Why aren't telnet bots finishing the three-way handshake? I have a port forwarding rule sending 23 traffic to a "honeypot" (called "comp" below). Throughout the night, many bots from around the world attempted to connect, but there was no service running.

Now, I wrote a C program that just binds to 23, accepts a connection, and exits. When a bot scans, Wireshark shows the following failed handshake for most connection attempts:

bot --> comp (SYN, port 23)
comp --> bot (SYN, ACK)
(sometimes): comp --> bot (TCP retransmission)
             ... (may have several retransmissions)
bot --> comp (RST)    (sometimes happens immediately after the SYN, ACK)

I have seen one successful bot connection, but most attempts result in the above. I know that the program is working because when I telnet with my Android on 4G (i.e. outside the LAN), the normal three-way handshake occurs, followed by an immediate FIN, ACK from my "honeypot", as expected.

Why do many of the bot connection attempts fail? The bots can't possibly tell that it's not a real telnet service before they even finish connecting?

Edit: Also, they sometimes send another SYN immediately after the RST, and then that handshake proceeds successfully.

They are performing port scans, not trying to establish a connection.
This specific scanning technique is called a SYN scan. The idea is that you don't have to complete the entire TCP handshake to find out if a port is open. A SYN scan is often preferred to establishing a full connection because it's faster and less noticeable. From the nmap guide:

SYN scan is the default and most popular scan option for good reasons. It can be performed quickly, scanning thousands of ports per second on a fast network not hampered by restrictive firewalls. It is also relatively unobtrusive and stealthy since it never completes TCP connections. [...]
This technique is often referred to as half-open scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and then wait for a response. A SYN/ACK indicates the port is listening (open), while a RST (reset) is indicative of a non-listener. If no response is received after several retransmissions, the port is marked as filtered.

You can try to reproduce this behavior by attempting a SYN scan yourself using nmap and checking the Wireshark results:
nmap -sS yourhost

The bots can't possibly tell that it's not a real telnet service before they even finish connecting?

Correct, the disadvantage of this technique is that they can't really fingerprint the service. All they know is that the server has accepted a connection at that port.


How shodan takes screenshots? How Shodan takes screenshots from some webcam even if this webcam (IP adress) requires login?

And how can I protect this? I can't have some thing on LAN network, because I need to join to it from far away location.

We do not try to authenticate with webcams at all - not even using default credentials. We are only able to grab an image if the device has no authentication enabled and is public on the Internet.

Source: I wrote the code.


What's the risk of changing permissions of the Security Eventlog registry key to IT operations? Background

Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code:

  EventLog.[WriteEntry][1]("MyBadApp", "This will cause an exception for ASP.NET and non admins", EventLogEntryType.Error, 10);

.. and then not creating an installer that creates the required registry keys for "MyBadApp"

More information

If that is run under Network Service, ASP.NET, WCF, a service account and is using a non-admin account, the following exception will happen ...but who knows if or where it will be logged (Pasting for Google's sake)

System.Security.SecurityException: The source was not found, but some or all event logs could not be searched.  Inaccessible logs: Security.
   at System.Diagnostics.EventLog.FindSourceRegistration(String source, String machineName, Boolean readOnly)
   at System.Diagnostics.EventLog.SourceExists(String source, String machineName)
   at System.Diagnostics.EventLog.VerifyAndCreateSource(String sourceName, String currentMachineName)
   at System.Diagnostics.EventLog.WriteEntry(String message, EventLogEntryType type, Int32 eventID, Int16 category, Byte[] rawData)
   at System.Diagnostics.EventLog.WriteEntry(String source, String message, EventLogEntryType type, Int32 eventID, Int16 category, Byte[] rawData)
   at System.Diagnostics.EventLog.WriteEntry(String source, String message, EventLogEntryType type, Int32 eventID)
   at **YOUR.CUSTOM.BROKEN.CODE.HERE(ResolvedMessageEventSource source, QueuedMessageEventArgs e) in c:\test2\YourProjectHere\Class1.cs:line 116**

 ----  SNIP Possibly more stuff here --
System.Threading._ThreadPoolWaitCallback.PerformWaitCallbackInternal(_ThreadPoolWaitCallback tpWaitCallBack)
   at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback(Object state)
The Zone of the assembly that failed was:
MyComputer

Microsoft is aware of this issue, but it is by design for quick and dirty EventLog access.  Every time WriteEntry is called, the system will enumerate the registry and look for the "Sourcename" the application specified.  If it doesn't exist then it will be created.

The problem is that during enumeration, the Security log is hit,and an exception is thrown.  Developers who don't create an installer, or otherwise create a registry key for "MyBadApp" will fall back on the dynamic event creation will see this issue.

This is by design and affects WriteEntry and less frequently  WriteEvent (WriteEvent developers usually create an installer)

Solution

There are 3 solutions I'm aware of:

Make the application run as Administrator (bad)
Change the permissions on the registry keys
Create an installer that makes the registry key for the application (best solution)

Question

What is the worst that can happen for an application that changes the permissions of the Security Registry key?

Can it read the Security event log?
Can it change or modify entries of the Security event log?
Can it spoof security events that aren't its own?
Can that lead to a DoS?

DO NOT CHANGE PERMISSIONS ON THE SECURITY EVENT LOG.

If you change the permissions on it then any application running as the user with permissions can read it, and possibly write to it if you've given them said permissions. If I recall the registry key uses a SDDL format, and that is very easy to set up incorrectly.

You can't change entries with read or write permissions, unless you have access to the underlying event log file, but that's locked by the system.

Yes it can spoof security events.

It absolutely can lead to a DoS if the log is set up to cause a kernel panic once it's hit it's max size.

In any case, you shouldn't be modifying the registry key directly either. It should be done through WMI or through command line with wevtutil.

An installer (admin user) needs to create the log source before the application runs, or the application needs to dump its events into a predefined source. It's very easy to check if the source exists:

if (EventLog.SourceExists("YourSource")) { /* do your stuff */ }

You can also easily create the source by calling this:

EventLog.CreateEventSource("YourSource", "YourLogName");


Break out of JavaScript data context to perform XSS when backslash and quotes are replaced? Suppose I have a this on my site:

<script> var x = "<? echo unsafe_data; ?>"; </script>

This is obviously vulnerable to XSS. Now suppose I "clean" the unsafe data by replacing \ with \\ and " with \" (in that order). Am I still vulnerable? What payloads could be used to escape from the JavaScript data context and execute code?

How about

</script><script>alert('xss');</script><script>/*

?

JS parser will find the close script, and assume the original code is malformed. HTML parser will see the open script and start a new script block. The rest is just to make the rest of the block ignored.

Note that it doesn't contain any of the characters you're escaping - it shouldn't be affected by your sanitising code.


How to check if my ports are exposed to the internet [Crossposting from SO]
I am trying to make a port scanner in Python and trying to list which all ports are accessible by anyone remotely.
Using the socket.connect_ex package, I was able to check which all ports are open for my local machine to use, but couldn't find a way on how to check what all ports anyone on the internet can access on my machine.

If you want to know what port is accessible from the internet you actually need to try to access the port from some place on the internet. There is no way to do this locally since it is unknown what firewalls, NAT etc might actually block the access.
You can be pretty sure that at most what is accessible from inside the local network is also accessible from the internet. But likely there is much less accessible since most machines are not connected directly to the wild internet but separated from the it using some NAT router or some firewall which implicitly or explicitly restrict what can be accessed.


Clickjacking vulnerability of file attachment downloads? A portion of our system exposes an HTTP file handler that transmits a file to the client provided that authentication and file ID are correct, and no response if not.

The ASP.net server this is hosted on is instructed to add an X-Frame-Options header to all responses, and dutifully does so for standard pages. For whatever reason, it does not do so for this handler.

An automated scan has identified this as a clickjacking vulnerability, though I'm struggling to see why this would be the case. The file is transmitted as Content-Disposition: attachment and so downloads, instead of displaying in the browser in a way which could open up a vulnerability with an overlay over PDF content for example.

Is my gut on this right, that it doesn't represent a vulnerability? Or is there a case I've overlooked? I could, of course, just add the header anyway, though I'm not sure if that's spec-breaking.

My verdict
You can't have clickjacking on static pages as a valid or pertinent vulnerability, it won't hurt me atleast to skip those headers intentionally on static pages like that of attachments unless it's an API endpoint or so.
Professional Advice
Hell yeah it's the false positive and the sole reason why you are advised to go for bug bounty programs for your company and advised against running automated scanner, not even netsparker which costs a few thousand dollars. If you chose the latter option, do teach yourself the basic skills to understand what's a false positive and that these scanners have much lower precision than manual testing techniques.
No it isn't a vulnerability. Clickjacking by industry standards of the day, requires an attacker to be able to exploit it from the point of view of being able to coerce the user into performing a state-changing action in user's context. Judge the fact by Google's BugHunter university which states clickjacking which can have a state-changing impact on user account is only eligible for their VRP.
What's a valid attack scenario like strictly in technical terms?
So let's say attacker can make the frame hidden beneath a button, now makes unknowing user click on that button and this leads to the user deleting all his data and account. Then yes, it's a valid attack vector and is of P4 priority to an average security engineer like me.
Further clarification
Ask yourself again, can it be used for phishing by an attacker or can he accomplish something useful by embedding an attachment within a frame or iframe, can he record the keystrokes of victim user with the help of embedding the attachment in an iframe? Well the straightforward answer to it is no , not.
Further, you can go and read my article https://dzone.com/articles/looking-at-some-practical-examples-of-security-bug on DZone which was distributed to thousands of developers via weekly digest. It must be a good read for you, just ignore the typos their editorial team made.


