Archives for Security - Page 2
Types of Security Scans
Port scanner ( Nmap) Network vulnerability scanner ( Nessus, SAINT, OpenVAS) Web application security scanner ( Nikto, w3af) Database security scanner Host based vulnerability scanner (Lynis)
HTTPs and Authentication based sites not necessarily secure
Simple HTTPs does little to protect your website. All it does is protect MITM (Man in the Middle) attacks. Even an authentication based website is not necessarily secure - each…
Certificates Demystified – root versus self signed, private versus public key
I struggled a lot with understanding the nuances of security certificates – self-signed versus root certs, public keys versus private keys versus Certificate Authorities (CAs)….This post will attempt to clarify…
Random hostnames seen in Fiddler–when using Chrome
If you use Google Chrome (and who doesn’t), then you might see requests such as those below when you start up your browser. Randomized hostnames – so obviously, you start…
Sanitizing image and pdf files prior to upload
Does your site allow for file uploads of any sort? Pdfs? Jpegs? Anything whatsoever? All these file formats are notorious for allowing malware to piggyback onto them (a technique known…
Web Shells
A web shell is a piece of code that essentially takes over your web ; By providing a simple web-executable file ( aspx file, php file…) that contains code to…
Web application intrusion testing
What is Black Box Scanning? Black-box web application scanning, if we abstract from the details, is a simple process: Identify all links, forms, query string parameters. Send specially crafted strings…
Tableau Server Authentication Options
Tableau offers three choices for end user authentication No Authentication – Use an API key to access the public visualizations. No username/pwd or any other authentication mechanism required TTA –…
Workaround for session fixation
Tomcat A new security feature for Apache Tomcat 7 is Session Fixation Protection. Essentially, when a user authenticates their session, Tomcat will change the session ID. It does not destroy…
ROLES for a typical web application
Roles help define WHICH USERS can do WHAT. So – an ADMIN is a super ROLE – wherein all users belonging this ROLE, can do things that regular users cannot.…