Are there security issues around controlled cross site sharing behind SSO? Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get a broader view.   This is really a result of browser updates around cross site sharing in iframes in chrome and IE a few months back.   With those security features disabled at the browser level (yes we will not have users do that) iframing within our sites work fine.
Let me give you context of the specific problem:

example.com - main site
subdomain1.example.com - subdomain we have a ton
subdomain2.example.com - another sub
example.login.com - SSO server we authenticate to
example.cms.com - random vendor that uses our SSO

So right now as long as the servers in 1, 2, and 3 allow cross site sharing iframes work... as long as your cookie/token is already active.   If it is not active then it just errors out trying to connect to example.login.com.
We are discussing changing the CORS/sharing settings on the login server and others brought up possible security issues.   I just don't see how there are issues with clickjacking or anything else when we control all of the sites ourselves.   Am I missing something here?   Are there security issues with sharing between controlled tenets?   Let me know if I need to provide anymore info.

According to your description, I think what you are looking for is Content Security Policy (CSP). This header is can be specified by the web developers or administrators in the response, to declare approved origins of content, a specific browser should be allowed to load on a website. The intention was to provide a standard way to mitigate code injection attacks like XSS and clickjacking.
Almost all the modern browsers support this.
Refer this To get an idea on how to test if this works on the client side.
More info on the header can be found here


Can firewall stop social engineering attacks? A colleague of mine asked "What are the configurations I need to have in the firewall to help me curb social engineering attacks?"

So I want to know whether I should respond with:

Firewalls are not for stopping social engineering attacks. You have to look for other security measures.
Yes, a certain set of settings can help to detect at least some of the social engineering attacks. If so, what kind of attacks?'

The scope is social engineering attacks done via mobile device or laptop in internal office networks.

Generally: No, a Firewall is not to stop social engineering attacks.

The reason for this answer lies in the nature of Social Engineering - Social Engineering is about manipulation people, not about computers.

And while Firewalls of all kinds are a good tool to prevent attacks on your infrastructure, they are not a good tool for protecting your staff.

  The most common type of social engineering happens over the phone. Other examples of social engineering attacks are criminals posing as exterminators, fire marshals and technicians to go unnoticed as they steal company secrets. Source

And as long as people are able to do bad things, there might be a way to trick them into doing it. To prevent Social Engineering, you need to increase security awareness among your staff.

Additionally, establishing technical safeguards like restriction of access rights, Data Leakage Detection / Prevention and operational safeguards like segregation of duties might make Social Engineering attacks harder to perform.


UDP-Only Linux Dedicated Server? I am running my own small UDP linux service on a dedicated server.  my service responds to single-package requests with single-package responses.  I don't want this server to do anything else.  I don't want it to access or serve the web, allow remote logins, go out to log in elsewhere, download files, etc.

I do not need or want any TCP higher-level protocol access.  I figure that if I just run my own UDP service (I don't even need DNS, but this is UDP), and TCP is not available, it would be VERY hard for a remote hacker to intrude.  even running my service on a non-upgraded linux distro would then remain reasonably safe.

of course, I can install firewalls, on and around the server, to block all TCP traffic.  (and then I would have to make sure that my admins don't have a weak moment, where they disable the firewall and punch through it.)  thus, I would prefer the simplicity of not even having TCP enabled in the linux kernel--rather than having it, and then trying to block it.

I would presume that a similar strategy would be useful for many small devices that are now creeping up in our houses.   I would want my lightbulbs to listen/respond to very simple UDP requests, and not run a full network stack all the way up to TCP.

is this possible in a linux-based system?  or another unix-style OS?

UDP alone does not provide any kind of security, that is neither encryption nor authentication of the peer  and not even protection against spoofing of the peers IP address.

Insofar it is not suited for any kind of important controls (which might even be switching lights) unless you have the surrounding network protected by some other means. But in this case there would not be any security advantage of running a minimal stack only, only the memory footprint of the device could be smaller.

So for any kind of real controls you need at least protection against spoofing, i.e. authentication of the peer. This is not as simple as you think because this authentication must also be safe against an attacker sniffing the communication and replaying it later. Once you add all the protections to your device it gets more complex so the original simplicity of your approach is no longer there.

  it would be VERY hard for a remote hacker to intrude.

If you only think of an remote attacker accessing a device inside your own network, than it does not matter if you have TCP or UDP as long as the device is not reachable from outside. But if the device is reachable from outside or if the attacker managed to get into your own network (like when you do web surfing and get a drive-by-download exploit) then it would not be a problem for the attacker to do harm against an unsecured device, no matter if it uses TCP or only UDP.


Unknown process shuts down computer when ending process tree /I'm not sure if this is the correct place for this question/

A few minutes ago, I discovered a strange process running in the background.

" P3RTZCU17K.exe " - I googled it with quotes and zero results were returned.

When I ended the process, Windows (Vista Home Premium) immediately displayed the blue screen physical memory dump page.

I've restarted the computer in Safe Mode (without networking) and am running CCleaner & Malwarebytes.

My question: Any idea what that process could be?!

*update:
Malwarebytes has found several infected files, including a Backdoor bot.

This seems to be some form of malware based on you description and update. I suggest you get out your back ups and look at restoring your OS, unless you want to clean your PC but risk malware residual being left behind


Please rate this SQL injection prevention strategy Recently a vendor representative told me that the reason a user couldn't log in to their site was that the password (which they check using an LDAP connection to our server) contained two consecutive dashes.

  I am sorry for not getting back sooner. It turns out that the "--" in [REDACTED]'s password is causing an issue with our sanitization script ( which pulls out anything that looks like code, which could cause issues when saving it into your database table) .

How worried would you be?

This suggests that their sanitization practices are not very targeted.  In particular, you should never have to sanitize a password.  Passwords should immediately be hashed and only the hash should ever be stored.  As a result SQLi via password field should be impossible.

Now normally defense in depth suggests taking extra steps for security is a good thing, even if it seems redundant.  So a naive answer would be "they are being careful about security here, even if it is potentially unnecessary, so what's the problem?".  The problem is that unnecessarily removing characters from passwords (presuming it didn't actually break anything) makes the passwords weaker.  If their system properly "cleaned" the input both when the password was stored and when the user logged in, then the login would work normally but a password of "my--password" would presumably turn into "mypassword" before hashing.  As a result, the cleaned password is more crackable than the original.

The other issue is that the way they worded it suggests that they have a sanitization script that just blindly "cleans" everything.  This is really the lazy man's way to do security.  I've seen plenty of systems that use that approach, and in my experience it usually means that the rest of the security isn't really well thought out.

Finally, it really is a useless security measure, and steps which make things look good without actually improving security don't help anyone.  The reason why they are removing a double dash is because in SQL this is a comment, and as a result it is sometimes used as part of an SQL Injection attack.  Stripping out the comment characters isn't a very effective method for defeating said SQLi attack.  They need to reject such requests all together.  They also better be using prepared statements properly, in which case stripping out double dashes is doubly useless.

It is certainly no excuse for a bug: that just means that they failed to properly implement a less-than-ideal security feature.  Hopefully they made that comment to you as a "thanks for pointing out this bug so we can fix it".  Even if they want to keep their "cleaning" algorithm, it shouldn't break anything.


Honeypot tricking my android device to connect I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network.

The issue is much like described in this link

I need to find a way to get rid of this since its also found to do some active network attacks by stealing creds, though I can't prove it. But still its getting connected unusually even after forgetting. Please help.

Does the honeypot have a singular SSID, or is it more like the question where he's constantly changing the name so that phones automatically connect?

If it's a singular SSID, what's the name of it? If he's named it a common hotspot name like "attWifi" or something, your phone might be seeing it and automatically thinking it's a public hotspot. There could also be a feature that allows the phone to connect to unsecured networks when a known one isn't available.

Jamming his router is illegal, but kicking people off of it isn't. An overkill solution would be to setup a wireless device with tools like the airocrack suite. Just script it so that if your device connects to a network that isn't whitelisted, it'll kindly use aireplay to send it a deauth packet.

Unfortunately without more information, we can't be of much help


Passwords propagation, Password Trend and Word Generator in Human Mind Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits.

The users seem to pick up the password suggestions  or just copy the passwords pattern of others without giving a thought. The passwords should remain secret, but the fact that passwords of different users in many leaked databases are found to be same or similar indicates that the passwords do not remain secret. Is this just a coincidence that users are using the same password or same rules to transform the password?

The password trend seems to be propagated from users to users as today information get propagated through the internet. This trend also reaches the potential attacker and as a result, in case of the password database is leaked, the cracker succeeds. The passwords that are not cracked, do not follow the popular trend and are thus spared by the cracker.

It is often argued that the human choose passwords that are easy to remember. But the fact that nearly 300,000 Rockyou users used password "123456" indicates that either most of the users simply imitate others in some way for creating the passwords or is it the case that the word generator in the human mind is biased. Learning by imitation is an evolutionary feature. But passwords creation needs uniqueness and not imitation.

So, is this the limitation of human mind (either imitation or biased word generator), when it comes to the password creation?

To prevent the influence of the password propagation, can we give unique suggestions to each user for the password creation? Composition rules applies to each user of that website, can it be altered to each user?

I think you're misunderstanding users.  People can't be understood as code (i.e. a "biased word generator").  People have different motivations and understandings of the world than you do or I do.

Some really don't care if they get hacked.  Some don't understand that automating attacks are relatively trivial.  Some think that "why would anyone attack me?".  They don't understand that automation doesn't care about them personally.