How secure is a MD5 hash of an 128bit key Apparently, for the Android KeyChain an encrypted master key is stored along the MD5 hash of the unencrypted Key.
How secure is that?
MD5 is known to have collisions, but I guess we can assume with an input space limited to 128bit values no collisions turn up?
But still, given that there is no salt involved, isn't it possible for an powerful attacker to calculate rainbow tables and then instantly break every KeyChain an any Android device he gets his hands on?

Why is the plain MD5 hash of the secret key used to check if the Pincode is valid?

Collisions are not useful in this case.  You need a pre-image attack that can find the correct input that was used to generate the hash.  An alternate input that creates a collision is still not the correct key, and won't decrypt the data.  Finding the correct 128-bit random input is not feasible, even with MD5.


How to use a found USB key safely I found a USB drive while riding the subway and I want to read it to see if I can return it back to it's owner. If I can't find any info on the stick, I'll use it for my own means. Assuming I have a perfect sandbox and I reformat the USB drive, how large is the possibility that my system gets compromised from using this USB drive? I'll leave this question's scope open to the possibility of both software and hardware (hidden memory?) methods of attack.

It is possible for USB drives to have firmware-embedded malware, see this BadUSB article which shows the research. There would be no way to get rid of firmware-embedded malware, formatting would have no effect on it at all. However, it's pretty new, and therefore very, very unlikely that you would run into it. It's probably something someone dropped by accident, although found devices can have deliberately installed malware on them for the unsuspecting. These can be targeted on individuals (drop it by a CFO's car door) or companies (strew them around a coffee shop or company car park) or at random (drop them on the floor of the downtown bound 2 train).

Assuming your perfect sandbox you could examine the content and reformat it with almost certain safety. That perfect sandbox doesn't really exist though, so it would make sense to boot a virtual system from read-only and save nothing from the session.


Identity and Access Management (IAM/IdAM) deployment guide I'm working on a set of applications that require authentication and authorization.

Can you point me in the right direction to some architecture design for this when I want to have multiple services running and how to exactly manage service to service authentication and user to service authentication as well?

I will probably do all this through OAuth2 etc, but I'm not sure what's the proper way of deploying this.

Hopefully this helps.

Identity Management Systems

Identity Management System are often defined by trusted sources. These are the systems we rely on for a source of record for an individual. These are not really a single piece but a combination of systems designed to manage people.

Identity Data Trusted Source

This is data of people, typically found in your HR systems. They are wide ranging, and can be as simple as AD for a small organisation.

Authorization/Authentication Trusted Source

This is a system or systems which your organization uses for AAA. In many organizations, that is just Microsoft's Active Directory, however, there are several directory based services out there and larger organizations can have systems split into different sources.

Single Sign On

Most organizations that uses SSO within the organization likely uses some sort of Federated Identity Service which allows users to have a single ID across multiple AAA systems.

Modern Federated Services allow for both SAML and OAuth 2.0 communications. If you want to be technical, OAuth isn't targeted at Authentication, it's Authorization. It does provide a mechanism for Authentication Exchange, but that's not its intent.

SAML is on built for both, and is typical for Enterprise SSO services.

If these are custom applications, one standard I have added to my development work is JWT (JSON Web Tokens) which is not really SSO per-se, but more of a mechanism to enable SSO features in modern applications, but it can handle both Authentication and Authorization.

Common IDM systems Examples

Oracle Identity Manager (Link)
Sailpoint IdentityIQ Link

I work with both these systems. I have many reservations about them. Sailpoint is more modern, Oracle is, well, Oracle (Lots of ups/ LOTS of downs). I always think I could build a better one (which I might attempt for fun one day).

Do it yourself setups

Understand that IDM/IAM/IdAM (Or whatever abbr you want) are designed to provide a common set of administrative functions around people and access to resources. This includes being a central repository for identity access, role management, policy deployment, and provisioning/de-provisioning of resources. Wiki for reference.

Your actual goal sounds less like IDM and more like resource management, I.E something that is not achieved by these system specifically. A few things:

You need to identify which systems are going to allow to authenticate and/or authorize resources.
You should have a policy around future apps about their ability to authenticate to those systems.

I think you may want to start with Federated Services and research them. This will give you an understanding of what their purpose is. Most organizations looking at SSO at scale, are looking to Federated Services to simplify thing.

This is where the term Microsoft shop comes into play, so mentioned because all their apps are MS and can authenticate to AD. I've never been to an organization that had this but, kudos if you have that simplicity.


Is it ever safe to skip server-side validations? I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/.

I am well aware that client-side validations can be bypassed, but I have currently not bothered to implement server-side validations as they are much more painful to implement and require procedural logic in the html and so on.

My reasoning is that there is actually nothing here that requires server-side validations, no file uploads or data of great importance that absolutely must be correct. If the user gives the incorrect email address then they will never receive their confirmation email, if there name is incorrect that is insignificant, and so on.

The only reason client side validations would be bypassed if the user chooses to disable javascript in which case a noscript tag can be used to tell them that the app will not work without javascript.

Are there security problems with what I am doing?

The short answer is yes, you should always implement server side validations to prevent attacks. You can never trust client side applications as anything that is installed locally can be subverted by an attacker. They can also see what you are checking for, which gives them even more information with which to attack your server.

Many exploits target vulnerabilities in the underlying operating systems or supporting services, for example buffer overflows, SQL injections, and many others. Server side checks are the only way you have to prevent these types of flaws from being exploited, by verifying that input is within limits and is in the format expected. Without checks (and log messages warning on suspect inputs) you won't have any warning that someone is targeting your system, you could get hacked and never know it.

Even if you are never targeted servers side checks add another level of assurance, if you or someone else makes a change to the client side application which breaks something then server side checks can save you a huge amount of cleanup. It's well worth your time.


How do I clear cached credentials from my Windows Profile? Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.

How can I backup and purge this data?

The utility to delete cached credentials is hard to find.  It stores both certificate data and also user passwords.

Open a command prompt, or enter the following in the run command

 rundll32.exe keymgr.dll,KRShowKeyMgr

Windows 7 makes this easier by creating an icon in the control panel called "Credential manager"


Is it really possible to install spyware on a cell phone without having access to it? A friend is concerned their phone may have spyware on it.  A quick search on the web returns a lot of results for software/apps that you can buy to spy on someone's cell.  Based on researching this topic and various software, it's my belief you do need access to the cell for any spyware to work.  My friend disagrees.

I'm not trying to start a debate; I'm sincerely interested in hearing from a community that has security experts.  I would like to allay my friend's fears.  Please let me know if I posted this in the wrong stackexchange.

I'm not an expert either so I can only give generalities.

Installing a spyware remotely is likely much harder than with physical access to the phone. In the latter case, you're totally screwed : physical access is total access.

If the phone is away, the only option would be to break into it, using an OS vulnerability. It's totally possible as no system is totally secure, but these usually require an action from the user, therefore good security practices will most likely prevent this.

Namely, ignore any link or attachment coming from emails, or unknown or obviously hacked phone numbers/social media accounts/messaging service accounts : these can try to exploit vulnerabilities in your browser or in other parts of the OS.

Emails are easy to spoof, SMS likely harder, but I wouldn't trust them either ; social medias are usually better secured but client vulnerabilities, weak passwords or social engineering can allow someone to break into accounts anyway. Therefore, if you have a doubt, stay safe.

A more worrying problem is the lack of software updates. Most Android phones have outdated Android versions because the manufacturer doesn't care. You don't have a lot of options here : choose a model that's regularly updated like Google's Nexus/Pixel lines, or use an iPhone, as Apple typically updates its devices pretty quickly and supports them for years.

Also, forget jailbreaking, and stick to well-known apps in Google's or Apple's application stores. These are well reviewed and very likely not malicious.

TL;DR It's possible and been seen before, but usually requires user mistakes, and good practices can likely prevent it.


Are sqlcmd parameters inherently at risk of SQL injection? The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx

If an attacker controls the variables, is there a way of writing the scripts so that they won't be vulnerable to SQL injection or is this inherently insecure in that situation?

If the attacker controls SQLCMD inputs, then they can do anything their login credentials (authorized or stolen) can do.  That's just normal functioning.

Don't do this.  This is a bad practice if there's any input from the outside going into your SQLCMD.

If you insist on this, then if you want to use SQLCMD with parameter substitution from environment variables (perhaps), you probably want to experiment with credentials that can only EXECUTE within a certain, limited schema

CREATE SCHEMA FromSqlCmd AUTHORIZATION myuser

GRANT EXECUTE ON SCHEMA::[FromSqlCmd] TO [myschema_execute];

Within each stored procedure, NEVER concatenate what's passed in to dynamic SQL.

NEVER put the results into a table without a whitelist; otherwise you're opening yourself up for second order sql injection.

If you're consider Powershell, then cjsommer.com has an article about this - he found that neither powershell SQLPS command protected against injection, even with parameters.

It's worse than that

If you actually let input - validated or not - from others be part of your command line for SQLCMD, then you're opening yourself up for command line injection!!!  The & character is one way for a command prompt to run multiple commands; try it with

C: & cd \ & format /? & del /?

Now imagine this in the middle of your sqlcmd.

Also note that Powershell uses ; to separate commands.


PayPal "Confirm your email address" spam emails? I got 3 different mails within 10 hours I got 2 emails within 12 hours containing the following:

  Confirm your email address Hello [Name] [Name],

  Confirm your email address now to let us know it really belongs to
  you.

  Once that's done, you're ready to receive money.

  If you are unable to click the button below to confirm your email,
  please follow this link https://www.paypal.com/us/ece/?cn=17526xx55
  [button]Confirm your email[/button]

  Thanks,

  PayPal

I added the pseudo-markup for the button and the placeholders for the names. Both mails are addressed to different names and both names are very american-sounding.

I use an email address which is publicly available. As I maintain contact with a very low-skilled user base I cannot "encrypt" my address with "[at]" instead of @ or "dot" instead of ".". I receive a lot of spam on a daily basis but the very most of that gets filtered by gmail's spam filter. However, the mails I received from PayPal look very legit so I suppose someone wants to make money by linking his account to a wrong person. Does it work like that?

I wouldn't mind if it was a single mail because it might be someone who still had my email in his clipboard, but experiencing this 2 times within a day seems very strange to me.

I would be glad if anyone knew more about this.

PS: sorry if that's the wrong board for that but I wasn't sure where else to ask.

UPDATE: I now got the third mail, 14 minutes after I asked the question. Again, an exceptionally stereotypical name. As I am pretty sure I don't harm any real person here, here the names:

Kelsey Boldin
Byron Maddux
Priscilla Wakeford

Should I post any RAW data of the mails? The links are actually pointing to https://paypal.com/... I think I am either getting trolled or scammed here

These are likely to be authentic emails, what's most probable is that someone is trying to open a paypal account using your details. While it's hard to say for sure what's most likely is that the same person or people tried to use your email twice. It didn't work the first time, so they tried again. It's impossible to say for sure without more data.


Mac sending hundreds of packets to gateway I've got a user on my work network who brings her personal laptop (macbook) in for work.  They've been having some horrendously slow network issues on everything past that hub, so I did some packet sniffing and log checking on my firewall.

I'm showing hundreds (probably moving towards thousands now) of packets sent from her computer to the gateway/firewall (watchguard firebox).  The packets all have the same source port - 10101 - and seem to be incrementing their destination port by 25 each time.

The user certainly isn't techy enough to have intentionally started any sort of port scanner, which leads me to believe there is either something buggy on her computer, or there is some sort of malware trying to poke holes in my network.  Does anyone have some ideas about what might be causing this sort of network traffic?  Should I be worried about it?

For reference, here is what the log strings look like from my firewall interface:

2011-11-16 08:03:01 Deny 192.2.40.144 192.2.40.1 10101/tcp 63416 10101 1-PACNT Firebox Denied 64 64 (Unhandled Internal Packet-00)  proc_id="firewall" rc="101" tcp_info="offset 11 S 293987549 win 192"    Traffic

As of now, the destination port (63416) has incremented from 58300 to 63416.

Update 1:  Got some help in chat that suggests this may be a trojan sitting on her parallels install.  Link: http://chat.stackexchange.com/transcript/message/2445373#2445373

Short and simple:

The symptoms that you described fits myscan, read about it here (search for 10101).

You should run a bot-scanning tool and mitigate it.


How can I recover encrypted files after system reinstallation I had a file which contains images and videos, I was using the windows 7 ultimate and I had encrypted the file. Now I have copied that file to my hard disk and format that operating system and again. I installed a fresh copy of operating system windows7 ultimate, now when I want to see my file which I had saved in hard disk, file is not opening and generate some permission issues.

How can I recover my data?

Do you have a copy of the key?

http://windows.microsoft.com/en-US/windows7/Recover-encrypted-files-or-folders

Connect the drive that contains the encrypted file.
Connect the drive that contains the backed-up certificate and key.
Start certmgr.msc
Import the certificate

You should now have access to the files.

http://technet.microsoft.com/en-us/library/bb457020.aspx


Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config? I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?

Ultimately, blacklists don't work: it would be a vain endeavour to try to find all ways by which a root-equivalent user could alter the contents of /etc/ssh/sshd_config and try to fix them all. For instance, a lot of commands can output some data in a file whose name is provided as parameter -- that could be used to alter /etc/ssh/sshd_config.

Instead, use whitelists: explicitly allow sudoers to run an explicit, small sets of commands (e.g. a command to trigger a reboot, if that is relevant to your situation), and all others must be forbidden.

Alternatively, use SELinux to constrain sudoers into a not-exactly-root role and get /etc/ssh/sshd_config out of their reach. But this may involve some considerable configuration work (SELinux seems to be up to the task, but I have not tried it, so I do not guarantee success here). Also, be aware that the power of nuisance of a rogue root user tends to be pervasive: there are many many ways by which such a user can harm your security. It seems better to just not trust evil people with sudo powers. Or maybe some more comprehensive isolation layer would be warranted: instead of having several users in a single machine, with some semi-administrative powers, give a virtual machine to each user, that he may play with at will without impacting the other users. Depending on your context, this may or may not be applicable.


How to sniff VPN traffic using Snort? Here's what I want to do:

I want to use a VPN client on my PC (like TunnelBear).
Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN.

So basically I want Snort to sit between my OS and the VPN.
So Snort should sniff outgoing traffic before it's encrypted by VPN and should sniff incoming traffic after it's decrypted by VPN.

How can I do this?

Steffen Ullrich has the correct answer. Snort is a program on your computer. The program looks at traffic on a network interface. The traffic is 'exiting' at your machine, from the VPN. The Snort program can see this traffic as it exits, as it has been decrypted. The command that Steffen posted is telling snort to look at traffic on an interface called 'tun0'. The interface may otherwise be named 'tap0' or similar, depending on VPN used.


Is there some type of x-ray that can see through HSM or shielded integrated circuit? I know that security-oriented products can easily protect their contents from even the most sensitive commercial x-rays, which can see objects at about 0.5µm. But let's put cost limits aside (or imagine that we have State-level resources), and think about theoretical limits.

Is there some known theoretical physics knowledge that when applied, would allow a State-sponsored organization to create an X-Ray that is capable of seeing through security devices, such as smartcards, shielded integrated circuits or even a Hardware Security Module?

Examples would be a device that uses gamma rays (which has a much smaller wavelength than conventional x-rays) or even some exotic device such as a neutrino detector (it's well known that neutrinos can pass through entire planet with low probability of interacting with any atom - can that be leveraged to bypass the device shield?).

X-rays lack the spatial resolution to see objects of the size required to visually map out a modern integrated circuit. Gamma rays are too energetic to be focused by any sort of lens, so they can't really be used to see through anything. Neutrinos are even more ghostly. Chances are, not a single neutrino has ever actually collided with a particle in an HSM in its entire lifetime.

Leaving aside the physics aspect of this question, I need to point out that you are assuming that being able to see the internals of the device would be a security risk. This assumption is false. At most, being able to see the internals of an HSM would reveal trade secrets. It would not necessarily reveal anything stored digitally. While I believe a charged NAND cell can be identified with extremely high-powered microscopy in a chip-off situation, anything that is capable of seeing through the IC itself, including X-ray microscopes, will likely not have nearly sufficient resolution.

This is all rendered irrelevant as modern HSMs will typically not be heavily-obfuscated internally, but they will be shielded from many sources of electromagnetic radiation. While this shielding is typically designed to frustrate fault attacks, it will still manage to block an X-ray microscope. As such, it would be necessary to perform chip-off forensics against the HSM, which is quite difficult.


stdin does not wait for next input after ROP chain I was trying to exploit a vulnerability in a ctf but I can not make fgets() reopen stdin to put my second stage ROP chain.  I am using pwntool but the problem is more socket oriented.

I recreated the above situation. In a test program. The concept is simple.
After overflowing the rip I return to main in order to  give/change the input.
The problem arises when pwntools/bash  etc closes the second stdin.

Locally I can overcome the problem doing something like:

cat <(cat myinput.txt) - | ./test.txt

But how can I do this in a socket ?
Using pwntools.interactive solves the problem but I want to send non printable characters.
Here are some example screenshots of my ./test program

int main (){
    char mastr[150];
    printf("lol\n");

    fflush(stdout);
    fflush(stdin);
    fgets(&mastr,600,stdin);
    puts(mastr);

    return 0;
}

With pwntools.interactive()

Without pwntools.interactive()

What is the theory behind sockets and stdin ? I really do not know the correct terms to search it.

A note on fgets(): This is what I observed stepping through the debugger.  When piped data is sent to fgets() it's buffered on the heap, then it's transferred to the stack one by one until

A compare instruction returns true on a counter and the value that's passed in the RSI register to the fgets() function; which is the string length specified by the programmer.
Or receipt of an 0x0a byte ("\n")

Once either of those are met, the function exits and STDIN is torn down. So it's buffered I/O and not actual I/O to a file descriptor that's used to communicate with the OS.

Anyways, to manage stdin like you're doing there with bash in Python, you can use Subprocess's Popen function to connect directly to the service, but there's a catch.  Python blocks SIGPIPE by default, which prevents keeping the fd open for writing.  You can overcome this using the signals module and creating a patch function that overrides Subprocesses configuration to allow SIGPIP:

import signals
def restore_signals():
    signals = ('SIGPIPE', 'SIGXFZ', 'SIGXFSZ')
    for sig in signals:
        if hasattr(signal, sig):
            signal.signal(getattr(signal, sig), signal.SIG_DFL)

Then, call your program directly (without piping) via a Subproccess shell passing the SIGPIP patch through preexec_fn arg.  I also specified bash as the shell I wanted to use, but it's not required:

myproc = Popen("./test",
                stdin=PIPE,
                stdout=PIPE,
                shell=True,
                executable='/bin/bash',
                preexec_fn=**restore_signals()**)

This will keep a pipe open and you'll just have to manually close it.  I assume from an exploit dev standpoint, it won't really matter for you.

To send data, don't use the .communicate() method.  You'll have to manually manage the connection sending your shellcode bytes like so:

#prep the receive buffer by clearing it first
myproc.stdout.flush()

#Send your shellcode where shellcode is a var holding your shellcode
myproc.stdin.write(shellcode+"\n")

Note the "\n" to simulate enter so fgets() knows to end the buffer.

Then, to read output, you probably won't want to use the .readline() method unless you know the output (like a banner) will end with a newline byte (0x0a / '\n').  You'll have to manually manage it using the .read() method.

The thing with .read() is you'll need to have some sense of the data that is returned.  So if you're expecting a return of something like a memory leak or string and know the size, you're going to want to specify that so your script doesn't block while waiting for more data. I can't remember what the default buffer size on read is, but it won't return until that buffer is filled. .readline() will return on a 0x0a byte.  So, if you're expecting a 10 byte string:

 #sleep 1 second after your shellcode send to give the process time
time.sleep(1)
output = myproc.stdout.read(10)

Keep in mind that if you're sending multiple lines, you're going to want to flush() the stdout buffer each time, or your response will read 10 bytes from the previously received data.

Repeat as necessary. Hope that helps.


Is there any reason to not show users incorrectly entered passwords after a successful login? Our client has come up with the requirement that in case the username in question has had multiple failed login attempts, the incorrectly entered password(s) must be shown once a successful login is performed. Correctly entered information, including previous passwords, will not be shown in any case.

Our lead dev has told us it is technically possible by not hashing incorrect entries, but she is extremely uncomfortable with the feature and thus it has been put on hold while we brainstorm it out.

The website in question is a broad mapping/GIS application that does not feature any monetary transactions whatsoever. Other login/authentication options include Google/LinkedIn/Twitter/facebook, so obviously no passwords to be stored there and handling that is primarily a UX issue.

What security vulnerabilities come with implementing such a feature? Our client is not entirely without technical knowledge so a general explanation is enough.

My apologies if the question is too broad or the answer very obvious.

The primary issue is that incorrect passwords have to be stored in a way that allows them to be later displayed to users.  Which, as your dev pointed out, means they can't be cryptographically hashed first.  The result is that you store them either as plaintext (bad) or encrypted (better but not normally recommended).

The biggest risk is if this database of invalid passwords becomes accessible to attackers.  Either they compromise the server, perform SQL injection, or retrieve it in some other way.  Rather than cracking the primary passwords, which hopefully are strongly hashed and therefore tougher targets, they could decide to compromise accounts using the information in the invalid password history.  Either they access the plaintext passwords easily, or they attempt to find the encryption key that allows them to decrypt back to plaintext passwords.

A common source of login failures is minor typos during the password entry process.  So my password is Muffins16 but I type in mUFFINS16 because my caps lock is on.  Or Muffins166 because I hit the same key twice.  Or Muffina16 because my finger hit the wrong key.  As you can see these variations are close enough to the original that attackers can probably determine the valid password from invalid passwords by trying a few minor alterations or comparing wrong passwords to likely dictionary words or names.

This problem is exacerbated because most people use password choices similar to these formats and not random strings.  It is harder for an attacker to identify the typo if your invalid password is V8Az$p4/fA, although still much easier to try variations of that then guessing it without any info.

Another risk is that users may not remember which of their passwords they used on this site so they try their common ones.  Now this site is suddently a bigger target because an attacker might be able to not only compromise a user's account there but also on other sites with the handy list of 'invalid' passwords.

You can mitigate some of these risks by wiping storage of invalid passwords immediately after display following a valid login.  That should limit the window of opportunity for an attacker to access and benefit from the data.

The question you should probably ask your client is how they predict users will benefit from seeing their invalid passwords.  Is it so users can identify how they mistyped their password?  Typos aren't intentional so it's not likely that showing them their mistake will improve future login attempts.  So users can identify an attacker trying to guess their passwords?  Similar feedback can be provided by listing date, time, IP/geolocation or other info for invalid attempts without the attempted password.  So users know that they screwed up during password entry and don't blame the site's login system?  This seems like the only one with merit and I'm not sure it provides enough value to justify the risk.

My guess is that once you better understand what they're trying to accomplish with this feature you can probably suggest more secure alternatives.


How to redefine the maximum number of decoys in a nmap scan? I want to do a scan with a high number of decoys, I am using the following command

nmap -D RND:252 xxx.xxx.xxx.xxx

But it gives the following message

You are only allowed 128 decoys (if you need more redefine MAX_DECOYS in nmap.h)
QUITTING!

I haven't found that file anywhere and a internet search did not return anything helpful

nmap.h is a header file. You will find the default nmap.h in the github repo.

To change the maximum number of decoys you need to compile and install from source code. If you already have done, you can just go to the directory with the source code, edit nmap.h, then compile and you're done.

If you installed a package you will need to get the source code from https://nmap.org/download.html You can then either remove the package or install the latest one alongside the package by passing the --prefix option to configure and install it where it will not get in your way. nmap compilation and installation has been pretty painless for me. On FreeBSD the only dependencies are gnupg (To verify the tarball) and gmake (for building nmap). On Linux I believe you just need a build environment, on Debian the package build-essential should be all you need.

There is a book on nmap with a lot of good information. Here is the chapter on compilation and installation https://nmap.org/book/inst-source.html


Use local admin or domain admin to raise privileges on a machine for administrative purposes? By now I would hope that, unless there were extenuating circumstances, all users (including administrative users) use a low-level account for their daily activities and raise their permissions to perform administrative tasks.

Obviously domain-based tasks need to utilize a domain account, but software & driver installation can be done via local admin.

In thinking in terms of preventing lateral movement through a network, is elevating to a domain or local account the safest option?

Risk

Two attack vectors to keep in mind here:

If an attacker compromises the Local Admin account and it uses a common password with other systems in the environment -it's a security risk because of credential sharing.
If a user elevates to a Domain Admin account, his credentials are available in plaintext (during his logged on session) and available in a cached form thereafter. Note: The cached credentials may or may not be available, but they are enabled by default in Windows and store 10 of the last logged-in users. So the security risk here is that if DA credentials are compromised the lateral movement involves the entire domain.

Solution

You know the saying about opinions... (insert cliché here), but here is my recommendation to clients.

Randomize the local admin password for all systems in the domain (research Microsoft LAPS for more info), and even systems not in the domain.
Use the local admin for system-level changes (patching, updating, installing, etc)
Set Domain Admin accounts to only be able to logon to Domain Controllers to reduce the risk of leaving credentials in the environment.
Optionally, create a "Power IT User" for admin tasks on servers within the environment that is not a domain admin, if users balk about needing to login as a local admin every time. Be sure to disable cached credentials, and make sure users logoff when finished.


Could a user never store a password if a username/email hash was used instead? So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me:

Could we strengthen web security by hashing username/password with javascript before sending it to the server?

Obviously we should always use SSL, but even SSL is vulnerable to MITM attacks, wouldn't it be safer if, instead of a password, web servers stored a hash of the username and password, so that even if a user's login hash was recovered, it would only work on one website. Right?

Because lets say that joe shmoe has his gmail account, with a username of mrjoeshmoe1996@thegmail.com and a password of joeshmoe. Now Mr. Shmoe signs up with mylazywebsite.com which doesn't use SSL, using the same password as his gmail account, now his whole online identity has been compromised.

If the protocol you use is vulnerable to Man-in-the-Middle attacks, then you lose anyway, regardless of how much hashing you apply: the MitM attacker can just wait for your authentication to be performed, and then hijacks the connection at that point. I must say, though, that SSL is NOT vulnerable to MitM, as long as nobody does anything stupid (for instance, looking at a big red warning from the browser which says "this server uses an invalid certificate" and clicking "shuddup I want to connect anyway" is "something stupid").

So we are talking about a user who did something bad enough to breach SSL; and the same user also reused the same password on several sites. Unfortunately, there are many users who do such things. Your proposal suffers from two main issues:

Password storage should use password hashing, with salts and slowness. A large number of iterations is applied, so that an attacker who could dump the server's database still suffers a lot when trying to crack the passwords. But in your case, this hashing MUST necessarily occur on the client side, in Javascript. Javascript is far (very far) from having enough muscle to do that. This would imply dividing the iteration count by at least 10 (probably more) so that login time remains tolerable, thus dividing by at least 10 security against an offline dictionary attack.
Javascript. The code which does the hashing has just been served by the server itself, over the connection that we assumed to be under a MitM attack. Such an attacker can modify this Javascript at will. Namely, he can add a tiny bit of extra Javascript which also sends the login and password (as entered by the user) to his own evil server.

The second point makes the discussion moot: if an attacker can run a successful MitM, then he can grab the password from the source, i.e. the entry field in the Web page, and no amount of Javascript can change anything to that.


How do clients enroll using SRP? From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as a new user how does this work? I can only imagine 3 scenarios none of which seem to be great:

1) Client sends password to server on enrollment so that the server can calculate the verifier for future authentication. Password is vulnerable over the wire.

2) Client calculates verifier locally and sends verifier over the network. Verifier is vulnerable over the wire and could be subjected to a dictionary attack.

3) Client enrolls using SSL and a Certificate Authority. This eliminates the benefit of not requiring a CA.

None of those options are great, although (1) is the worst. The bottom line is that SRP is a fantastic idea, but it's difficult to see how to deploy it. Especially as browser support is patchy - beta quality plugins for a handful of browsers.

If you want to make a practical working site now, use (3).

You could, in theory, use (2) over SSL with anonymous Diffie-Hellman so there's no CA. In that case, on your first exchange, you don't know who you're talking to. But in the future you at least are sure that it's the same site. So perhaps you sign up at first with no trust in the site, build up trust over time, and have the confidence that an attacker couldn't then impersonate the site you now trust.

It does raise some broader issues of trust and how you transact online. A lot of consumers like the model of "I know Amazon are trustworthly, I want to use them" and the existing CA model matches that quite well. If you're more into peer-to-peer, non-hierarchical arrangements, then how do you establish trust online?

Your question only covers online registration - if you have another arrangement, such as in-person registration, you may have better options.


guidelines for password managers I use Lastpass and I'm testing out other password managers in order to set policy for organizational use.  Depending on settings, I've found that these programs can automatically send your password out to unexpected places.  For example:

Password Safe:  The "browse to URL and autotype" feature of Password safe opens the default browser, enters username and password and generates a carriage return! In IE and Chrome, this results in a web search with my password as the search term, broadcasting my password to an unexpected place.

LastPass:  Lastpass sometimes has trouble differentiating between "hr.company.com" and "testing-apps.hr.company.com".  I enabled auto-login for hr.company.com. Lastpass then tried to auto-login to testing.hr.company.com and failed.  Since we are testing, this generated a log file entry containing my credentials for hr.company.com.   Forced me to quickly change my password and re-evaluate my use of auto-login settings.

My question is this:  These can't be the only examples of unsafe use of password managers.  What other gotchas are out there?  Can anyone recommend guidelines for safe use of password managers in an organization?

The hostnames hr.company.com and testing-apps.hr.company.com will not cause proper browser security model segregation - it is possible for hr.company.com to set cookies than can be read by testing-apps.hr.company.com and testing-apps.hr.company.com will be able to set cookies on the hr.company.com domain. So you have to trust both hr.company.com and testing-apps.hr.company.com in order to use either, so it could be argued that LastPass accidentally completing the password details on one application is not that big of a flaw - the testing environment should be on a completely separate domain to prevent any vulnerabilities found from exposing the live domain. Additionally, passwords should never be stored in log files so while it could be considered a small bug (maybe it should prompt before filling a form on a different subdomain), it is not a huge security weakness in itself - the underlying web application needs to be trusted, which includes considering the browser security model. It could be that testing-apps.hr.company.com is only available internally. however this could allow a local attacker to compromise another employee's live account using a flaw on the test version.

In this case you can make this particular password manager more secure by configuration. e.g. disabling auto fill, and there is also an option in settings called URL Rules. Here you can set whether the hostname has to be an exact match. You cannot stop people using software in an insecure fashion, you can only guide and educate them, as you have pointed out.

  My question is this: These can't be the only examples of unsafe use of password managers. What other gotchas are out there? Can anyone recommend guidelines for safe use of password managers in an organization?

There will be flaws in all applications, whether at enterprise level or not. The advantage of browser based password managers is that is can protect against phishing attacks. The URL is validated and as default only the credentials saved for that URL will be completed. If this is something you want to protect against then you will pretty much need to use a browser based password manager. If using something browser based is too much of a risk then you can use a separate application, but you must accept that an unwitting user may accidentally log into a wrong website, whether a malicious one or not, potentially exposing their login credentials to a 3rd party.

The specific guidelines will differ depending on the software used and how passwords are used within the organisation, as well as the organisation itself. For example. does the organisation trust the cloud, or is everything done in house? Storing password data on trusted internal servers might be better, however the organisation is then taking on the extra work of making sure the infrastructure is properly secured and ensuring that the data is properly encrypted and encryption keys are securely stored.


Should I recreate Git tags after revoking a signing key? Let's say my signing key has been compromised and I have to revoke it.

What happens to the changesets and tags already signed? Should I rewrite them with the new signing key?

What happens to the changesets and tags already signed?

Nothing will happen to them - they remain signed, but with the revoked key.
Revoked keys stay on keyservers (and on people's disks, if they have a local copy), so the signature can still be verified.

  Should I rewrite them with the new signing key?

That depends on what you want to achieve, but probably yes. The whole point of signing tags is to certify "I (rather: the onwer of the private key) really created this tag."

By revoking your key you are effectively saying: "Don't trust any signatures with this key, they may be forged." So if you want to give users of your repository a way to verify the authenticity of tags, you should re-sign them.

Technical note:

You cannot re-sign a tag in Git, because the signature is an integral part of the (signed) tag. For details see for example Can I sign a git tag after it was created? on stackoverflow.com.

You will have to create a new tag, and sign it with your new key. Also note the general caveats about changing/replacing tags: You will either have to create the tag with a new name, or replace the existing tag. If you do the latter, people who previously fetched the old tags will have to manually delete them, otherwise they will not get the new tags.


Enterprise Anti-virus for Linux? I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud vSphere environment but it looks like a solution at the hypervisor level would not be available anyway since those anti-malware vendors that do offer a hypervisor solution leverage the vShield Endpoint Thin Agent and it only supports Windows guests.

So for the most part this means running an agent on the Linux server/guest. Here the vendors (e.g. Trend Micro) will list supported kernel versions. The problem here is that the supported versions will be older kernels that have had Important Security Advisories issued by Red Hat and we don't want to address one security concern by potentially increasing our risk elsewhere.

We have deployed IPS as a mitigating measure and harden our servers as well as submit our application to third-party penetration testing but we are required to deploy an anti-virus solution.

Note that on-demand scanning is inadequate. We are looking for an enterprise solution that provides on-access scanning, isn't dependent on kernel versions and updates to all servers can be automated (via an administrative/management interface that preferably runs on Linux as well).

McAfee's VirusScan Enterprise for Linux on the face of it looks like it isn't dependent on kernel versions. Their datasheet states the following:

  Kernel module versioning—On-access scanning
  on new kernels without the need to recompile
  modules saves you time and effort when rolling
  out new Linux kernels.

and:

  Runtime kernel module—Automatically supports
  the latest distribution, saving both time and effort.
  On-access scanning without kernel modules
  for kernels 2.6.38 with fanotify ensures Linux is
  always protected even after kernel updates.

But the latest version of McAfee's VirusScan Enterprise for Linux (2.0.0) doesn't even support RHEL!

What enterprise anti-virus solution doesn't support RHEL?!

What is a well-meaning sysadmin to do?

I've already answered this question a few times here. Have a look at this answer in particular:
Virus scanner on server
And in particular this part:

The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. Servers don't (or shouldn't) allow reading emails and browsing websites. Instead, attacks against servers are fully automated; no human required. They call that a "worm" rather than a "virus".
Worms are a concern on Linux. But protecting your server from that type of threat works differently. Protecting users from viruses requires something stopping users from doing things they shouldn't. Hence the "anti-virus". But protecting servers from worms and similar exploits involves fixing vulnerable software. If something is exploitable on your server, then the thing needs to be fixed.

A virus scanner watches files to see if they will hurt you if you run them. That's not a concern on servers because the only programs you're ever going to run are already there. As a rule, you're not downloading and running new programs on servers the way you do on desktops.
Assuming Linux is running as a server, (which RHEL pretty much always is) Running an anti-virus is the wrong kind of protection. It protects you against threats that can't hurt you, while ignoring the threats that can. This is why RHEL doesn't offer antivirus integration. Because Redhat understands server security.
This has nothing to do with how popular Linux is or whether virus writers will target it, as commonly argued. This has to do with how the server is used. There is no user browsing email in Outlook, or download flash movies and running them. So preventing dangerous user activity is not a valuable solution.
If your QSA is demanding you run an anti-virus on your Linux server, then you need a different QSA. This one hasn't a clue.


OpenSSL generates 1032bits when I request 1024bits When I enter the command-line openssl dhparam -text 1024 the resulting safe-prime is 1032 bits instead of 1024 bits. It seems like the 1st byte is always 0. Why is this?

Try this:

openssl genrsa | openssl rsa -text

Look at each of the fields; the primes, the exponents, all of them. Now try again, and again, and again. You'll notice some inconsistency as to whether an initial zero byte is present. Sometimes it is, sometimes it's not. The pattern is this: if the first bit of the first "real" byte is set -- that is, if the first hex character is less than 8 -- then there won't be an initial zero displayed (or stored), but if it's 8 or higher, then a zero byte will be prepended.

This makes it pretty clear that the problem they're solving is sign interpretation. With signed values, the first bit is the sign of the number; adding an initial zero removes any ambiguity.

To see what's actually stored (not displayed) look at this:

openssl genrsa | openssl asn1parse

You'll see that the while only 64 or 32 bytes are displayed, you'll see l= 33 or  l= 65 indicating that one extra byte is actually stored. That's your initial zero byte you saw earlier.

