In this presentation we will be looking at:
Common threats to the security of your website.
The various attack surfaces of a website; from the server, down the wire to presentation in the client browser.
Simple approaches to mitigating these threats.
Keeping web applications free from malicious attack is an arms race. From bruteforce attacks against your server through to browser based attacks to your pages once delivered (e.g. XSS, click jacking, cross site request forgery (CSRF)); there are many ways in which your web site is susceptible to attack.
Fortunately there are several established counter measures that are simply (if rarely) implemented that are effective in mitigating such threats.
We will look at the various modes of attack, review some real world examples and see how counter measures can be put in place.
The presentation is aimed at anyone responsible for delivering information over the web regardless of whether they are responsible for the hosting and administration of their web site. Covering measures you can implement yourself and measures you may wish supported by your hosting provider.
Topics covered:
Server hardening through the use of firewalls,
TLS/SSL implementation to protect delivery across the wire and
Secure response headers and Content Security Policies to protect your page once received by the user's browser.
DrupalCamp London 2017 - Web site insecurity George Boobyer
Common threats to web security with real world case studies of compromised sites,
- A 'dissection' of a typical common exploit tool and how it operates,
- Simple approaches to mitigating common threats/vulnerabilities,
- Defence in depth – an overview of the various components of web security,
- Drupal specific measures that standard penetration testing often does not account for.
An overview of how to benefit from:
- Security monitoring and log analysis
- Intrusion Detection Systems & Firewalls
- Security headers and Content Security Policies (CSP).
see Drupal Camp London for full details:
http://drupalcamp.london/session/web-site-insecurity-how-your-cms-site-will-get-hacked-and-how-prevent-it
Topic: Art of Web Backdoor
Speaker: Pichaya Morimoto
Event: 2600 Thailand Meeting #5
Date: September 6, 2013
Video: https://www.youtube.com/watch?v=QIXTPPBfLyI
Think Like a Hacker - Database Attack VectorsMark Ginnebaugh
More here: http://bit.ly/2OMTu4
Sudha Iyer of LogLogic and Slavik Markovich of Sentrigo discuss how hackers learn their trade and what you can do to protect your database.
Learn about methods for protecting against each type of attack, including secure coding practices, database hardening methods and deep-scanning database activity monitoring tools.
You will learn:
• How to think like a hacker (including a demonstration of basic hacking)
• SQL injection in depth
• How to avoid SQL injection problems
• User-defined DBMS security policies
• Taking control of SQL injection, buffer overflow and other privilege-escalation attacks
• How to preserve the confidentiality and integrity of your data
• Strategies for monitoring and analyzing database activities without impacting performance
This document contains various methods to hack or pentest the web-server and web-applications.
1. A person can use it as hand book for hacking websites.
2. All contents of these hand book is searched and taken out from various other websites & blogs...
3. Use these knowledge for education purpose only.
[CB16] Esoteric Web Application Vulnerabilities by Andrés RianchoCODE BLUE
This talk will show esoteric web application vulnerabilities in detail, these vulnerabilities would be missed in a quick review by most security consultants, but could lead to remote code execution, authentication bypass and purchasing items in merchants using Paypal as their payment gateway without actually paying. SQL injections are dead, and I don’t care: let's explore the world of null, nil and NULL; noSQL injections; host header injections that lead to phone call audio interception; paypal’s double spent and Rails’ MessageVerifier remote code execution.
--- Andres Riancho
Andrés Riancho is an application security expert that currently leads the community driven, Open Source, w3af project and provides in-depth Web Application Penetration Testing services to companies around the world.
In the research field, he discovered critical vulnerabilities in IPS appliances from 3com and ISS, contributed with SAP research performed at one of his former employers and reported vulnerabilities in hundreds of web applications.
His main focus has always been the Web Application Security field, in which he developed w3af, a Web Application Attack and Audit Framework used extensively by penetration testers and security consultants.
Andrés has spoken and hold trainings at many security conferences around the globe, like BlackHat (USA and Europe), SEC-T (Sweden),DeepSec (Austria), PHDays (Moscow), SecTor (Toronto), OWASP (Poland),CONFidence (Poland), OWASP World C0n (USA), CanSecWest (Canada),PacSecWest (Japan), T2 (Finland) and Ekoparty (Buenos Aires).
Andrés founded Bonsai Information Security, a web security focused consultancy firm, in 2009 in order to further research into automated Web Application Vulnerability detection and exploitation.
DrupalCamp London 2017 - Web site insecurity George Boobyer
Common threats to web security with real world case studies of compromised sites,
- A 'dissection' of a typical common exploit tool and how it operates,
- Simple approaches to mitigating common threats/vulnerabilities,
- Defence in depth – an overview of the various components of web security,
- Drupal specific measures that standard penetration testing often does not account for.
An overview of how to benefit from:
- Security monitoring and log analysis
- Intrusion Detection Systems & Firewalls
- Security headers and Content Security Policies (CSP).
see Drupal Camp London for full details:
http://drupalcamp.london/session/web-site-insecurity-how-your-cms-site-will-get-hacked-and-how-prevent-it
Topic: Art of Web Backdoor
Speaker: Pichaya Morimoto
Event: 2600 Thailand Meeting #5
Date: September 6, 2013
Video: https://www.youtube.com/watch?v=QIXTPPBfLyI
Think Like a Hacker - Database Attack VectorsMark Ginnebaugh
More here: http://bit.ly/2OMTu4
Sudha Iyer of LogLogic and Slavik Markovich of Sentrigo discuss how hackers learn their trade and what you can do to protect your database.