RockYou is a free "social media gaming website".  Is that really a site that a lot of users care about security?  I wouldn't, and would likely use an easy to remember password that I don't care about.  I also didn't care about my NY Times password back when they required registration.  I believe it was "password" (Go ahead hax0rz, hack my NYT account!).


Is a part of an encrypted file easier to crack? After encrypting a file (GPG with AES) and splitting it into chunks (split), is it easier to crack one of the parts compared to the complete file? (Maybe because it may loses some important bits.)

No. You still need to find the same length encryption key to decrypt the data into plaintext. Finding the key is the hard part, decrypting a whole or partial image is trivial once you have the key.

If you are using an encryption scheme where the file is encrypted and decrypted deterministicly based on the section that was last (de/en)ecrypted, it can be harder to reliably end up at the same plaintext as you would have gotten were you to perform the same decryption on the entire file, if the file is split after encryption. This is semi-relevant to CBC encryption schemes.You can recover plain-text blocks if your archive separates files into segments of two or more ciphertext blocks or longer. If you were to separate the entire ciphertext into segments of one cipher-block each, you would render any block missing both it's adjacent blocks as indecipherable.

If you are using a scheme that applies a different encryption key to each smaller segment, then you are increasing the number of keys needed to decrypt the entire message, but that is getting very implementation specific.

EDIT:

In regards to "losing important bits" - I assume you mean that if you were to split up the encrypted file and delete some of the segments (or store them elsewhere), you might be deleting parts of the file that ensure the security of the contents, such as a checksum or something.

The way that modern crypto works, your end result is two pieces of data - your encryption key, and the ciphertext. A good crypto algorithm won't have distinct "parts" in the ciphertext. It should be indistinguishable from white noise, ideally. Otherwise you are opening your ciphertext up to both detection and reverse engineering. So from a ciphertext, there are no specifically important bits to lose.


Is my network affected by malware? I am using Wi-Fi at my home, so I can connect more devices like my phone and computer in the same network. For the past two months, whatever website I visit, it loads for a long time and at the end it is redirecting to xtaff.com, tradeexchange.com, etc some other websites, ads are opening. I could not got to any website. But some standard ecommerce websites, Stack Exchange websites are loading fine but with low speed.

I could not find why it is happening like this. If I used my mobile with my same network, it is also facing same problem, and sometime I am getting the message like 'Your phone is affected by virus', then it stops there.

But If I use my mobile or computer at my office i.e connecting to some other network, I can get the same websites with fine loading including good speed.

What is the problem with the wi-fi? How can find it and remove it? I am using free antivirus software only (Avast).

Since according to your description all systems in your network are affected and independent from the operating system, the chances are high that your router is compromised and the DNS settings are changed. This way most outgoing traffic can be controlled by the attacker which leads to all these redirects to ads. This type of compromise is not uncommon as you can see from a google search.

What you need to do first is fix your router, that is make a firmware reset and update it to the latest firmware. If the router is out of support, if the model is known to be insecure or if the vendor is known to be unable to make secure devices (this includes most vendors of cheap devices) throw it away and get a better router. For more information see routersecurity.org.

After you've fixed your router you should also make sure that all your systems are clean since compromised routers are not only used to deliver ads but also malware.


what can you do in sql login details and encryption key is available I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml.

In this file there is information such as:

<crypt>
    <key><![CDATA[414c9022922d31b62bbe4447356e4ed6]]></key>
</crypt>
<disable_local_modules>false</disable_local_modules>
<resources>
    <db>
        <table_prefix><![CDATA[]]></table_prefix>
    </db>
    <default_setup>
        <connection>
            <host><![CDATA[]]></host>
                <username><![CDATA[MYSQL_USERNAME]]></username>
                <password><![CDATA[MYSQL_PASSWORD]]></password>
                <dbname><![CDATA[DATABASE_NAME]]></dbname>
                <initStatements><![CDATA[SET NAMES utf8]]></initStatements>
                <model><![CDATA[mysql4]]></model>
                <type><![CDATA[pdo_mysql]]></type>
                <pdoType><![CDATA[]]></pdoType>
                <active>1</active>
        </connection>
    </default_setup>
</resources>
<session_save><![CDATA[files]]></session_save>

However, I found admin folder as well but do not have the login details.
Only http and ssh ports are open. The SQL port is closed so remote access is not possible.

Apparently code injection is possible as on the default 404.php page I found a <script>alert('hacked')</script>

Apparently there are loads to do with <key><![CDATA[414c9022922d31b62bbe4447356e4ed6]]></key>. But I dont know how to use it.

Some things you can try:

Check for credential re-use. For example, can you log into the SSH server using the DB credentials?
Try to get code execution on the server. Since the web server obviously has access to the database, if you can launch another process with the web server's permissions, you should be able to access the DB from there.
Attempt SQL Injection (SQLi) attacks on the web application, which can be used to get at the contents of the database without ever directly connecting to it yourself.
Port-scan the server to see if the DB is perhaps listening on a non-standard port, or if there's some other vulnerable program listening on another port (a privileged debug service listening on 8080, for example).
Look up what the crypt key is used for (I'm not familiar with this system myself, but I'm sure the info is online) and see if it's anything useful like encrypting/signing authentication tokens (would let you spoof being an arbitrary user). This probably won't give you direct access to the DB, but might let you do something like access an administrator account in the web app and from there you can possibly access more data or find vulnerabilities in new attack surface.


X.509 certificate renew vs. rekey What is the difference from CA perspective between renewal and rekeying of the certificate previously issued by this CA?

From RFC 3647: Internet X.509 Public Key Infrastructure -- Certificate Policy and Certification Practices Framework:

  4.4.6.  Certificate Renewal

  This subcomponent is used to describe the following elements
  related    to certificate renewal.  Certificate renewal means the
  issuance of a    new certificate to the subscriber without changing
  the subscriber or    other participant's public key or any other
  information in the    certificate:

  Circumstances under which certificate renewal takes place, such
  as
    where the certificate life has expired, but the policy permits the
    same key pair to be reused;

Which contradicts itself in that it initially states that during renewal you cannot change the public key or any other information in the certificate, but then goes on to say that a renewal can take place where the certificate life has expired.

and...

  4.4.7.  Certificate Re-key

  This subcomponent is used to describe the following elements
  related    to a subscriber or other participant generating a new key
  pair and    applying for the issuance of a new certificate that
  certifies the new    public key:

  Circumstances under which certificate re-key can or must take
    place, such as after a certificate is revoked for reasons of key
    compromise or after a certificate has expired and the usage period
    of the key pair has also expired;


What are the pros and cons of using fail2ban when using SSH key auth? I've just bought a new dedicated server. Should I install fail2ban if I am only using SSH keys to login? What else does fail2ban protect? What are the advantages and disadvantages of fail2ban? Is there a better alternative?

I have also disabled root logins and installed sudo. It is an Arch Linux server supplied by OVH. I intend to install nginx and gitolite.

Since it varies on a case-to-case basis, there is no perfect answer to your question.

Yet, from an information security point of view, installing fail2ban (or any alike solution) would definitely add an additional layer of security... and that's something you can regard to always be a good decision.

My 2 cents: just go ahead and do it. In the end, you're better safe than sorry.


How to identify hackers based on ip addresses and the pages that were accessed I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that they were trying to access) I created my own blacklist process where I can blacklist someone from my site based on ip address and/or username.

After implementing this, I didn't see ANY errors of that kind....until today.

Now, before I go ahead and blacklist this person, I'd like to make sure that it isn't a legitimate search engine just trying to build it's database with all links available from my site.

So, my question, is there a way to see what company an ip address is assigned to?

Or, do those crawlers from search engines only go to pages that exist?

is there a way to see what company an ip address is assigned to?

You can find additional information about an IP address by using WHOIS services. ARIN, is a good start, and will redirect you to other registries (such as LACNIC or RIPE) when needed.

For most activity from legit search engine bots, the WHOIS will also contain the name of the company. For example, the WHOIS for 209.85.238.2 (one of the IP addresses used by Google crawler) will indicate that the IP address is registered by Google Inc.

You may also be interested by the lists of IP ranges by crawler, such as this one.

  Or, do those crawlers from search engines only go to pages that exist?

Not necessarily. A crawler doesn't always know that the page doesn't exist:

A page could have existed and indexed in the past and was removed later,
An internal link can lead by mistake to a resource which doesn't exist,
An external link can lead by mistake to a resource which doesn't exist.

  Here are some of the errors that I'm getting, should I blacklist this person?

It's your responsibility to decide to blacklist the IP or not.


Is it possible to store a user's third-party private API key securely? Let's say there is a website called Service. Service has a read-only API. A user of Service has an API key that they can change at any time if they think their API key has been compromised. If I want to read info on a user from the API, I just give Service a url like service.com/api&request=info1,info2&key=aBc123 and I get JSON of whatever I requested.

I'm trying to create a graph of live event data of which a certain user has, and provide this info to other users. This requires the certain user's API key be stored for the duration of the event, since the API only gives me entries from so far back. I would ask for certain user's API key before the event, use it to access the API, and store the key until the event is over.

I also want to use each user's API key to verify that they have permissions to view the graph, as the API tells me if users are in the same group or not.

My graph app would be hosted on a simple shared website thing from something like Namecheap or Bluehost, so that certain user does not have to keep their computer online.

