Browsed by
Category: SECFND

HTTP Response Splitting

HTTP Response Splitting

1. EXERCISE BACKGROUND The vulnerable application pane loads the online shopping application LotsOfGoods.me. It aggregates data from multiple off-line shops and presents it on a single platform. To offer each customer a personalized offer from the shops that are located near them, LotsOfGoods.me prompts its users to specify their location.Alice is a legitimate user of this application. She wants to find a place nearby where she can buy a new laptop. She specifies the city where she rents her apartment….

Read More Read More

HTTP Headers that are misused for security purposes

HTTP Headers that are misused for security purposes

There are headers (like Referer and Host) that developers tend to use in the security mechanisms they develop, but it is considered bad practice: data that is passed in those headers is derived from user inputs and shouldn’t, therefore, be trusted.Also, there are headers that are not actually security headers by definition (like Content-Type and X-Content-Type-Options headers), but nevertheless, they play an important role in application security. You should NEVER use the following headers in implementations of security mechanisms: Host…

Read More Read More

HTTP COOKIES

HTTP COOKIES

An HTTP cookie is a small piece of data that a server sends to a client. The server sends the cookie using the Set-Cookie header in the response. It looks like that:Set-Cookie: trackingCookie=user1357272User-agent saves a cookie from the response and sends it back in the Cookie request header like that:Cookie: trackingCookie=user1357272Cookies are used for the following purposes:1. Session managementHTTP is a stateless protocol meaning that two requests cannot be correlated to the same source or to each other even if…

Read More Read More

HTTP Security Headers

HTTP Security Headers

There is a number of HTTP response headers that you should use to increase the security of your web application. They are referred to as HTTP security headers.Once implemented, HTTP security headers restrict modern browsers from running into easily preventable vulnerabilities. They also provide yet another, additional layer of security by helping to mitigate security vulnerabilities and prevent attacks (like XSS, Clickjacking, information leakage, etc.). But it is important to mention that HTTP security headers are not intended to replace…

Read More Read More

Azure Storage

Azure Storage

Performance Tiers When creating a storage account, you must choose between the Standard and Premium performance tiers. This setting cannot be changed later. Standard This tier supports all storage services: blobs, tables, files, queues, and unmanaged Azure virtual machine disks. It uses magnetic disks to provide cost-efficient and reliable storage. Premium This tier is designed to support workloads with greater demands on I/O and is backed by high performance SSD disks. They only support page blobs, and do not support…

Read More Read More

Public Key Infrastructure (PKI) Explanation

Public Key Infrastructure (PKI) Explanation

Recently one of my colleagues asked me to about a good explanation of PKI. So i decided to collect him some materials from Cisco. I think following explanation of PKI is brilliant. Thanks to Cisco. PKI OVERVIEW A substantial challenge with both asymmetric encryption and digital certificates is the secure distribution of public keys. How do you know that you have the real public key of the other system and not the public key of an attacker who is trying…

Read More Read More

Linux Process Creation

Linux Process Creation

New processes are created in Linux with a fork-and-exec mechanism. When a process makes a fork call, a new process with a new PID is created. The process that made the fork call is the parent process and the new process is the child process. The child process starts as a duplicate of the parent process, with some significant status changes. Both processes receive a value from the fork call. The parent process receives the PID of the child process…

Read More Read More

OpenSSL Generating Private and Public Key Pair

OpenSSL Generating Private and Public Key Pair

In this post I will create asymmetric encryption key pair and then demonstrate the encryption and decryption of sample test.txt file with Private and Public keys using OpenSSL in Linux 1. Generate 4096-bit RSA Private key and protect it with “secops1” pass phrase using 128-bit AES encryption and store it as private.pem file openssl genrsa -aes128 -passout pass:secops1 -out private.pem 4096 Encryption of private key with AES and a pass phrase provides an extra layer of protection for the key….

Read More Read More

Describing Security Event Analysis: Diamond Model for Intrusion Analysis

Describing Security Event Analysis: Diamond Model for Intrusion Analysis

Critical thinking skills are a core requirement for a security analyst. The security analyst must be able to link together logs, events, and other meta-data by identifying patterns across a massive amount of gathered data. The diamond model, developed by Caltagirone, Pendergast, and Betz is a method for helping the security analysts derive order from the chaos. The basic intent of the diamond model is to create a systematic way to analyze events in a repeatable way so that the…

Read More Read More

Regulatory Compliance

Regulatory Compliance

Compliance regulations are a major driver for security in organizations of all kinds. They define not only the scope and parameters for the risk and security architectures of an organization, but also the liability for those organizations that fail to comply. Current trends in regulatory compliance include the following: Strengthened enforcement Global spread of data breach notification laws More prescriptive regulations Growing requirements regarding third parties (business partners) Risk-based compliance on the rise Compliance process streamlined and automated The following…

Read More Read More