As for 32-bit DH keys, look at this:

$ openssl dhparam 32 -text
Generating DH parameters, 32 bit long safe prime, generator 2
This is going to take a long time

PKCS#3 DH Parameters: (32 bit)
    prime: 2714658203 (0xa1ce659b)
    generator: 2 (0x2)

So, that looks like only 4 bytes even though the initial bit is set. But let's look at the asn1parse:

0:d=0  hl=2 l=  10 cons: SEQUENCE
2:d=1  hl=2 l=   5 prim: INTEGER           :A1CE659B
9:d=1  hl=2 l=   1 prim: INTEGER           :02

So for this 32-bit prime, 5 bytes are stored even though you only saw 4 bytes displayed.

The reason you didn't see the zero byte this time is that since the stored value is only 32-bits, it can be displayed as a simple unsigned integer, and therefore OpenSSL's display library accordingly shows you the decimal value and the hex value in parens instead of just showing you a string of hex bytes separated by colons. But the initial zero is still there, as we saw in the asn1 output.


CORS error but only from AJAX and not from HTML form I study web attacks. I find that it is possible to submit a form with HTML from another origin into the victim server. But if I use AJAX then I get a CORS error. Is this the expected behavior? If yes, why? The victim has not set any "Allow-Origin" header at all.

This is the expected behavior.

Before CORS it was already possible to make cross-site requests using HTML forms, cross-origin inclusion of images ... . But it was not possible to do cross-site XHR (Ajax) and thus workarounds were done by developers using the allowed methods.

CORS changed this by loosening the original restrictions and allowing cross-origin XHR in some cases. "Simple" XHR are allowed without asking the server first because the same requests could have been done before with HTML forms etc. All other XHR need a pre-flight request first which checks if the server is accepting the HTTP request.


Do I have to do any setup if I want to run a VPN with the Tor browser bundle? I know there will be some votes against this but I want to run a VPN alongside the Tor browser. Can I just open the VPN program, connect to the VPN provider, then open the Tor browser and use it as normal? No extra setup required?

TL;DR: No extra setup required.

Concept:

Try to understand what Tor does. Tor builds a Proxy Chain for you to access the Internet. Your single request is routed through several different Tor nodes (known as relays) before reaching the host. The host only sees the IP address of the last node in your Proxy chain as the requesting IP address and returns the response to that IP. Diagrammatically, it would look something like this:

Your Machine ====> Tor Node 1 ==> 2 ==> 3 ==> 4 ==> 5 ==> Internet

Now what would happen if you also connect your machine to a VPN?

A VPN is like a tunnel which makes your OS believe that it is part of a private network, but the actual VPN server hosting this network may be a few hops away from your network. So effectively, when you connect to a VPN, all your traffic flows in the following manner:

Your Machine ====> N/W Hop 1 ==> 2 ==> 3 ==> 4 ==> 5 ==> VPN Server ==> Internet

Only the IP address of the VPN server is exposed to the Internet. Your VPN network adapter however remains oblivious to this route all it sees is:

Your Machine ====> VPN Server ==> Internet

When you merge run both VPN & Tor browser, the network path will look like this:

Your Machine ====> VPN Server ==> Tor Node 1 ==> 2 ==> 3 ==> 4 ==> 5 ==> Internet


Blocking reflected XSS on common web servers How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx?
The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-Protection was removed from latest Chrome.
The question is specifically about these web servers settings, without any code change or WAF.

These headers never blocked XSS at the web servers but instead instructed the browsers to use heuristics to detect XSS on the client side.
There is no magic way to block reflected XSS on the server side. And there is no "Without any code change / WAF", at least if you are having a broken application affected by reflected XSS in the first place.
One can use heuristics to filter for common XSS attacks, i.e. use a WAF. Better yet, the code should have proper input validation and output sanitation and should be structured so that a strict Content-Security-Policy (especially no inline eval) can be enforced and will then also be set by the server.


single secure architecture solution for below 4 threats An e-commerce website uses LAMP stack hosted on a single rack-mounted server located at a data center. On every transaction, credit card information is stored in the MySQL database at data center.

For accounting purposes transaction records (including credit card information) is transmitted in standard unencrypted formats, such as CSV or XML files, to the accounting server. At regular intervals, a batch job on the LAMP server pulls new transactions from the MySQL database and sends them via FTP to the accounting server.

Once the accounting is done, transaction records are immediately encrypted and stored in a database on some server.

The e-commerce company has identified several threats that they want to protect the credit card numbers from and these threats are:

Database administrator – A company employee with authorized access to the database could log in and pull down credit card information
Data center – A data center employee could pull the server out of the rack and take it, along with all the credit card data
Internet attacker – An attacker could potentially break into the system and steal the credit card information from the database
Internet attacker  – The communication of the transaction data from the e-commerce server to the accounting server could be intercepted by an attacker

What is a single secure architecture solution that provides protection for the credit card numbers again all 4 threats mentioned above? Physical security is out of scope and I realize there are many other potential threats, but in this scenario, only 4 above threats.

I came up with encryption technique that can be done while transmitting or storing data Not sure if that's the most appropriate or convincing answer for this question.

The easiest, cheapest, and most secure way to deal with credit card data and remain PCI compliant for small business is not to deal with credit card data. Use a third party payment provider like Paypal, Stripe, Google Wallet, eWAY, Braintree, etc so you don't have to deal with securing the credit card data. Many of these payment processors also has features for preauthorized transactions for future transactions and subscriptions.


Securely storing passwords using PHP5 Starting note: After going through some articles and answers posted on SO related to storing secured passwords I'm still not sure whether my way of thinking is applicable to todays reality.

I'm currently thinking of a way to provide a secure structure for storing and retrieving passwords needed for authentication of a user on a webpage. While browsing the net and digging through pages of answers I've found myself stuck at some point. First of all, time goes on and not every article/answer is up to date. Secondly, there are many ambiguities as of what actually should be done.

I'm using PHP5 and Postgres database. While being aware of existance of pg_crypto module to me it seems like doing those computations on database level does not seem secure due to logging and passing plain password to database query.

So I decided to get the job done in application code (PHP). Since PHP5 there is a native password hashing API providing functions like password_hash() and password_verify().

What I'm asking for is advice whether or not I'm on the right track or any improvements that could be done supported by strong security-related arguments (please refrain from advising on iterating milion times). Also, is this possible using PHP5 or am I missing any theoretical knowledge as well (considering my way of thinking for this process).

My way of thinking for this process is to:

Get the password from user
Apply a randomly generated salt for each user (preferably constant length for every salt), that is independent of any data stored in database
Store that salt in table where users and their hashed passwords are going to be
"Hashinng"

Hash the salt concatenated with password using SHA512 algorithm
password_hash with bcrypt

Store hash in db

So as you can see my main consideration is whether to use SHA-512 or bcrypto, but I feel like I lack the capacity in this field and thus am asking for general advices to my entire process.

Particularly my attention to which "hashing" process to use was brought by erickson's answer on comparing SHA vs Bcrypt. I'm aware of SHA3 existance, but doesn't that prove there were things that should be improved as compared with SHA2 family (this is a question of type for now)?

What I've read already:

Non-random salt for password hashes

SHA512 vs. Blowfish and Bcrypt

Secure hash and salt for PHP passwords

Passwords storage, hash() with sha-512 or crypt() with blowfish (bcrypt)?

PHP Reference Manual - FAQ - Passwords

I think many of your questions (eg SHA-512 vs bcrypt) are answered in the guide linked to by AviD. But it doesn't actually say anything about PHP, so I'll answer that part.

Hashing a Password in PHP5

It's good that you want to understand the underlying concepts, but actually securely hashing a password in PHP5 is quite easy:

$hashedPassword = password_hash($plainPassword, PASSWORD_DEFAULT);

That's it. Store it in the database, use password_verify to compare, and you're done. password_hash will create a per-user salt for you, so you don't need your step 2 or 3[*]. You also don't need the first part of your step 4 (it's enough to hash once).

The result of this will be of the form $hashFunctionId$options$saltHash. The hashFunctionId and options (the cost) are used to store information on how the hash was created.

[*] I can see why it's confusing though, because so many guides explicitly mention the important of per-user salts, so it might seem odd that PHP actually does the work for you

password_hash options

So what is the use of the other options of password_hash if hashing is that simple?

PASSWORD_DEFAULT means that currently bcrypt will be used, but if there are better methods in the future, those will be used. If for some reason you do want control over this, replace it with PASSWORD_BCRYPT.

You can pass a salt which replaces the auto-generation of a salt. This is useful if you want to get the same output when hashing the same password, or if you want to include a pepper.

And you can pass a cost, if you think that the default cost of 10 is not enough for you.


Attack vectors that go through previously compromised accounts Assume an attacker gains access to a user's account on some cloud service (like my Google, Microsoft, or whatever ), the user discovers this, and changes their password.

What are the scenarios that the user should then watch out for to ensure that they are totally safe from the attacker?

If the question is too general or vague in the above form, let me just ask a specific case which applies to me: I recently changed my password on Microsoft OneDrive due to concern it was compromised and I want to be sure my computer is safe when I reconnect to the service.  Beyond being sure not to execute some malicious executable left behind by the attacker, is there anything else I need to do to stay safe? Are there any other attack vectors that I should be watching out for?

Thanks!

First you should make sure that there are no apps associated with your account which still might have access - see Secure Your Online Accounts By Removing Third-Party App Access. Then you should make sure that the attacker gets not access to your account again.

This means that you should check that the attacker has not left some kind of backdoor into your account: check any recovery email addresses, phone numbers etc to make sure that these are only addresses and phone you and only you have access to. And if the account provides recovery using secret questions make sure that these are the ones you and only you have the correct answers for.

Apart from that figure out how the attacker get access to the account in the first place and make sure that this and similar ways don't work anymore. Such path might for example have been weak passwords or reused passwords, access to a device or email you've setup for recovery or easy to guess answers to the recovery questions.

Also, for additional protection setup 2FA on the account.


Preventing users from tampering with replay data Possible Duplicate:
  Protect application from being modified

This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical answers here.

So I've been developing an iPhone game which has a replay functionality. The replay of the game is basically a sequence of moves by the player which determine the game outcome. The replay data may be used to brag the score to others or claim some kind of prize (maybe not the latter).

How does one prevent users from tampering with the replay data? I suppose I could encrypt/checksum the data and such, but if they peek through the binary it might be possible to get the private key or whatever algo used.

I realise this is probably overkill for an iPhone game, but I suppose it's better to be safe than sorry?

You can sign the data, but this leaves the problem that the private key needs to be embedded into the application in order to verify it.
You can store the replay data on a server and allow the friends to access it using their own device.

For an average game, it is likely not worth the effort because the data can already be manipulated at the time it is recorded by modifying the game application. Depending on the type of game, it may be suitable to use fully automated bots, aim bots or map hacks.

Protect application from being modified has some more information on that topic.


What password cracking software is commonly used? I am curious to know how secure my passwords are.

What password cracking software is commonly used?
Preferably open source.

EDIT: I am actually looking to crack my passwords used on services I don't own.
Obviously, this means that I don't want to actually attack the service..

Is there any piece of software that would allow me to give it a password, and it will attempt to go through the process of breaking it?

John the Ripper is the traditional, free, open-source password cracker (there is also a closed-source commercial "pro" version). It has been widely used for (much) more than the last 10 years.


Nmap scanning with and without proxychains has different behaviour I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333

On the other terminal I run sudo nmap -O -sV -p 0-65535 IP where IP is my local IP. The result I got on the nmap terminal is this one:

But on the terminal where I opened the port, the process finishes and I have this message:

    root@kali:~$ sudo nc -lvnp 333
    listening on [any] 333 ...
    connect to [IP] from (UNKNOWN) [IP] 47462

I got curious and I tried to do the same thing with proxychain just to check which IP would appear, so I run sudo proxychains nmap -O -sV -p 0-65535 IP

The result on the nmap terminal was different I guessed because the limitations of nmap through proxy I read in other places:

But when I checked on the nc terminal the process didn't finish and it doesn't seem that noticed some scan was checking that port.
Which is the reason that with proxychains the scan was stealthy?

You are basically comparing access from the local machine to the local machine (i.e. fully internal to the machine) with no firewalls in between to access from some remote machine to your local machine with likely firewalls and maybe even NAT in between. It is expected that the results will be different since firewalls/NAT block the traffic.


What is the expiration time threshold below which LetsEncrypt certificates will auto-renew? I have a few domains on some server, all certified by LetsEncrypt certificates. The certificate is due to expire in 11 days, on July 9th.

However, when I try to renew using /opt/letsencrypt/letsencrypt-auto renew, I get this:

The following certs are not due for renewal yet:
  /etc/letsencrypt/live/what1.ever.com/fullchain.pem (skipped)
  /etc/letsencrypt/live/what2.ever.com/fullchain.pem (skipped)
  /etc/letsencrypt/live/what3.ever.com/fullchain.pem (skipped)
  /etc/letsencrypt/live/what4.ever.com/fullchain.pem (skipped)

It seems a bit odd that certificates can't be renewed 11 days before the expire, but it might be a matter of policy rather than a bug.

What is the expiration time threshold below which LetsEncrypt certificates will auto-renew?

According to certbot documentation:

  This will attempt to renew any
  previously-obtained certificates
  that expire in less than 30 days.


Potential risks of a single codebase for multiple CMSes We are currently in the process of converting our multiple codebases (which are exactly the same, except for a configuration file and 2 stylesheets).
We have been thinking about this for a while, and the idea for now is to determine the domain the user is accessing and loading the stylesheets and configuration file depending on the domain.
For example:
User 'A' goes to the website 'www.my.example.com' and the configuration (which includes database, SMTP and other options) and the stylesheets get used. We determine everything depending on their domain.
So if user 'B' goes to the other CMS 'my.exampler.com' it will load the configuration and stylesheets for 'my.exampler.com' instead of 'my.example.com'.

Are there any security risks as to doing it this way? We currently do not know of any possible security risks which could occur. The configuration file is not accessible for users without having FTP or direct access to the server itself.
Is this a bad idea? Is there possibly a more secure way to do this? Or is this an acceptable way to create a single codebase for every CMS?

In the abstract, serving multiple domains from a single codebase is far better than serving multiple domains from multiple codebases. Less code much better than more code.

That said, there are reasons NOT to do this- most notably if the different domains have different risk profiles (like one is a CMS and another is ecommerce).

And when doing this, it has to be done with care. One common mistake is to implicitly trust the incoming Host header and reuse it in templates and so forth, which opens all of the sites hosted in this way to compromise.


Is BCrypt enough when saving a password into a database? In order to allow users to connect to my website, I encrypt their password using BCrypt since it is one of the slowest algorithms to decrypt (making a compromised database longer to be decrypted).

But I was wondering if that was enough -- or if combining it with a hashing algorithm like sha256/512 was better ?

In fact, that would mean :

clear password -> sha256 -> bcrypt -> stored in database.

Does adding the sha256 really increase the difficulty to decrypt these, or is the slowness of BCrypt sufficient?

The short answer is, use bcrypt, not SHA256.  Bcrypt already hashes the password, so if you are using bcrypt, there is no point to use both bcrypt+SHA256; it won't be any stronger.  Bcrypt alone is sufficient.

There's a lot of advice on this site on exactly this topic.  Search for "password hashing" and you'll find it.

See, e.g., How to securely hash passwords?, Which password hashing method should I use?, Most secure password hash algorithm(s)?, Do any security experts recommend bcrypt for password storage?.

You want to use a password hashing algorithm that is as slow as you can stand, to prevent offline dictionary attacks on people's passwords if your database is compromised.

Of course, that is not enough.  There are a variety of steps you should take to make use of passwords as secure as possible.  Here are a few:

Use site-wide SSL/TLS.  Any attempt to visit your site through HTTP should immediately redirect to HTTPS.
Enable HSTS on your site.  This tells browsers to only connect to you via HTTPS. Paypal uses it.  It is supported in recent versions of Firefox and Chrome.

Search the site and you'll find lots more.


Problems with the security certificate On my phone when I try and access my regular websites, I get the error message " there are problems with the security certificate of this website".
More often than not I still proceed onto the website.
If it is a website that I regularly go on, is it safe to proceed on to the site anyway?

Proceeding when the certificate doesn't validate roughly turns the secure HTTPS into the insecure HTTP. It is very bad to hit continue. If the same websites work safely from your desktop, it is probably a browser problem that you have to fix. That means fixing the problem is out of scope for this website. You need an Android support website. But maybe I can help you.

Try the following in order from first to last. Stop when the problem is fixed.

Some Android phones/tablets are known to do this when the date/time is set incorrectly. Reset your date/time.
Delete the cached data for the browser application.
Delete the browser app if you can.
Switch to a different browser app if you can.
Factory reset your phone/tablet.
Contact your phone/tablet support channel.

Good luck!


IP retrieval without visiting the site or clicking the link There are sites like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a message via Twitter, WhatsApp, Facebook or Instagram.
Will it be possible to get the IP of the individual without him clicking the link?
An example scenario is as follows: A sends msg to B with link. As soon as message lands in B's, inbox we get the IP address of B.
Some services do generate logs in when link previews are generated but they are bots.

Common in modern marketing email is the practice of including "tracking pixels." These are small 1x1 transparent images embedded into the email that are hosted on an external web server. When the user opens the message, their email client will download the image from the external server, creating a entry in the external server's logs.

However, this method has some limitations:

The user must open the message. If they don't, the message and tracking pixel will never be loaded.
Not all email clients load external images by default. Some will ask the user whether they would like to load the images in the email, and if the user opts not to, the tracking pixel will not be downloaded.
Some email services (Gmail?) will proxy image downloads on behalf of the client. In this case, you would get the IP address of the proxy rather than the final recipient.

I am not aware of a method that would allow you to get the IP address of an email recipient 100% reliably. Tracking pixels get part of the way there but they are more effective for tracking email open rates than for collecting IP addresses.


Are there any concerns with sending and storing 3rd party cookies? I have a userscript for an browser game that I use to send users cookies to my webserver. I then use those cookies to pull player specific data and compile it into reports for those players.

The game, and my website use HTTPS. I am storing the cookies in an encrypted database table and then using them to perform the data-pulls server-side.

What sort of security concerns arise from this sort of setup, and what should I do to mitigate them? Is the premises very insecure to start?

InfoSec is always a balance between risk, cost, and convenience.  In your case we're talking about a game that perhaps is not well known, so it is not a high value target.  If there is literally nothing worth hacking, there is nothing worth protecting.

