Skip to main content
Share Your Experience: Take the 2024 Developer Survey
34 votes
Accepted

Why create a CSR on my own server to have it signed by a 3rd party?

My question is: What could the reason be that we (the previous sysadmin) would create the CSR etc, instead of just letting the customer create the certificate fully on their side, and when it's ...
Gh0stFish's user avatar
  • 11.7k
30 votes

How to add X-Frame-Options header to a simple HTML file?

X-Frame-Options is an HTTP header. As such, it's not part of HTML and can't be set inside an HTML document. One reason why it's an HTTP header only is that clients should be able to decide if the ...
Arminius's user avatar
  • 44.8k
19 votes
Accepted

How to add X-Frame-Options header to a simple HTML file?

The X-Frame-Options header is added on the server-side, not the client. This is because the header is used to control how the browser should render the page. Whatever server is hosting your file ...
Dan Landberg's user avatar
  • 3,322
15 votes

Why create a CSR on my own server to have it signed by a 3rd party?

What could the reason be that we would create the CSR? In the first phase you do not create just a CSR, but a key pair. The CSR is derived from the public key of that pair, to be signed with the ...
Esa Jokinen's user avatar
11 votes
Accepted

Risk of allowing the string "xss" in query string

That is just cargo cult security filling no real purpose. Any attacker who finds an XSS vulnerability could easily bypass that. Actually, probably they will never run into it the first place since ...
Anders's user avatar
  • 65.6k
6 votes
Accepted

Is it secure to have only https binding in IIS?

It is not possible to "trick" the server, but there are a couple of caveats here. First, it is still possible to set up another site in IIS with a binding that will accept HTTP requests, so you ...
Xander's user avatar
  • 35.8k
6 votes
Accepted

How to defend against web server security scanners?

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, ...
Nik Roby's user avatar
  • 390
6 votes
Accepted

How could ASP.NET forms authentication session leak into a different site?

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and ...
Xander's user avatar
  • 35.8k
4 votes
Accepted

Can I use an old version of IIS and still be secure?

According to wikipedia IIS 8.5 is included in Windows 8.1 and Windows Server 2012 R2 and both systems are still supported for some time. This way IIS 8.5 also receives updates and if you always update ...
Steffen Ullrich's user avatar
4 votes

How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?

Is there real need of having CMS inside of the CHD (card-holder data) environment? We always recommend to keep the CHD as small as possible. Isn't it possible to design it in another way where your ...
Fis's user avatar
  • 1,230
4 votes

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

Neither cipher suite is good. Which one is the least bad depends on your threat model. TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA has two problems: It uses SHA-1 to authenticate the server's signature. SHA-1 ...
Gilles 'SO- stop being evil''s user avatar
3 votes

.NET extraction and storage of compression files concerns

It has nothing much to do with .NET or IIS and make your mind clear about just you are in risk because of using MS products. When you get input from public, of any kind, you should act pessimistic. ...
Xaqron's user avatar
  • 306
3 votes

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

Going HTTPS-only doesn't help protect you in this case. This other question should help illustrate why. In short, if an attacker can force a client to communicate over HTTP then the attacker can get ...
Taul's user avatar
  • 599
3 votes

Can enforcing a website to serve SSL requests only prevent SSLstrip from working?

Will that be sufficient enough to prevent the attacker from using SSLstrip to downgrade HTTPS to HTTP? No. I would assume the webserver will fail to serve non HTTPS traffic, correct? No. The ...
Tom's user avatar
  • 2,105
3 votes
Accepted

Is the CSR and public key the exact same thing?

No, they are not the same. A public key is actually one member of a "key pair", consisting of both a public key and the matching private key. The CSR is a Certificate Signing Request, which is just ...
John Deters's user avatar
  • 34.2k
3 votes

TLS 1.2 and HTTPS

TLS 1.2 is a protocol. HTTPS is HTTP over TLS. While TLS supports some methods to protect the connection without certificates, browsers don't - the certificate is required to make sure that the ...
Steffen Ullrich's user avatar
3 votes
Accepted

Is this test enough to proof that the web application is vulnerable to Login CSRF?

Yep, indeed the scenario is enough to say that the web app is vulnerable to Login/Logout CSRF. ViewState and EventValidation are not meant to protect against CSRF (I guess it's a .net/asp(x) ...
Soufiane Tahiri's user avatar
3 votes

Which cipher is more secure TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA or TLS_RSA_WITH_AES_256_GCM_SHA384?

I agree with @schroeder, I don't think you can do a direct "which is better?" comparison with cipher suites. That said, Mozilla's TLS Recommendations currently lists DHE-RSA-AES256-GCM-...
Mike Ounsworth's user avatar
2 votes

Is it secure to have only https binding in IIS?

No - if there is no http binding, IIS will not accept an HTTP request. On 443, it will attempt to negotiate a TLS/SSL (depending on configuration) connection, if it cannot, the connection will fail. ...
crovers's user avatar
  • 6,381
2 votes
Accepted

Is a Kerberos ticket valid with only one-way external trust between domains?

from what i gather the IIS server is part of domain A, if so you can add a one way trust between A->B, this will cause all global/universal users in domain B to be trusted by domain A, allowing you to ...
Jonathan Allon's user avatar
2 votes

Do IIS / ASP.NET / MVC version headers reveal patch presence?

No, these headers don't say anything about the server itself, only that it's running Windows (Because of the IIS). The other two headers are the .Net and MVC framework version, which both are ...
Robin Hilber's user avatar
2 votes
Accepted

Invalid CSR when using Let's Encrypt web tools

I needed to remove "New" from the text -----BEGIN NEW CERTIFICATE REQUEST----- and -----END NEW CERTIFICATE REQUEST----- The second of the tools was using a Regex which wasn't looking for ...
Ian Warburton's user avatar
2 votes
Accepted

IIS renew option missing for self-signed certificate

Such a button does not make sense. Renewing a certificate typically means generating a new certificate request (and possibly automatically sending it to a CA). A self-signed certificate does not have ...
Stephane's user avatar
  • 18.7k
2 votes

How to defend against web server security scanners?

You "defend" against them by scanning your sites yourself and remediating any vulnerabilities found. Yourself could mean running a vulnerability scanner (e.g. Nessus in web mode or Burp Suite) or if ...
SilverlightFox's user avatar
2 votes

(Solved) Meterpreter over ASPX webshell

I know basically what you're saying, you need to tunnel your session. try this: https://github.com/SECFORCE/Tunna It's designed to tunnel an installed meterpreter session, through a website. All ...
standarduser's user avatar
2 votes

Can http referrer value be used to stop spam bots?

Can http referrer value be used to stop spam bots? No, because the referrer is just a header and is easily forged by a bot. I noticed that google's noCaptcha feature with the simple check box has ...
John Wu's user avatar
  • 9,301
2 votes

SSL cert for securing on-premises IIS web application

We have a customer, let's call them ABC123 Ltd, who have an existing website on abc123.ie hosted by some hosting provider or other. It's just an informational site with no login\commerce function so ...
Xiong Chiamiov's user avatar
2 votes

Is SSL still secure if SSL Settings in IIS is set to ignore or accept only?

Client certificates are not needed to keep the SSL/TLS connection secure. They are only used to authenticate the client. If your web application does not need to verify that it talks to the correct ...
Steffen Ullrich's user avatar
2 votes
Accepted

django-python3-ldap Does TLS Encrypt AD Passwords When Site is Hosted on http

If you setup the web server with HTTP only the password will not be protected. The setting of LDAP_AUTH_USE_TLS=True only covers the protection of the connection between the server side part of your ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible