted CA the client can ...


19

I just posted an update to IIS Crypto which is a free tool that sets the schannel registry keys and puts RC4 at the top of the SSL cipher suite order with a single click. This mitigates the BEAST attack on Windows Server 2008 and 2012.


18

Even if you see a message saying the connection is not trusted does not mean it is not an HTTPS connection. In order to display or not such error messages, browsers try to validate certificates using following criteria: Does the certificate common name match the domain name entered in the URL bar? Is the current date between validity start date and ...


15

When you type the URL in your browser, the browser will mainly do two things with it: Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server, Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case ...


14

One possible path would be to try and get it to be included somehow. A lot of add-on frameworks can run an arbitrary PHP code file. If the attacker was able to find such an add-on framework, they could give it the path to the file and it would be executed as PHP regardless of the file extension.


14

A generic remark is the following: if you can reboot the machine, and the server becomes operational again automatically, without any further human intervention, then, by definition, the machine disk contents contain everything that the machine needs to access the private key. Correspondingly, someone gaining full access to the machine (as "root" on Linux, "...


14

The X-Frame-Options header is added on the server-side, not the client. This is because the header is used to control how the browser should render the page. Whatever server is hosting your file would have to add this header.


11

I assume that you mean issuing or signing your own certificates, not actually hosting them. From a pure security (encryption/data confidentiality) point of view, an X.509c3 certificate is an X.509c3 certificate and the offer the same security for the same number of bits. So a 2048-bit cert issued by Verisign is as secure as a 2048-bit cert issued by ...


11

That is just cargo cult security filling no real purpose. Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since there is no reason to include the name of the exploit in the payload. But if I discovered that any URL containing XSS resulted in a 404 I would be encouraged to ...


10

The right way to do this is to run your own private CA. You can then use Active Directory to push the (self-signed) CA's public key to all of the client computers on your network. If you do this right, then no one should see any cert warnings from their browsers. This is a perfectly reasonable approach for use on an internal network (e.g., an enterprise ...


9

Here's some high level design things to plow through first. There's a couple of ways to skin the cat, and how you set it up will impact the long term sustainability of this system. Issuing and Managing Certificates: So, you'll definitely need to issue each administrator his certificate. As per usual, Microsoft plays well with Microsoft, so if you have ...


8

I am pretty sure that this is not Apache Synapse, it's some tool built with Ararat Synapse, this is a TCP/IP library built with Delphi . I downloaded source code from both projects, and as far I can see Apache Synapse has a configurable user-agent, and default is : Synapse-HttpComponents-NIO On the other hand, Ararat Synapse has default user agent : Just ...


8

The certificate request is generated where the private key is generated; and the private key should, normally, be generated by the client, since the client will ultimately store it. You can have a model where you (as a server) generate keys for clients and then distribute the keys and certificates to the clients, but it raises the question of why you use ...


7

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using. I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not ...


7

OpenSSL does support Windows. You can download it hehe. This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL). The command is as follows: openssl s_client -connect localhost:443 -ssl2 EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!


7

No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be accessible to other applications. If you control the system, then you can do whatever you want, including just decrypting the section. There is no protection ...


6

No, there is no need to ever encrypt loopback traffic with SSL. Loopback traffic never leaves the machine, since the interface is virtual. The traffic never even reaches a real NIC's device driver. In order to capture the loopback traffic, an attacker would need to execute a capture program on your machine. Once an attacker has code execution on your ...


6

As long as you have taken all the usual security precautions, this isn't anything to worry about. On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of ...


6

Installing more software on any machine (almost) always increases the number of ways the machine can be attacked. So it is generally good practice to segregate components when possible. Suppose there is an attacker can use a flaw in the wordpress blog to execute PHP code, now the server hosting your main site is owned. Another issue that comes to mind with ...


6

It is not possible to "trick" the server, but there are a couple of caveats here. First, it is still possible to set up another site in IIS with a binding that will accept HTTP requests, so you need to be aware of the configuration of any other sites hosted on this server. Second, this configuration means that if people attempt to visit the site ...


6

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, outdated, easily vulnerable servers. You are looking for how to secure it, and that is a really important first step. You can not stop the scans. However, that ...


6

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and decrypting the authentication cookie, and by default (if the node doesn't exist) the server will create unique keys for each application. If, however, you ...


5

It is a Trojan affects Windows PCs , named TROJ_OBVOD.TA or Trojan.Obvod . Discovered: July 14, 2012. This Trojan connects to the following sites to obtain a list of URLs where the malware accesses/visits for pay-per-click scheme: {BLOCKED}3.*.in The list contain a hundred URLs including mine .


5

I'm not familiar with IIS so I hope what I've found is not the outdated results you already found. But what you need is to set up a Certificate Authority and issue a certificate per User. I found this site talking about how to do it. The the mapping seems to be done between certificate and AD(??) users. You can check here and here about the so-called one-...


5

As with all scenarios it depends on what you are protecting against. Generally speaking, its not wise to host administrative endpoints on public networks. In other words change the site to not be accessible on the internet. Second, some people have problems with domain-joined servers on the internet. If its breached, then attackers have access to your ...


5

When the machine says that "you have the private key corresponding to this certificate", then this means that you have the private key which corresponds to the certificate, not that the certificate itself contains the private key. Asymmetric keys come in pairs: the public key and the private key. They are mathematically linked to each other, but rebuilding ...


5

This log entry means that someone, somewhere, tries to know the names of the directories on your server by the simple but inelegant expedient of trying a lot of possible names -- and that someone is honest enough to let his tool state it plainly. Such attacks are very common. Whenever there is a public-facing server on the Internet, seemingly random attacks ...


Only top voted, non community-wiki answers of a minimum length are eligible