Is it possible to handle and store the API key in such a way that I cannot steal another user's API key? Or do users just have to trust that I won't peek? Do I need to worry about the security of the key while it is being transmitted, either from the user to me or from me to the service?

It is not certain that there is a 100% secure solution to any static-secret problem (that's what you're describing btw). Also, there is always a trust relationship between your users and your service. You certainly don't want to be storing your user's secrets -- use it and discard it immediately is a good model.
All risks must be properly assessed, according to impact, likelihood, etc. For example, I use the excellent service, OctoTree, with GitHub. I have given them an access key to my account. I trust them because I don't have any private repos (and therefore the impact of disclosure is low), and it doesn't profit them to misuse or disclose this information. For me the risk is low so I give access to OctoTree. Your users will have to make the same assessment with you.
Btw: having a private key in a URL, as suggested by your post, is totally insecure anyway, so you don't have to worry about security on your end.
If you must store someone's key, use Hashicorp Vault's kv store. If you can run it, then it's the most secure you're likely to get.


What is the exact meaning of this gpg output regarding trust? When I import signatures or receive a key with gpg, it outputs some cryptic lines like:

gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:  16  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:  16  signed: 115  trust: 1-, 1q, 1n, 1m, 12f, 0u
gpg: depth: 2  valid: 105  signed: 189  trust: 81-, 11q, 0n, 4m, 9f, 0u
gpg: depth: 3  valid:  29  signed: 120  trust: 19-, 9q, 0n, 0m, 1f, 0u

I understand web-of-trust and asymmetric cryptography. But I don't know what "marginals", "valid", "signed" and all the letters behind trust exactly mean.

The official GnuPG documentation regarding this output is rather awkward.

The OpenPGP trust model

gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model

By default, GnuPG uses the OpenPGP trust model. In this, you can put trust on a key, which allows it to validate other keys.

Trusted Keys

Keys can be trusted. Trust allows keys to validate other keys. Although trust is a kind of signature on other keys, it does not get distributed when uploading keys to key servers.

There are different trust levels:

  - No ownertrust assigned / not yet calculated
  e Trust calculation has failed; probably due to an expired key
  q Not enough information for calculation
  n Never trust this key
  m Marginally trusted
  f Fully trusted
  u Ultimately trusted

(taken from the GnuPG manual, chapter key management)

Mostly important are the last three categories: your own keys are ultimately trusted; fully trusted keys' signatures are regarded equally worth your own ones; while marginal trusted keys require more signature paths to make a key valid.

Valid Keys

In the default OpenPGP trust model, a key is fully valid if:

  it is signed by enough valid keys, meaning

  you have signed it personally,
  it has been signed by one fully trusted key, or
  it has been signed by three marginally trusted keys; and

  the path of signed keys leading from K back to your own key is five steps or shorter.

(taken from the GnuPG manual, chapter 'Validating other keys on your public keyring')

Other keys are marginally valid; showing there is a trust path, yet it is not strong enough. I highlighted the word "valid" in the quote above: only fully valid keys' trust is taken in account for calculating validity! In GnuPG, the default trust model can be configured.

The manual page linked directly above also contains some examples for trust calculation, but watch out for the non-default trust model applied for simplicity!

GnuPG's Trust DB Information

This information gets printed whenever the trust database gets updated, for example after receiving them from a key server.

gpg: depth: 0  valid:   1  signed:  16  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:  16  signed: 115  trust: 1-, 1q, 1n, 1m, 12f, 0u
gpg: depth: 2  valid: 105  signed: 189  trust: 81-, 11q, 0n, 4m, 9f, 0u
gpg: depth: 3  valid:  29  signed: 120  trust: 19-, 9q, 0n, 0m, 1f, 0u

This output describes your web of trust. The letters represent the trust levels listed above. On level 0, you will find your own (ultimately trusted) keys. There should not be any other kind of trust on this level. This key is valid (of course).

The further output represents my interpretation which is not based on reading the (missing) documentation nor the source code: You signed 16 keys, making all of them fully valid on level 1. For 12 of them you issued full trust, one of them only marginal. Those again lead to another 105 valid keys you trust on level 2. Some of them are trusted again, leading to another 29 valid keys in level 3.

Comparing this output to what the keyservers tell, you should probably update your keyring. ;)

More trusted keys in deeper levels could create the levels 0-5 if you do not change the maximum path length of five proposed by OpenPGP's trust model.

Werner Koch, the main author of GnuPG, once stated on the GnuPG mailing list:

  You would need to look at the source.  However, if you known the WoT well,  you should be able to figure out what this is. [...]  You should consider this a debugging output.


What are the alternatives to null byte injection attack? Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?

For RFI you don't need null byte, simply match the file extension on the remote file, inject a ? Which turns the extension into query string, use URL rewriting, etc, etc. For LFI however you may be able to pre-pend a number of ././ or /./. to cause the total path to be too long and php will truncate it. This is trickier as it is is length/offset dependent and you will need to brute force the length unless you know the local path and finally as you are padding by two bytes you may need an odd or even number of bytes in the filename for the truncation to align.


Stopping Session Hijacking If you noticed, I put "stopping" instead "preventing" in the title because I want my PHP application to be as secure as possible. I am wondering if anyone has any better ways to prevent session hijacking then what I have already. I would like to keep the security measures to my PHP code and not in any of the web server settings.

Here is what I am doing right now:

When a user logs in, session_regenerate_id() is called
A session variable is created which stores the users IP address which is decided from HTTP_X_CLUSTER_CLIENT_IP, HTTP_CLIENT_IP, HTTP_FORWARDED, HTTP_FORWARDED_FOR, or REMOTE_ADDR (whichever is found first)

Anyone have any tips on what else I should be doing? I was also wondering what the best method is to determine the users IP address so it can't be spoofed?

First of all remove all of the proposed checks.  They are relying upon attacker controlled input to impose security restrictions.  Nothing about this is "secure",  its just foolish.

Spoofing your IP address over the internet is impossible because of the 3 way handshake,  you should try studying networking it is actually pretty interesting.  Using the HTTP_FORWARDED_FOR PHP variable for security is a violation of CWE-291: Trusting Self-reported IP address.

So how do you prevent "session hijacking"?  Prevent the attacker from obtaining the session id in the first place.

OWASP A9 - Insufficent transport layer protection and OWASP A2- Cross Site Scripting.

Set these PHP session configurations:

session.cookie_httponly = 1 (helps mitigate xss)
session.session.use_only_cookies = 1 (prevents session fixation)
session.entropy_file = "/dev/urandom" (better entropy source)
session.cookie_lifetime = 0  (smaller exploitation window for xss/csrf/clickjacking...)
session.cookie_secure = 1 (owasp a9 violations)


Proxy server and IP address blockade i am in china. so i use web freer to use blocked sites like face book and you tube. we use broadband connection provided by our university. some times the server goes too down and we can not use internet. our friends say it goes down because they block our IP address as we use that proxy server. I want to know if that is the real case... should we stop using proxy?? will it help?? is there any other way to use blocked sites with out hampering the internet connection???

You're in a difficult position, because China has a program of "Internet content review" which causes many sites to be inaccessible for periods of time. And most of the information (outside mainland China) which would tell you how to access these sites is also unavailable.

One of the most effective ways of bypassing this is to use SSH's SOCKS proxy feature. This is because SSH is almost never affected by the Internet content review.

This requires you to have access to a Linux (or UNIX) server outside China. For instance you could lease a virtual server from Amazon EC2 or many other low-end VPS providers. It also requires you to have SSH installed on your local PC, so you would need to run Linux, or Cygwin for Windows for instance. Once set up on both ends, you make a SSH connection from your PC to the Linux server:

ssh -D1080 my.server.outside.china.com.au

Then you configure your local Web browser to use a SOCKS proxy on localhost port 1080, and all of your Web browsing will be tunnelled through the SSH connection, and the rest of the world will see the connection originating from your leased Linux server in the other country.

It's also possible to use VPN services, though these often get blocked.

A post at our sister site Super User has some more ideas on ways to access blocked sites.


How to reset passwords without emailed reset link? In an offline system what is the preferred method of resetting a user's password?

Usually this would be handled with an emailed password reset link. However this system is offline, there is no access to email.

My first thought is that an administrator would reset the password, then communicate the new password to the affected user, who would use it to log in and then be forced to enter a new password.

The shaky part of this is how should the password be communicated to the user? Presumably on a piece of paper. That doesn't seem great.

My second thought is that an administrator would simply clear the password, allowing the user to log in with no password (possibly for a limited time), and then be forced to enter a new password.

I'm not sure that's right either.

Is there some standard process for this? I'm keen to avoid some contrived roll-your-own approach.

  EDIT: One point I should have clarified is that this system could have as few a one (shared) computer (managed by a group of administrators). User's won't have their own devices. The advice posted before this clarification is still useful though, so thank you.

A temporary password is issued and communicated that must be changed upon first log on. This is very common for new employees in a company when they get their first Active Directory account.


Are phone calls on a GSM network encrypted? When I make a call on my cellphone (on a GSM network), is it encrypted?

For the most part[1] they are encrypted, but not sufficiently enough to be considered as safe, tap resistant encryption. GSM uses 64-bit A5/1 encryption that is weak, to say the least. $15 phone, 3 minutes all that’s needed to eavesdrop on GSM call article from ArsTechnica covers it pretty well IMO, if you care to read more about it.

