Browsed by
Author: Amal Mammadov

Azure virtual network service endpoints

Azure virtual network service endpoints

You’ve migrated your existing application and database servers for your ERP system to Azure as virtual machines. Now you’re considering using some Azure platform as a service (PaaS) services to reduce your costs and administrative requirements. Storage services will hold certain large file assets, such as engineering diagrams. These engineering diagrams have proprietary information in them, and must remain secure from unauthorized access. These files must only be accessible from specific systems. In this unit, you’ll look at how to…

Read More Read More

Azure VNET Peering

Azure VNET Peering

az network vnet create \     –resource-group learn-176d3f64-8002-4e62-b762-ac3929d20952 \     –name SalesVNet \     –address-prefix 10.1.0.0/16 \     –subnet-name Apps \     –subnet-prefix 10.1.1.0/24 \     –location northeurope     az network vnet create \     –resource-group learn-176d3f64-8002-4e62-b762-ac3929d20952 \     –name MarketingVNet \     –address-prefix 10.2.0.0/16 \     –subnet-name Apps \     –subnet-prefix 10.2.1.0/24 \     –location northeurope     az network vnet create \     –resource-group learn-176d3f64-8002-4e62-b762-ac3929d20952 \     –name ResearchVNet \     –address-prefix 10.3.0.0/16 \     –subnet-name Data \     –subnet-prefix 10.3.1.0/24 \     –location westeurope     az network vnet list –output table =============================================== az network vnet peering create \     –name…

Read More Read More

Azure Site to Site VPN Configuation

Azure Site to Site VPN Configuation

We will create Site to Site VPN connection with two VNETs. By this way we are simulating Cloud and On-Prem sites as in the following diagram az network vnet create \     –resource-group learn-ee8df1a4-1b8d-4bd1-86fc-7c05ca89bf17 \     –name Azure-VNet-1 \     –address-prefix 10.0.0.0/16 \     –subnet-name Services \     –subnet-prefix 10.0.0.0/24     az network vnet subnet create \     –resource-group learn-ee8df1a4-1b8d-4bd1-86fc-7c05ca89bf17 \     –vnet-name Azure-VNet-1 \     –address-prefix 10.0.255.0/27 \     –name GatewaySubnet     az network local-gateway create \     –resource-group learn-ee8df1a4-1b8d-4bd1-86fc-7c05ca89bf17 \     –gateway-ip-address 94.0.252.160 \     –name LNG-HQ-Network \     –local-address-prefixes 172.16.0.0/16     az network…

Read More Read More

Front End Security Basics Secure Cookie Flag

Front End Security Basics Secure Cookie Flag

1. VULNERABILITY INTRODUCED Properly implemented data protection is an essential component of the security of any web application. It allows the users to know who they are communicating with, whether or not their communication channel is encrypted, and that the data is not manipulated in transit. Applications frequently fail to authenticate, encrypt, and protect the confidentiality and integrity of sensitive data transmitted through the network. For example, when HTTP protocol is used, the traffic (including cookies) is sent in plain…

Read More Read More

Front End Security Basics DOM XSS in AJAX

Front End Security Basics DOM XSS in AJAX

1. VULNERABILITY INTRODUCED When an HTML page is rendered in browsers, the browser downloads the HTML into local memory and automatically parses it to display the page on the screen. When a web page is loaded, the browser creates a Document Object Model (DOM) of the page, which is an object-oriented representation of an HTML document, that acts as an interface between JavaScript and the document itself and allows the creation of dynamic web pages. So, the objects in the…

Read More Read More

Front End Security Basics DOM XSS in URL

Front End Security Basics DOM XSS in URL

1. VULNERABILITY INTRODUCED When an HTML page is rendered in browsers, the browser downloads the HTML into local memory and automatically parses it to display the page on the screen. When a web page is loaded, the browser creates a Document Object Model (DOM) of the page, which is an object-oriented representation of an HTML document, that acts as an interface between JavaScript and the document itself and allows the creation of dynamic web pages. So, the objects in the…

Read More Read More

Front End Security Basics Components With known vulnerabilities

Front End Security Basics Components With known vulnerabilities

1. VULNERABILITY INTRODUCED When development teams use component-heavy development patterns, they sometimes do not even understand which components they use in their applications much less keeping them up to date.Developers often do not know: The versions of all components they use (both client-side and server-side); If the software they use (OS, web/application server, database management systems, run-time environments, and libraries) is vulnerable, unsupported, or out of date; If the underlying platform, frameworks, and dependencies are fixed or upgraded in a…

Read More Read More

Front End Security Basics: Cross Site Request Forgery

Front End Security Basics: Cross Site Request Forgery

1. EXERCISE BACKGROUND The vulnerable application pane loads the TraderDASH application. In this application, a user is able to quickly buy and sell stocks with a single-click order execution. It has also a quite ordinary profile for managing user details. ACTION Click My Account -> My profile link to open the profile page. 2. CHANGE EMAIL FUNCTIONALITY Bob is an attacker. While he was browsing the Web, he came across the TraderDASH application. Since registration was free and accessible, Bob…

Read More Read More

Front End Security Basics: Clickjacking

Front End Security Basics: Clickjacking

1. VULNERABILITY EXPLAINED Clickjacking attacks occur when a page, particularly one with clickable elements, can be placed inside a frame.An attacking website frames the victim website and redresses it in a manner that it becomes not visible to the victim.For example, if a website’s profile page has a Delete Account button, an attacker can place an iframe that centers on that button, while placing a fake ad in the topmost page, with a fake X button to close the ad…

Read More Read More

FRONT END SECURITY BASICS: 3. No Server-Side Validation

FRONT END SECURITY BASICS: 3. No Server-Side Validation

1. VULNERABILITY INTRODUCED Sometimes front-end developers get mesmerized by the validation word in the client-side validation term and implicitly assume that it refers to protection of some kind that operates on the client-side level. Also, they assume that properly implemented client-side validation will not allow hackers to pass any kind of malicious input to the server, and therefore there is no need to duplicate the same validation on the server level.But when the server doesn’t use the same protection schemes…

Read More Read More