Also, InfoSec tends to focus on threat modeling specific attack vectors.  You may not have to do anything if there are no attacks that would cause you grief, e.g. if the only attacks that would work are ones that don't affect anything important to your operations.  So you should try to list these.  What sorts of things are you worried a hacker could accomplish?  For example, is it a big deal if someone can alter their own scores and reports?  Is it a big deal if they could see someone else's scores?  If they could modify them?  Etc.

That being said, I can introduce you to a couple general practices that certainly wouldn't hurt anything if you did them:

If you are actually storing data in the cookies (as opposed to an identifier which can be used to obtain data) then the cookies can be modified by any user who is in control of the machine on which the cookie is stored.  Of course, they can only modify their own cookies.  But if this is still a concern, you can make your cookies a bit tamper-resistant through various means: you could encrypt the cookie (probably using private key symmetric encryption like AES), or you could sign the cookie with a Machine Authentication Code.

If you are not storing data, only an ID, and you use the ID to get data from the database, there are three suggestions I'd make.  First, make the identifier random, not sequential, so that nobody can guess others' IDs just by adding 1 to their own ID.  Second, generate the identifier with sufficient entropy (say, 64 bits) so that it is difficult to find IDs using a brute force search.  Third, tie the identifier to a user (e.g. add a UserID column to the database table) and check to make sure it matches the current authenticated user before you pull any data.

If you are worried about physical security of the endpoint-- e.g. a user playing your game in a coffee shop, who leaves the computer without clearing his cookies-- then I suggest that your cookie be provided with an expiration, or that it be a session cookie which is deleted when the user closes the browser.  Re-issue the cookie when the user signs on using his user name and password.

If you are worried that a hacker could use the cookie to inject malicious code into your application, use the cookie only to store an identifier in a known format, and validate the format of the cookie when it is submitted to your server.


Mobile call encryption Is the signals of a mobile phone-call encrypted between the phone and the mobile-tower or only between the towers? And is it possible for a non-authority individual to eavesdrop on your conversation if he picks up the signal between the phone and the tower?

All normal (GSM,CDMA,UMTS,LTE) mobile network communications are encrypted, except when it is not. For example, very old 2G GSM networks may only offer A5/0 or A5/1 "encryption", which is in effect none or broken.

Many other protocols are also already broken. See: Cellular encryption algorithms currently in use globally.

Some attacks are done by downgrading the communication from a safe/encrypted protocol to a broken one.


What is the use case for using TLS on an internal network? If there are admin consoles on the internal network and TLS has been disabled what is the use case for enabling it?

The only use case I can think of is when you have untrusted users on the network who could potentially use pack sniffers to sniff the traffic.

Enabling TLS would mean monitoring devices would not able to monitor the traffic as it will be encrypted.

What are your thoughts? Should TLS be enabled for users accessing services (e.g. admin consoles) on internal networks?

See the note in the bottom center of this classic slide:

This is from a leaked NSA slide deck. Tapping internal traffic is not rocket science, the only real requirement is that someone is targeting you. If there is something of value going over the cable, something potentially worth encrypting, then you may also assume that someone might be going after it sooner or later.

That's why we encrypt internal traffic: physical cables are not always to be trusted. A guest in a waiting room having access to the internal network (due to missing or misconfigured (V)LANs) is not uncommon, or someone who is trusted but whose device is infected, or someone who physically breaks in, or a single compromised server that can intercept other servers' traffic... there are a lot of scenarios in which encryption helps, also on internal networks. You should also ask yourself: is the least privileged person with physical (or network) access allowed to learn the most sensitive data that the network transports? If not, encryption is what ensures they can't intercept it.

Do you know where your physical cables run and whether all those places are guarded at all times? Is ARP spoofing disabled in every LAN you have? VLAN hopping mitigated? No WPA2-PSK WiFi anywhere? Intermediate firewalls and routers have 2FA enabled and are not hacked? Are all of the implemented measures tested? Did I not forget anything? From my experience, each of these measures is in use only in a minority of companies, and very few will have it all.

Setting up the encryption is typically easy these days. If you're only talking about your own data, then you can take the risk for yourself. But when there are other people (colleagues or even customers) at risk, you really should enable it.


Using a manual cipher to secure Two Factor Authentication (2FA) backup codes Most accounts with two factor authentication (2FA) provide you with backup codes to use in case your phone is lost or stolen. For example, Google provides a list of 10 backup codes when setting up 2FA. These codes need to be stored securely but also need to be accessible. If anyone is able to obtain the 2FA codes, they can bypass 2FA on my account.

Some people have suggested printing out the codes and storing them in your luggage. Instead, I've been putting the backup codes in a digital crypto store with a unique key known only to me. I am using client-side encryption which requires special software which I may not have access to while traveling.

As my phone is the only computing device I have when I travel, I'm trying to cut out the requirement for decryption software. I'd also like to retain control of my keys so a vault with key knowledge (Dropbox, Google Drive, etc) is also out of the question.

Therefore, I am considering another option. Instead of storing the backup codes in a digital vault that requires software for decryption, what if I encrypt them with the manual one-time pad method (text char + key char then mod 26) and make the ciphers publicly available? When I lose my phone, I can decrypt the ciphers by hand with the key I memorize without needing special software.

This provides a couple additional benefits:

I can store the encrypted backup codes in multiple locations such as my wallet, my luggage, and on a publicly-accessible webpage.
I only need to memorize one key for all my backup codes across multiple accounts.
It does not matter if my backup code ciphers get lost or stolen.

My question is: Is this a secure method for storing 2FA backup codes? What are the security risks? What am I overlooking?

I did my own research on this and encrypting the 2FA codes with the One-Time Pad method and a non-obvious phrase is unbreakable due to the uniformity of the 2FA codes.

When using One-Time Pads (OTP) to encrypt a sentence, the key must be uniform to guard against frequency analysis. But in general, either the plaintext or the key need to be uniform. Google Authenticator and other 2fa providers use a hash generated by SHA-1 to generate the 2fa codes which is the standard for HOTP (RFC4226) and TOTP (RFC6238). While SHA-1 may not be perfectly uniform, SHA-1 is nearly-uniform and close enough to uniform that frequency analysis is not a feasible attack. Therefore, any non-obvious key such as an easy-to-remember phrase or sentence can be used to encrypt the 2fa codes.

One weakness of this is if you use the same key to use a One-Time Pad to encrypt all your 2fa backup codes and one of your codes gets brute-forced, the attacker can derive the key and then decrypt all your codes. While it is standard practice for account providers to rate-limit logins to help prevent brute-force attacks, some account providers may have worse protection than others and it should not be assumed that all account providers have adequate protection. Your 2fa backup code security is then only as good as the weakest account provider. Therefore, you should use a different key for each account which negates one of the major benefits of this method: that you only have to memorize one key.


Is the server certificate taken into account during the cipher suite negotation phase? I've a tomcat server with RSA certificate and connector X with a following suite:
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

My openssl client has the same suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Client connects to connector X. There is a handshake failure (on server hello step) BEFORE the authentication phase.

Is it possible that server certificate (RSA) is taken into account during the cipher suite negotiation phase? Or maybe the handshake should be successful but the authentication phase fail?

Your cipher says *_ECDSA_* which means that the authentication is done using ECDSA which requires a certificate with an ECC public key. But you have a certificate with a RSA public key only. Thus, this cipher and this certificate will not work together. If this is the only cipher configured at the server or client the handshake will fail with no shared ciphers.


DnsSpoof Target machine wont connect SETUP:

Target Machine:
VM on my network, on a machine that is hardwired to the router

Kali Box:
Tried both in a VM on the same machine as my target and a live boot on a laptop over wifi. Both within the same network

MACHINE IPS:

  Target: 192.168.1.83

  Gateway: 192.168.1.254

  Address to redirect to: 162.226.5.161 (my blog)

Steps taken to spoof dns:

Setup traffic forwarding on my kali box

  echo 1 > /proc/sys/net/ipv4/ip_forward

arp poison the gateway

  arp -i wlan0 -t 192.168.1.254 192.168.1.83

arp poison the target

  arp -i wlan0 -t 192.168.1.83 192.168.1.254

create a host file (using tab in between the ip and the url)

  cat > host

  162.226.5.161   *.google.com

  162.226.5.161   *.facebook.com

  162.226.5.161   *.bing.com

start dns spoof

  dnsspoof -i wlan0 -f host

Results

When I use NSLOOKUP at retrieve the DNS records for my target sites the expected ip of 162.226.5.161 is returned. However when you go to the target sites in the browser it just times out.

When the target machine calls one of the target sites I can see dnsspoof logging the traffic.

THE PROBLEM:

As noted above, when you navigate to the target sites in the browser the request times out even though NSLOOKUP is returning the proper redirect ip.

So the answer was obvious I suppose but I still don't know how to work around this.
When the target machine was requesting a site such Facebook.com it was doing it over HTTPS obviously. Which I guess meant it expected the site returned to accept a HTTPS connection.
This means that if I wish to DNS Spoof and forward the target machine to a different site that (at least for the moment until I figure out a work around) it needs to accept the same protocol that was initially requested.
To test this theory I found a site that allows HTTP connections (MSN.com) and I instead returned my blog. This worked swimmingly.
Results
So the short answer to the above problem was that I was attempting to forward the target to a machine that didn't support HTTPS though that's what the target machines initial request was for.
By using a site that accepted HTTP requests I was able to confirm this was the problem.