However, it also depends on what you mean by GSM. What I mentioned above is true for what we usually mean as GSM (2G, or second generation protocols). 3G are generally considered slighly safer (for lack of a better word):

  3G networks offer greater security than their 2G predecessors. By
  allowing the UE (User Equipment) to authenticate the network it is
  attaching to, the user can be sure the network is the intended one and
  not an impersonator. 3G networks use the KASUMI block cipher instead
  of the older A5/1 stream cipher. However, a number of serious
  weaknesses in the KASUMI cipher have been identified.

https://en.wikipedia.org/wiki/3G#Security

However:

  Many operators reserve much of their 3G bandwidth for internet
  traffic, while shunting voice and SMS off to the older GSM network.

http://arstechnica.com/gadgets/2010/12/15-phone-3-minutes-all-thats-needed-to-eavesdrop-on-gsm-call/

[1] Unencrypted communication (flag A5/0) is also supported on GSM systems, and this encryption (or lack thereof) might be regulated by laws of different countries differently, or part of the carrier's policy not to use it. Some devices also display notifications to users when their calls will be encrypted and when not, but most probably felt it's hardly worth bothering notifying users, especially considering the strengths of various cypher suits in use with GSM protocols. See my reply to @HSN's comment below for more information.


AWS Tenant Restrictions I'm a sysadmin of a medium sized chain of Italian restaurants.  While I'm not dealing with patient health records or financial information I am still security focused.

I'm trying to achieve tenant restrictions for Amazon AWS, similar to what I do for Outlook.  I do not want users to log into personal AWS accounts, only the organization one (https://docs.microsoft.com/en-us/azure/active-directory/active-directory-tenant-restrictions)

For S3 buckets themselves I can limit PUTs and POSTs to them to prevent uploads on non-approved buckets.  I want to prevent users from logging into a personal AWS account on the web console and uploading from there.

I'm using a proxy based solution for a SWG and can apply headers as needed.

Does some kind of header exist that I can shove into my S3 requests (or auth requests to AWS) that prevents people from logging in with personal accounts similar to what O365 provides?

I don't think that there is any method supported directly by AWS to prevent users from logging into any account (that they have rights to).

AWS promotes the use of multiple accounts. With the recent announcement of AWS Single Sign-On it is even easier to use multiple accounts.

Announcing AWS Single Sign-On (SSO)


TrueCrypt LUKS keyfile and password I understand that a TrueCrypt volume may be encrypted with a password AND a keyfile.

As far as I can tell, A LUKS volume may use EITHER a password OR a keyfile, but not both simultaneously for the same user.

Can anyone confirm whether this is correct?

Can anyone offer an opinion on whether using a password-protected keyfile is better/worse/equivalent than the combination of a password and a keyfile?

A LUKS volume is protected by a volume master key.  This key is generated when the encrypted volume is created, and is the maximum strength the chosen encryption algorithm permits.  Access to this key is by means of a number of "key slots": the volume master key is encrypted using a user-supplied password and stored in the header.

Strictly speaking, LUKS does not support keyfiles.  Instead, it supports reading the user-supplied password from a file -- something that is roughly equivalent to TrueCrypt's keyfile system.

A password-protected keyfile can be equivalent to a password+keyfile, or it can be worse.  It all depends on how well your password protects the keyfile.  I can't think of a situation where it would be better.


SSL protocol paper "Investigations about SSL" In several papers, I see the quote of the following security paper, which concerns SSL:

EADS Defence and Security Systems SA. Investigations about ssl.
http://www.eucybervote.org/Reports/MSI-WP2-D7V1-V1.0-02.htm.

Unfortunately, I can't find it anywhere, by checking the address directly or by using a web crawler. Where could it be available on the Internet (if it still is)?

Seems eucybervote.org isn't available anymore. You can try the web archive.


Connection to Google websites is not secure When I open Gmail or Google search and leave it opened for a while, I notice this yellow warning triangle, as in these photos:

However, when I refresh the page it returns to the usual green lock icon.

Why I'm losing my private connection to Google? I have up-to-date Mozilla Firefox, and my connection is through a proxy server.

Thanks.

Since it does not complain about a bad certificate it is probably not related to MITM attacks. And since the original google.com is usually not mixed content I doubt that this message is caused by google itself.

Therefore I suggest that it is an in-browser issue, like some browser extension injecting code into the page where the code tries to load external resources using http instead of https. Thus check out the extensions you use and see if the issues is resolved when switching off specific extensions.

If you are in a corporate environment or have a local anti-virus working as a proxy there might still MITM in the form of SSL interception which then changes the page. To find out look at the certificate chain.

Apart from AV there is other software which injects its own root CA into the system. A typical example is the infamous Superfish which came pre-installed with Lenovo-Systems and which "enhanced" the browsing experience by injecting advertisements.


What kind of attack is when we use iframes to redirect users? What is the name of the attack if:

there is a forum on the goodwebsite.comm
there is an attacker website badwebsite.comm

The form on the goodwebsite.comm allows us to insert iframes, and using window.top.location we can redirect the parent page to any page, ex.: badwebsite.comm to show the users a login form that looks similar that is on goodwebsite.comm. After the users gaved their user/pw, they will be redirected to the original page/forum of goodwebsite.comm. Next time they refresh the page, they will be NO login screen, because we stored a cookie, thus only showing fake login page from badwebsite.comm when it's the first visit.

Question: what is this attack called?

It's called XSS (Cross-Site Scripting).
Quoted from here:

Cross-site Scripting (XSS) refers to client-side code injection attack wherein an attacker can execute malicious scripts (also commonly referred to as a malicious payload) into a legitimate website or web application. XSS is amongst the most rampant of web application vulnerabilities and occurs when a web application makes use of unvalidated or unencoded user input within the output it generates.
By leveraging XSS, an attacker does not target a victim directly. Instead, an attacker would exploit a vulnerability within a website or web application that the victim would visit, essentially using the vulnerable website as a vehicle to deliver a malicious script to the victim’s browser.
While XSS can be taken advantage of within VBScript, ActiveX and Flash (although now considered legacy or even obsolete), unquestionably, the most widely abused is JavaScript – primarily because JavaScript is fundamental to most browsing experiences.


How eavesdropping will be performed how can I prevent from eavesdropping I believe that eavesdropping in a man in middle attack and the message is passing from the client to server the man sitting at ISP or network hackers can look at what message I am sending. Heard that this can be easily done with wireless networks.

Well, how can I prevent from eavesdropping without SSL?

Does encryption help me in any way?

Will sending a bar code with my message help me?

Is there any other way to prevent eavesdropping?

Also what are the uses of SSL?

Is it only used to prevent attackers from eavesdropping or does it have any other significance?

Simply put - any unencrypted message which is sent can be seen by an attacker who has access to the communications channel. This can be more of a problem with a wireless network, as it is broadcast as opposed to a wired network, which would require an attacker to gain access to a point on the route.

The solutions to this are:

to encrypt the message
to encrypt the channel

Both work and are appropriate in different situations.

I'm not sure what you mean by barcode - a barcode isn't a security mechanism, it is a way of representing characters in a machine-readable format.

As to the uses of SSL - there are a wide range of questions here tagged SSL which are worth looking at.


Is symmetric encryption with one time pre-shared key secure? Suppose I have a secure channel between client and server, with proper certificate validation etc (actually, ssh session).

I want to establish a secure connection between my own application on a server and client, but don't want to implement TLS, or some sort of certificate validation, or send my data through SSH tunnel.

Is it enough to generate a strong random key, send it through ssh session, and simply use that key for symmetric encryption, say, AES?

Edit. Realized my question was not clear enough. Real question should look like so:

If I have a pre-shared one-time key, is it worth to use TLS? What problems can I encounter with my own implementation using strong symmetric encryption, like AES?

Basically, no.

You haven't even gone half way towards describing your system. Will you be using a stream cipher or a block cipher? How will you authenticate this traffic? How will you protect it from replay attacks, bit flipping attacks, timing attacks and so on?

Once  you've fixed all the vulnerabilities in your system, I think you'll find that it resembles TLS anyway. Except you will probably have missed a few things along the way. You'll end up putting a lot of effort into making a flawed implementation of something that you can already have for free.

Using TLS from the outset would seem to be the sensible thing to do here.


Is it safe to publicly expose key hashes? I have a simple API which I want to limit users using a key. For each request, the users will need to post the key and the other parameters.

For example in R:

res <- httr::POST(
  "api-url",
  body = list(
    img = img,
    key = "6pX2PKIKTGyjORcUjlbyDv1yPyxDdk63LudskjdXnyx1tJ7mjhfmeYMTQ7gH8q376"
  ),
  encode = "json"
  )

The request handler will do the following:

 key <- openssl::sha256(key)
  if(!key %in% keys | is.null(key) | is.na(key)) {
    stop("Not authorized. Get an api key from decryptr.com.br")
  } else {
    return(result)
  }

My question is: Is it safe to let the keys object be public in order that anyone can read it?

At the moment it's a yaml file like this containing only the hashes for each key:

keys:
- ef556689177dbe281139a5688162f54166127c83746a83c87b872605621sa156
- b934527d8d59be4766e43db6c9de039871ddcea33c948bcf59ee5ed29fdr1f4f

As long as the keys contain as many or more bits of entropy than the number of output bits of the hash (ie keys are random and long enough), making the hashes public wouldn't result in any notable loss of security. To reverse a hash of sufficiently random data would require a preimage attack, and preimage resistance is one of the basic properties of a cryptographic hash function (even MD5 is still preimage resistant). Just make sure the keys are being generated with a CSPRNG.


Pentest a WordPress installation I will help a friend to test the security behind their WordPress site. I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful.

When I read a lot about the way people is penetration-testing wp-sites a lot of people is using sql injection on older versions of WP, though I believe this site is pretty new.
Also a lot people is using brute-forcing though that builds on you have got a good word-list.

What is your suggestions?

Notice also I am not interested in break their Webserver in a any way.

For an application scoped assessment, I would begin with the obvious tools that are specific to that application, such as WPScan (which you mentioned).  Beyond the findings there, I would look at your goals, objectives, access, and likelihood of finding types of vulnerabilities.

Wordpress core is relatively well hardened today.  It's unlikely you'll have findings there.
Wordpress plugins are a potential cesspool.  Many of them have no maintenance and were written by people as one of their first programming projects.  Look at the interfaces these provide.
Custom themes, since they can contain PHP, are particularly a source of vulnerabilities, including XSS.  Look closely if your friend has a custom theme.

I would use mostly Burp Suite in the evaluation of these areas.  If you have reason to believe SQLi exists, then consider also sqlmap.

I wouldn't bother trying to brute force credentials at all -- what's the point?  If you want to check whether passwords are strong, you could dump the password database and do an offline attack with JTR or Hashcat, but if the number of users is small, just make them have good passwords.  :)


CSRF Login: can Attacker Login using valid credentials? Consider the picture below (taken from page 21 here). Is this possible? If so, how can I prevent it?

Yes, it's possible.  Or rather, it would be possible, except that Google has deployed countermeasures to defend against precisely this attack.

This attack is known as "login CSRF".  It's similar to a standard CSRF attack, but a little different.  If you search on "login CSRF", you will find information on the attack.  It is a real threat against some web services.  For more details, see my answer to a related question, and the following research paper:

Robust Defenses for Cross-Site Request Forgery.  Adam Barth, Collin Jackson, and John C. Mitchell.  CCS 2008.

See especially Sections 1-3 of that research paper for more technical details.  The paper describes how to defend against the attack.

The short version of how to defend against the attack is that you include a secret CSRF token in all POST requests, including login attempts; and on the server side, you require that login attempts have the proper secret CSRF token included.  OWASP has more on how to deploy secret CSRF tokens.


How are IaaS Virtual Machines Isolated? I am currently examining Hypervisor firewalls for my graduate thesis, but I unfortunately don't have a lot of experience with IaaS environments.  How are IaaS Virtual Machines network isolated from each other (if at all)?

Do IaaS Providers solely rely upon VLAN's for network isolation?  Are IaaS VM's bridged onto a network to obtain an IP?  Can most IaaS VM's ping other VM's that are present on the same Hypervisor?

Thank You

IaaS servers use traditional hypervisors you can install on any computer, typically Xen or KVM (or Hyper-V if you hate money). These typically connect to the network using one of:

an internal virtual interface (TUN/TAP), which you can then bridge or firewall or do whatever you want with at the containing host level
programatic in-process NAT (unlikely in an enterprise setting)
network card sharing (managed by the hypervisor)
dedicated network card

The network model is up to the implementor. The TUN/TAP interface provides the greatest flexibility, since the VM's network interface shows up as an otherwise unconnected interface in the host OS. When and if to send packets to the virtual interface is determined entirely by the host server's firewall and routing tables. It can be complicated to set up and get right, though.

The network card sharing system is probably the simplest, and therefore the most likely. To all the world, it looks like each VM has an ethernet interface all connected to the same switch. But in reality there's only one interface listening in promiscuous mode, with the host OS determining whether or not to send packets to a given VM. The security model there is the same as you'd get with multiple servers on a single broadcast network.

Finally, dedicating an interface to each VM is the most expensive, but also the easiest to understand intuitively from a security perspective. Each VM has a network adapter, you plug the correct cable into the appropriate adapter, and there you go. This is highly unlikely to find at scale, though, since changes require manual intervention.

As far as what security models are in play; again that's up to the implementor. Simpler places will typically provide NO network security (your server is on the Internet, deal with it), but if they do provide private networks, then their mechanism for doing so is their own secret. There are only so many things you can do, though, so you probably can guess.


Anyway to Escape HTML Reading Input as a String? So I'm evaluating a notoriously safe website for XSS exploit, but I've noticed something interesting. They ban HTML number entities (&#123;) but not the letter kinds (&lt;).
With the "letter" kind, it parses on the website and I can input

While the above should break and execute, it doesn't. It just sits there, even if it's returning on the page.

TL;DR:
I found a way to make a page accept

It is fine if a web page does not filter strings like &lt; because it is escaped already. Browsers know that &lt;script&gt; is not an actual script tag, but just text.


Should I have an SSH bastion? I am using AWS. I need to connect with a local SSH client to Linux EC2/ECS instances. I also need to connect with a local PostgreSQL client to RDS instances.

There are tutorials for creating SSH bastions in AWS:

https://docs.aws.amazon.com/quickstart/latest/linux-bastion/welcome.html
https://cloudacademy.com/blog/aws-bastion-host-nat-instances-vpc-peering-security/

I know several people who do this.

I also see articles about not doing this:

https://medium.com/@henriksylvesterpedersen/you-dont-need-that-bastion-host-cd1b1717a9e7

Assuming I am using IAM roles, security groups, etc. correctly, are there good reasons I should strongly consider using a (SSH) bastion? What are they?

I have just finished reading the post against bastion hosts. At first the author says that doing that goes against what the majority consideres as best practices. Attempting to make that interesting post short I would identify the following most important points:

nothing is wrong per se when using a bastion host it may simply be not as powerful as you could hope
the drawbacks are:

one more machine to maintain
a false security feeling could lead to lower the in depth protection rules - which is definitely bad.

IMHO this last point is the worst use case. People often want to just buy security without worrying of all the security rules, and are told that a bastion is their solution. What it is not. A bastion host is indeed a nice tool to increase security, but it will be helpless if the princip of least privilege is not respected.

Long story short, my opinion for best security practices is:

define what threats you want to considere
define what are the minimum rights that must be enabled to allow you business process
ensure that only that rules are allowed

Then if your security threat analysis shows that you need a strong protection at you internal network entrance (which is the common use case), then a bastion host is probably usefull, provided it is consistenly monitored and maintained with up to date versions of its software. If you cannot meet that condition, then you will only have a false security sentiment. If you find you saying My security relies on the bastion host, and I do not want to be bored with any other security consideration, then the bastion host is probably more harmfull than usefull.


Why is always possible to discover and exploit new zero-day vulnerabilities? Couldn't an updated  server/computer be completely sealed against attacks? Why can't you block any incoming request for running something in your server?

For example, in my naiv view, a mail server could be getting emails (text files) sending emails, but never allowing anything entering the server to execute anything. What could break this?

But, how do hackers proceed to find and use a vulnerability?

For as long as software is written by people, who are inherently imperfect and can make mistakes, there will be bugs in code that can be exploited.

Servers need to expose themselves to the outside world in order to provide their services, which are definitely provided by software written by people installed on the server. For client computers, they need to run software that allows them to be useful to their owners, such as word processing software, and that is still written by people.

In that example you write of, an attacker can attack the email service exposed by the server. Then, a few zero days for sandbox/chroot escape, privilege escalation and suddenly the attacker has root on the server.

No amount of mitigation will stop a determined attacker with nigh unlimited resources from compromising a system; it's a risk management thing, like what sort of attackers you are aiming to protect against determines what kind of measures you take.


Is it acceptable security practice to display password in plain text on a website? After I completed Account Setup Assistant process for a new SiteGround hosting service, I got this confirmation screen on the website:

... just log in to your Wordpress control panel with the details below:
Admin URL: XXX
Username: XXX
Password: XXX

In place of XXX, there were actually my username and password in plain text.

This was delivered in a new page over HTTPS; the HTML of the page contained:

Username: XXX

Password: XXX

From that I conclude that they don't use client-side password hashing. I was surprised; I thought it was normal industry practice for sensitive services. Is it not the case?

Apart from the above, is there any security issue with displaying password back to me in plain text? (I assume they don't actually save it in plain text in a database - that would be atrocious; presumably, it only stays in memory of their web server, while it's preparing the response to my POST request; I hope it is hashed/salted before being saved in any persistent storage).

Note: they did NOT include plain text password in the email confirmation; only on a single web page that is only available right after I signed up.

Yes, there are definitely some issues:

Shoulder surfing: There is a reason that password fields use stars. It's so that people who are nearby cannot see the password. Showing the password in plaintext on the screen obviously defeats this, and this is really the main downside of this approach.
Caching: The response may be cached by the browser. Setting appropriate headers can mitigate this.
It lowers the perceived security of the site, which isn't good. It may also have a negative psychological effect (if the site isn't careful with the password, why should the user be?).

  they don't use client-side password hashing. I was surprised; I thought it was normal industry practice for sensitive services. Is it not the case?

No, client-side hashing is not standard, mainly because it doesn't add much.

The password should already be protected in transport via HTTPS (and hashing wouldn't secure transport anyways).

It may seem that client-side hashing could turn a weak password into a strong password (eg password -> 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8), but any attacker would just need to take the client hashing into account and chain client- and server-hashing when cracking the password.


Save private key in a database to share between multiple accounts I don't know if my concept would be secure so I ask here. The main purpose is to log in with password x and also use that password to encrypt an RSA private key with AES to store that in the main database, so when I log in with another account that private key can be reused and I can encrypt all incoming messages with that private key, so other users only need one single public key from me.

Due I don't want anyone to be able to read the message I use that RSA encryption but I also don't want the server to be able to know the AES password.

So my thought was that I use password x and hash it with PBKDF2WithHmacSHA512 and use that first hash as the AES password. Then I hash the hash again with the same algorithm and use that to log in in my account. So the double-hashed-password will be sent to the server and will be treated as my account password. With my understanding the server will never know what the AES password is so will never be able to get the private key.

The private key will be generated when no private key is in the database yet, encrypted and sent to the database. When I log in again I will get this encrypted private key and can decrypt it.

Now I'm wondering if I'm missing something. Would that be secure?

Your strategy has a few issues. It is a bit confusing, but I'll try to address:

Firstly if you use the output of a hashed password as the input to something else, then you'll not be able to change passwords, since after this the output of the hashed password would be different and would therefore end up being a different key.

Secondly, the premise that you don't trust the server implies that you cannot send passwords or keys in any way to the server, which would certainly be the case for web applications. So you can't use your password or the hashed password which is used as an AES key (considering that this is possible and feasible). Otherwise it is always possible for the server to collect enough information to recover all your keys.

The last aspect is a deal-breaker. Either you change your model and somehow trust the server, or you change your model to ensure that private keys never touch the server.


Analyzing whether browser certificates have been compromised How can I know that my installed certificates (in Firefox), are (still) reliable?

You don't have a huge amount of choice. As I understand it, the root certificates that are automatically trusted by Firefox are actually embedded in Firefox's source code. It looks like you can choose to untrust them through the settings, but you can not actually remove one of the default root certs.
We all have to trust that Firefox has a rigorous and respectable process for including a CA as a trusted root. See Firefox's page on how they choose to include root certs. Since the root certs are embedded in the source code of the browser, the only way to remove one is for Firefox to push a security update, so we also have to trust them to do this in a timely manner if one of the trusted roots has a breach.


How should you store a password that needs to be retrieved as plaintext? Possible Duplicate:
  How should passwords be stored if they must be recoverable?

I have created an API for a site that doesn't provide any form of API. For the API to do anything with the account, it needs the username and password in plaintext.

How should I store this password so it can be provided to the API?

It should be available to my server, which runs a cronjob every hour, that is using this API.

Edit: I only need to store my own password for this site.

How do you store the password?   Very carefully.

In particular, I suggest using a special architecture:

Set up a separate machine, which will exist only for storing the cleartext passwords.  It should be hardened and locked down as tightly as possible.  You should limit the number of administrators with access to this server.  And this server should be used only for this purpose.  Let's call this the "login server".
The login server should export a simple API, with a few functions: (a) add a new username/password pair for some website to the password store, and return a handle that uniquely identifies this; (b) login to the third-party site using a particular username/password pair (as specified by its handle), issue a particular request, and return the response; (c) delete a particular username/password pair (as identified by its handle).  Passwords should be stored on the login server (not on a shared database).
Notice that there is no API to export a username/password pair from the password store.  That is on purpose.  The login server should act as a Hotel California for passwords: passwords go in, but they never come out.
The login server should keep detailed logs of all uses of its passwords.  You might also want to have it to some rate-limiting (e.g., notify an administrator if the rate of uses exceeds some threshold).  And you might want to have some garbage-collection, so that if a username/password is not used within 90 days, you delete it from the password store, to limit the number of old passwords stored (the user can be prompted to re-enter their username/password when they next log in).

This architecture isolates the most security-critical aspect into a separate piece, the login server, and tries to keep its functionality as simple as possible, so that you can minimize the chances of security vulnerabilities that might allow access to users' passwords.

Second, I suggest that you plan to do an extra level of code review and testing, given the critical nature of the login server:

Have a second developer review all of the code for the login server, to check that it does not contain any security vulnerabilities.
Consider hiring someone to do a pentest or a security code review of the login server.

Even if you take all of these steps, you are still subject to some risk.  There is no silver bullet.  If the login server gets hacked, all of your users' passwords will be disclosed, which is very bad.  Therefore, be as careful as you can.


What advantages does it have if a password manager locks the DB automatically on locking the computer? Disadvantages of turning it off? When I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords. I was wondering what the benefit is in that, as my computer is locked anyway.

After reading a few questions here I understand that this is to prevent cold boot attacks. Are there any other advantages?

Or restated differently: What are the resulting security risks when one keeps the DB unlocked while locking the pc?

One of the key principles in defending systems is reducing the attack surface. Especially when it comes to critical systems like password managers, you want to apply very high security standards and expose them only when necessary. So it makes sense to lock the password manager whenever you do not need it.

Password managers can lock themselves after a certain (usually configurable) amount of time or at certain events. It makes sense to lock your password manager automatically when you lock your screen, as the password manager can be sure, that you do not need it at that moment. Why leave it exposed, if the rightful owner is currently away?

So what are the actual risks? Let's take a look at the two most probable scenarios:

Someone is able to unlock your computer for any reason (weak password or written down password, etc.). Unlocking your computer is all that's needed to access you password manager, if it doesn't lock itself down. Breaking your login equals breaking your password manager. No second line of defense means less security.
Someone compromises your system over the network. Just because no one is sitting in front of your PC doesn't mean no one can interact with it. If your system gets compromised over the network to a point where an attacker can access your desktop session, you are probably in deeper troubles anyway, but there is still no reason to hand the attacker all your credentials on a silver platter. The shorter the duration your password manager is unlocked, the less likely it is for an attacker to get access. There is a small downside to consider though. If the attacker uses a keylogger, he can get your password for the password manager when you log in again, so logging in less often may sound appealing, but in real life it won't really make a difference, once an attacker took over your PC. Sooner or later you will log into the password manager and the keylogger will be waiting for you.

As you can see, remote compromise is less of a concern, since you have lost everything in this scenario anyway. The main issue is someone logging into your machine and having direct access to your password manager. You basically lose the second line of defense the password manager is trying to provide.

Before I forget, you mentioned cold boot attacks. I assume, you don't have to worry about them. Performing a cold boot attack is really difficult and not many actors will go so far to perform them. If you are really such an exposed and high value target, that you have to worry about cold boot attacks, you shouldn't even consider leaving your password manager open even a second longer than necessary!

If disabling automatic locking is a risk worth taking to avoid entering the credentials for your password manager more often, is up to you to decide. I can only recommend to take the safer route, the decision is now yours.


What is this weird localhost IP traffic on multiple ports in the 5400-5600 range? I am encountering an issue I recently have seen in my Fedora 23 machine (latest updates). I am getting about 130 IP packets passed back and forth over the lo interface in one go, every 1 second (like a timed process). It occurs for about 2-5 minutes, then stops for a few seconds to a couple mins., and then starts right back up again. I can see the packet traffic in a tcpdump capture on the lo interface, but I can't find any real information on the particular ports it is using other than IANA names, and I am not an expert on protocol debugging with tcpdump. A couple sample messages are pasted here, but I will also include a pointer to a paste bin for a more complete capture (yes, I read the SE general opinion on *bin sites, but it is a huge capture even for a couple seconds, and enough should be here for future searches to find):

21:33:43.047410 IP localhost.localdomain.5665 > localhost.localdomain.44574: Flags [R.], seq 0, ack 2284755030, win 0, length 0
21:33:43.047448 IP localhost.localdomain.38818 > localhost.localdomain.5667: Flags [S], seq 1778200592, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0
21:33:43.047460 IP localhost.localdomain.5667 > localhost.localdomain.38818: Flags [R.], seq 0, ack 1778200593, win 0, length 0
21:33:43.047496 IP localhost.localdomain.37068 > localhost.localdomain.5669: Flags [S], seq 3846609184, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0
21:33:43.047508 IP localhost.localdomain.5669 > localhost.localdomain.37068: Flags [R.], seq 0, ack 3846609185, win 0, length 0
21:33:43.047544 IP localhost.localdomain.44684 > localhost.localdomain.amqps: Flags [S], seq 2934840620, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0
21:33:43.047556 IP localhost.localdomain.amqps > localhost.localdomain.44684: Flags [R.], seq 0, ack 2934840621, win 0, length 0
21:33:43.047592 IP localhost.localdomain.56366 > localhost.localdomain.jms: Flags [S], seq 3939722005, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0
21:33:43.047604 IP localhost.localdomain.jms > localhost.localdomain.56366: Flags [R.], seq 0, ack 3939722006, win 0, length 0
21:33:43.047640 IP localhost.localdomain.50540 > localhost.localdomain.v5ua: Flags [S], seq 3048240647, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0
21:33:43.047652 IP localhost.localdomain.v5ua > localhost.localdomain.50540: Flags [R.], seq 0, ack 3048240648, win 0, length 0
21:33:43.047688 IP localhost.localdomain.57428 > localhost.localdomain.questdb2-lnchr: Flags [S], seq 2388676920, win 43690, options [mss 65495,sackOK,TS val 9036387 ecr 0,nop,wscale 7], length 0

It seems to go in sequence, like a port scan, but it always stays within the 5400-5699 port range. More is available at the Fedora Project paste site: https://da.gd/Zr1b . I could only paste up to 20 seconds of capture because there is so much traffic!

I normally would look up the process in a lsof and track down the culprit, but the ports go by so fast that lsof misses whatever it is that opens the connection. Netstat is no help either, or at least I may be using it wrong.
Some other troubleshooting steps I did take was to shut down networking, and pulled the Ethernet cable. No dice. I also ran up an instance of ntop, directing it to attach to the lo interface, but it could not see a thing.

So, does anyone have a clue as to what this is? I can say I noticed it in my network widget on the desktop when I got home from work today, and I had updated the machine the day before - but there was no localhost traffic I saw then.

I got the time to track it down, and it looks like I found the answer. It's 'adb', the Android Debug Bridge service, installed with the Google Android tools package. I had put it on my machine to help unbrick my daughter's phone (don't ask) and forgot to shut it off. But that was months ago, and like I said I didn't see the traffic in my desktop widget (Gnome/MATE System Monitor applet) until after I updated the OS on Apr. 19th, and not immediately after the update. I am digging through the release notes on the list of updated packages now to see if there was a networking-or-other package that updated something to bring this up on the radar.

Anyhow I'm recording the steps I took here in case someone wants to know how I found it, maybe it'll help someone someday. I started by using Wireshark, but not really knowing what to look for all I could note was that the pattern started at port 5401, ran every odd numbered port up to 5699, and then recycled. Then I went back to the basics and looked up the man page for lsof. I ended up using the lsof command like so:

lsof -i :5000-5700

It shows all processes using internet ports 5000 through 5700. A couple processes showed up, 'adb' being one of them (listening on port 5037) . 'avahi-deamon' showed up too, running UDP on mDNS (port 5353). I don't run Zeroconf/Bonjour/whateverthenameisnow, so I shut down avahi-daemon. No dice, still had the traffic. Then I went to look up adb, it had no man page, no apropos, no whatis, and a 'dnf whatprovides /bin/adb' came up empty. Strange. However running a 'strings' on it and piping it to less showed the word ANDROID show up a few times. Bingo. I took a look at the services list in systemctl, and saw 'adb.service' was enabled. I shut it off with 'systemctl disable adb.service', and wala, like magic the traffic stopped.

Now, doing that was just a shot in the dark, I did not know for sure it was adb that was making the traffic before I shut it down. After all I could only prove it was listening on port 5037. I wonder what it is doing looking through all those ports. Obviously trying to connect to something. When I get more time I will look through the documentation.


Suspicious .exe set to run at startup: Determine if file exists still When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the .exe aswell.

From MSConfig I can see that the .exe sits in %APPDATA% folder but I am unable to see the .exe when I navigate to the folder in windows explorer. Is it possible the .exe has already been deleted(it may have been a legitimate app that I uninstalled at some point)? Can a .exe that does not exist be shown in MSConfig?

How can I delete the .exe?

Note: I know C++ WinAPI and I have attempted to find the file using FindFirstFileEx();(I'm a Admin User) and also tried open it with CreateFile(); but both say "Cannot find path specified". That could mean that the file doesn't exist but could that also mean that the file permissions are set to FILE_ATTRIBUTE_HIDDEN? I've also tried SetFileAttributes to FILE_ATTRIBUTE_NORMAL but it gives the same error? Any ideas on what I should do to confirm whether the file exists?

I would just run Sysinternal's autoruns, and find the exe file in the list it provides you with. Make sure you run it as an administrator. If the file is marked red it does no longer exist.

You should however note the name of the file and do some research about it. If you have a bad feeling about the file I would also run a virus and malware scanner.


SSL/TLS entity identification Does SSL/TLS contain any form of identification in the initial handshake, so an attacker cannot simply waive the certificate around claiming they are someone else? Wikipedia did not say that it did, but I was wondering if the public key on the server cert is sometimes used for this. Or is this assumed since the the attacker cannot complete the handshake without the private key(and thus cannot complete the key-exchange and generate the symmetric key for authentication like HMAC)?

There is no way to perform identification before the cert is sent, because the whole point of the cert is to establish identity. So if you could establish identity of the server before receiving the cert, what would be the point of validating the cert against the server? This is actually another point, a cert is for a domain, so a client should always check that the domain in the cert matches the domain that it is connecting to. So technically if I try to connect to evil.com over HTTPS and you give me the cert for google.com I shouldn't validate the cert (Though implementations have been known to omit this check!!). And like you said, you could send a cert that is not your own, and the if the client (incorrectly) validates this cert the client then sends a secret encrypted under the public key contained within that cert to the attacker. The attacker is unable to decrypt this data since it does not have the private key. At this point the attacker is unable to derive any symmetric keys from the secret the client sent it (since it cannot decrypt the secret), and as a result is unable to decrypt any traffic sent from the client.


Are RESTful sites safe against CSRF attacks? I am having a debate with a coworker about whether our site is vulnerable to CSRF attacks.  He is saying that since we are using RESTful AJAX requests for everything that CSRF is not possible.  Say a request to update your account info looks something like this:

POST /ajax/account/savebasic HTTP/1.1
Host: www.mysite.com
Connection: keep-alive
Content-Length: 72
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://www.mysite.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.65 Safari/537.36
Content-Type: application/json; charset=UTF-8
Referer: https://www.mysite.com/portal
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: X-Mapping-fjhppofk=B8BFE26CD0B3A37348ECC6FFE3940306; sdemail_5228=tester%40test.com; sd_5228=%7B%7D; connect.sid=s%3AAQIPx7hyddXEYTOuyP857jEG.D002GI6%2FSEF0m5WTBUxRmbjpE48%2BMkPxEe9o2T9DH1Y; __utma=160595647.1524201255.1358783236.1379476052.1379533347.150; __utmb=160595647.1.10.1379533347; __utmc=160595647; __utmz=160595647.1376327581.102.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=http://mysite.com/

{"fname":"abe","lname":"m","company":"comp","email":"abe@test.com"}

I created a test HTML page on testdomain.com like the one below:

    <title>Bad site</title>

Hey!

Thinking that it would overwrite everything, but it redirects a few times and eventually throws a 404 error.  Is my coworker correct in saying that we are safe from CSRF because we use AJAX/REST?

Same-origin policy doesn't allow to JavaScript or similar receive response of sent requests outside your host !

  In computing, the same-origin policy is an important security concept for a number of browser-side programming languages, such as JavaScript. The policy permits scripts running on pages originating from the same site – a combination of scheme, hostname, and port number1 – to access each other's methods and properties with no specific restrictions, but prevents access to most methods and properties across pages on different sites.1 Same-origin policy also applies to XMLHttpRequest and to robots.txt.

Your application is Ajax but it can be vulnerable to CSRF (if you don't check content-type or adding unsafe Same-origin policies).

If you don't check content-type, attacker can send this request with normal form, like this :

<form name="x" action="http://site/index" enctype="text/plain" method="post">
  <input type="hidden" name='{"fname":"abe","lname":"m","company":"comp","email":"abe@test.com","Junk":"' value='Noting"}'>
</form>
<script>document.x.submit();</script>


Is open-sourcing the code of a webapp not recommended? How to find out what programming language a website is built in?

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

And other Qs like these ^ .

Shortly: It would seem that at least in terms of web app development, we want to disclose as little information to the attacker as possible.

Attackers want to determine the platform our web app is running on, but we want to trick them into believing it's a different platform than it actually is;
We are advised to switch debug mode off because detailed exception info might leak portions of the source code of our app (not the platform's);

If we open-source our web app's server code, we willingly hand everyone these very pieces of information that the questions I linked to discuss how to hide; and even more information than that.

It would seem, therefore, that open-sourcing the app is one of the last thing one would want to do.

This is surprising to me because:

Some think open-sourced apps are safer because more friendly eyes may look at the code, looking for exploitable bugs and submitting patches;
Not open-sourcing the app because of aforementioned issues is security through obscurity, which is bad.

However, according to @Mason Wheeler's comment on this site:

  I think that, if even a security tester can't figure out what language the site is built in, that makes it more secure because then no one will know which exploits to try. (Yes, there are occasionally valid use cases for security through obscurity.)

Therefore, is it agreed upon that open-sourcing the server-side code of a web app is a horrible idea?

It's a complex matter because there are several aspects to consider, with pros and cons, and there might not be a definite answer.

The security advantage of open source software is supposed to come from a "law" that Wikipedia calls "Linus's law", which says that "given enough eyeballs, all bugs are shallow". To start with, you'd have to ask yourself how many eyeballs you are going to have. For example, is your project going to be shared, forked, used extensively by lots of users and reviewed by a large community? Or is your software only going to be used on your website and no one else will care about it? Or maybe no one else will be able to reuse it because it doesn't come with a free-software license? In the end there are going to be white-hat eyeballs and black-hat eyeballs, so you need to be willing to accept that on one hand you will get some security improvement from ethical hackers, but on the other hand you will also be attacked by black hats. Will attackers be especially interested in targeting your project, or is it just going to be subject to non-targeted attacks? These are all things you should consider, and it might not be easy to draw a conclusion. It's also worth remembering that in several open source projects there were security vulnerabilities that had been there for a long time despite all the eyeballs of the community (see Linus's law on Wikipedia).

Security by obscurity is another concept that is often misunderstood, because its name makes it sound like it's all about keeping something secret. It's not so. Security through obscurity is when a significant part of your security comes from the secrecy of the methods (the implementation). Here's an example of security by obscurity:

// Login without password if URL has parameter dev=debug
// I'm a stupid dev, so I believe this is secure because nobody knows about it!
// But this source code can't be published or I'll be hacked at once
if ($login_password === $password || $_POST['dev'] === 'debug') {
    login_ok();
}

Anyway, even if your code is correct and you rely on security by design, nothing stops you from using a layer of obfuscation on top of it. That is, keeping the source code private can help you because it will slow down a potential attacker. The important thing to remember is that obscurity is ok and can be considered a great asset only if it's just a layer on top of good design.

In conclusion, I'd say you'd better not publish the source code unless you have a reason to do so (for example because you want your software to be free/libre and you want to create a community around your project). If your only goal is to improve the security of the application, you won't gain anything from just publishing it on GitHub, for example. If you are really worried that your software might contain mistakes and you'd like someone else to help you by providing more "eyeballs", you might consider paying for a professional security audit.


Secure access to a Microsoft Access Database I have a server set up with medical files in a Access database.
I am taking over this job from an existing guy who has vanished, so I don't know all the details of the system.  I can find out specific details as needed.

It is currently set up so that the local area network has access to the database file.  However sometimes the doctor on call might be called out at 2 in the morning and need to check the patient data.

I have two ideas at present:

Use VNC to login to a dedicated computer in the office.
Use Hamachi to simulate having the doctor's computer in the office.

Is there a good reason why either or both of these plans is a a really bad idea?
Is there a good way to do this from inside Access?

If you don't have details of the existing system, using a VPN is likely to be the simplest route. This way you can not only use the required level of authentication (depending on your country this may vary, but accessing patient data usually requires strong authentication, logging etc) but also mean you don't need to alter the existing application.

VNC or Hamachi can be very useful to make it simple for the doctor, but from a security perspective it's the tunnel/VPN that you communicate through which you want to concentrate on.


How to encrypt entire HDD without any password prompts? Before you dismiss this as silly, let me explain :)

The only purpose of this encryption is to make the data inaccessible if the drive breaks down and I want to send it off for warranty replacement. This system needs to be able to boot without my supervision when I'm away - which precludes the use of any passwords. Right now I'm stuck with a drive that I can't warranty-replace, because it's too broken for me to wipe it.

Ideally the encryption would be based on a keyfile stored on the (unencrypted) system drive.

Options I've considered:

TrueCrypt: requires the system disk to be encrypted too before it will agree to auto-mount (which requires the use of a password).
BitLocker: unsupervised decryption impossible without a TPM module. Maybe it's possible with one? But my motherboards don't have TPM anyway.
EFS: almost suitable, but cannot enable for the whole drive and copied files remain encrypted even when copied to a folder with no "encrypt" flag, both of which will be problematic in practice.

The key has to be somewhere other than on the encrypted drive, because logic.

Typically the key is stored in one of three places:

In the user's head (or, since keys are hard to store in a head, a password is stored that can be used to derive the key)
in a TPM module inside the computer
on a removable token, such as a smart card or USB fob

From your description you want option 3, a removable token that you leave with the machine except when you send it off for repair.

However, you might have a bit of trouble finding a product that suits, as yours is a very unusual use case. Lots of software supports removable tokens, but typically they only use it with a password, either to

provide a backup of a password-derived key in case the user forgets the password
provide two-factor authentication, where you need the token in conjunction with a password.


Port forwarding for reverse tcp I am using metasploit to create a payload for Android phone (for educational purposes).

If my target and my computer are on the same network it works fine. But when my target is outside connected to different network, and using a payload with LHOST = "my public IP", how do I forward the port if the router is not accessible to me (college router). Is there any way?

You can't.

I suspect you're behind a NAT, and hence you'll need to port-forward from the NAT to your LAN IP.

The other option is hosting something on AWS/DigitalOcean and get an actual Public IP for your server that you can use as your LHOST.


Mutual TLS and Cert Pinning solving the same problem? To prevent MITM from my app I will use cert pinning.

To prevent having not approved parties communicate to my server I can use Mutal TLS, which actually accepting communication from trusted sources.

Am I am missing something or it sounds the same?

While mutual TLS and certificate pinning are intended for different problems they can be used to solve the specific problem of detecting active MITM too. Only, with mutual TLS it is the server which detects the MITM (client certificate not as expected) while with certificate pinning it is the client (server certificate not as expected).

Implementation requirements are different too:
In case of (server) certificate pinning the clients needs the certificate of the server (or the CA in case of CA pinning). A fingerprint (hash) of the certificate or the public key (more flexible) would be sufficient too. And all clients can share the same information regarding the servers certificate.
With client certificates though each client needs a certificate and the matching private key. Each client should also better have a different certificate with a different key since sharing the same private key between clients makes it way more likely that an attacker gets access to the key. And of course proper revocation and a process to reissue a certificate needs to be installed in case the key from one client is compromised. This makes it way more complex and less scalable than server certificate pinning.

In other words: while both server certificate pinning and client certificates could be used to detect active MITM the use of server certificates is much simpler and scales better. Thus just using client certificates to detect MITM is probably a bad idea, but if they are needed anyway the side effect of protecting against active MITM can be used.


Question regarding browser windows when integrating with 3rd party payment software I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself should redirect to the payment gateway.

Where will I find documentation supporting this claim?
A new page would be totally secure. So is there a reason for this rule rule other than to allow the website to continue with the transaction

Opening a new window or iframe does not change the protections provided by the Same-Origin Policy.  The origin inherit ice rules for iframes prevents two different domains from accessing each-others data.

There is no security or PCI-DSS requirement that would require a redirect from/to a payment gateway.  This maybe a usability requirement mandated by a specific payment gateway.


What is a sequential injection attack? From the Financial Times 26th October 2015 "TalkTalk faces mounting calls for compensation"

  Then, the hackers downloaded customer data using a “sequential injection”. Cyber security experts say this is a well-known technique that is relatively easy to prevent.

What is a sequential injection attack?

TalkTalk almost certainly meant 'SQL injection'. However 'sequential injection' has been repeated across the media. http://www.theregister.co.uk/2015/10/26/talktalk_sequential_attack/

For the curious, this kind of mistake is known as an eggcorn:

  Eggcorns often involve replacing an unfamiliar, archaic, or obscure word with a more common or modern word (eg. "baited breath" for "bated breath").


Is overwriting the entire hard disk (e.g. with `dd`) sufficient to ensure that ransomware has been removed? Appologies if this is the wrong place to ask this question.

I have/had a computer infected with ransomware.  I have just used a linux live cd and used the command dd if=/dev/zero of=/dev/sda bs=1MB to wipe the hard drive (I have backups of my work). When that command completes, it outputs:

dd: error writing '/dev/sda': No space left on device
238476+0 records in
238475+0 records out
250059350016 bytes (250 GB, 233 GiB) copied, 2193.65 s 114 MB/s

Is that enough to ensure the ransomware has been removed, or do I need to look elsewhere too to ensure all traces of it have gone?

The computer was a Windows 7 machine.

Doing this, you wiped all the disk, turning all the data to zero (hopefully).

It does not mean it is safe enough:

Some kind of malware can reside in hardware (barely possible, but still a chance).
Some other can be placed on the MBR, so i would suggest you to wipe it too. Use: dd if=/dev/zero of=/dev/sda bs=512 count=1 (it also deletes the partition table). But you already did.
And stay sure every device attached to this isolated computer is clean too.

Hope this will help.


How to reach a hidden Python function with HTML injection in a web app? I was doing a web app CTF problem which has a web form which is vulnerable to HTML code injection. The goal of the problem is to reach a hidden Python function in that web app. It is a Python based web app but the underlying framework is not known. How can I leverage HTML injection to call the Python function?

Since HTML injection affects the client only but the python function is server side you cannot reach it directly. But your HTML injection might change the requests sent by an authorized user and this way you might cause changes in the execution of the server side application which ultimately leads to the call of the hidden python function. Useful injections are for example changes of existing HTML forms, adding new forms, links or images which all ultimately result in requests to the server as authenticated user (i.e. include the cookie).

Example:

<form action=/do_something>
<form action=/call_hidden_function>  <!-- injected this line -->
...
<input type=hidden name=crsf_protection_token value=...>
<input type=submit value="Submit form">
</form>


OAuth User revoke token I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on:

is this true / is the end-user the one to revoke the token?
can you point me to a tool / code / script or even a discussion on how the end-user could do that?

thanks!

Unlike the resource owner credentials,
     tokens can be issued with a restricted scope and limited lifetime,
     and revoked independently.

from http://tools.ietf.org/html/rfc5849

I guess the RFC has also example, but I did browse it entirely. The oauth site also feature some code, maybe it can help you, http://oauth.net/code/


JSON Web tokens claims. Where do I put a username I am using JWT to verify Users. As a result I need to create a json web token which contains the following information: username, mycompany, and expiration date. In the JWT standard there are reserved claims such as issuer (iss). For my information I was wondering what the best practice is to store my information? I was originally thinking of setting iss = 'mycompany.com', sub = 'myusername', exp = 'whenever', but looking at the documentation from jwt.com (http://jwt.io/introduction/) I see they store the username inside of the payload. Is there reasons for this? If so what are they and would my implementation be wrong then?

sub is just a predefined claim.

As stated in your link, this is for "interoperability". If you do not need to exchange your JWT with other systems, now or in the future then you can use private claims (e.g. name). If you are using sub then all systems that are receiving this token must interpret it the same (that is sub means username and nothing else).

Note that reserved claims are also stored within the payload.