Learn about methods for protecting against each type of attack, including secure coding practices, database hardening methods and deep-scanning database activity monitoring tools.
You will learn:
• How to think like a hacker (including a demonstration of basic hacking)
• SQL injection in depth
• How to avoid SQL injection problems
• User-defined DBMS security policies
• Taking control of SQL injection, buffer overflow and other privilege-escalation attacks
• How to preserve the confidentiality and integrity of your data
• Strategies for monitoring and analyzing database activities without impacting performance
This document contains various methods to hack or pentest the web-server and web-applications.
1. A person can use it as hand book for hacking websites.
2. All contents of these hand book is searched and taken out from various other websites & blogs...
3. Use these knowledge for education purpose only.
[CB16] Esoteric Web Application Vulnerabilities by Andrés RianchoCODE BLUE
This talk will show esoteric web application vulnerabilities in detail, these vulnerabilities would be missed in a quick review by most security consultants, but could lead to remote code execution, authentication bypass and purchasing items in merchants using Paypal as their payment gateway without actually paying. SQL injections are dead, and I don’t care: let's explore the world of null, nil and NULL; noSQL injections; host header injections that lead to phone call audio interception; paypal’s double spent and Rails’ MessageVerifier remote code execution.
--- Andres Riancho
Andrés Riancho is an application security expert that currently leads the community driven, Open Source, w3af project and provides in-depth Web Application Penetration Testing services to companies around the world.
In the research field, he discovered critical vulnerabilities in IPS appliances from 3com and ISS, contributed with SAP research performed at one of his former employers and reported vulnerabilities in hundreds of web applications.
His main focus has always been the Web Application Security field, in which he developed w3af, a Web Application Attack and Audit Framework used extensively by penetration testers and security consultants.
Andrés has spoken and hold trainings at many security conferences around the globe, like BlackHat (USA and Europe), SEC-T (Sweden),DeepSec (Austria), PHDays (Moscow), SecTor (Toronto), OWASP (Poland),CONFidence (Poland), OWASP World C0n (USA), CanSecWest (Canada),PacSecWest (Japan), T2 (Finland) and Ekoparty (Buenos Aires).
Andrés founded Bonsai Information Security, a web security focused consultancy firm, in 2009 in order to further research into automated Web Application Vulnerability detection and exploitation.
Hack Into Drupal Sites (or, How to Secure Your Drupal Site)nyccamp
Over 70% of the security issues in Drupal sites are either XSS, CSRF, or SQL Injection. Let's talk about how sites get hacked and how you can write secure Drupal code and maintain security throughout your development process and live maintenance.
About the Presenter:
Ben Jeavons is a member of the Drupal Security team and co-author of the Drupal Security Report. As an engineer at Acquia he works on the Acquia Network including the security and performance analysis tool, Acquia Insight.
Experience Level: Intermediate
Внедрение безопасности в веб-приложениях в среде выполненияPositive Hack Days
В данной работе рассматриваются результаты исследования по реализации алгоритма исправления ошибок в приложении в среде выполнения. Исследование проводилось на приложении с незащищенным кодом с целью его защиты от внедрения кода и других уязвимостей веб-приложений. Также в работе будет представлена технология защиты веб-приложений нового поколения под названием Runtime Application Self-Protection (RASP) (самозащита приложения в среде выполнения), которая защищает от веб-атак, работая внутри веб-приложения. Технология RASP основана на исправлении ошибок в среде выполнения путем «внедрения» безопасности в веб-приложения в неявном виде, без внесения дополнительных изменений в код. В завершении доклада перечисляются основные проблемы при реализации этой новой технологии и обзор перспектив защиты среды выполнения.
В последнее время все чаще происходят сложные целенаправленные атаки (APT) с использованием скрытой загрузки. Существующие системы автоанализа, как правило, не способны анализировать вредоносное ПО, используемое для APT-атак, и исследователи вредоносного ПО вынуждены анализировать его вручную. Докладчик представит новую систему автоанализа памяти в режиме реального времени (Malware Analyst). Данная система не генерирует дамп памяти при помощи LibVMI, а имеет непосредственный доступ в память для ускорения диагностики и четко распознает подозрительное поведение вредоносного ПО.
Supporting Debian machines for friends and familyFrancois Marier
Many Debian developers find themselves providing some form of technical support to friends and family. Achieving the mystical five nines is well beyond the means of an amateur sysadmin like myself, but giving my dad reliable boxes to use can be achieved without eating all of my free time.
This talk will draw on my experience supporting and maintaining my dad's Debian-based computers. I will briefly describe the hardware setup, introduce some useful packages and share some configuration hints. Areas of focus will include system updates, reliability, monitoring and security.
http://nz2015.mini.debconf.org/Programme/Francois/
20+ ways to bypass your mac os privacy mechanismsCsaba Fitzl
"TotallyNotAVirus.app" would like to access the camera and spy on you. To protect your privacy, Apple introduced Transparency, Consent, and Control (TCC) framework that restricts access to sensitive personal resources: documents, camera, microphone, emails, and more. Granting such access requires authorization, and the mechanism's main design concern was clear user consent.
In this talk, we will share multiple techniques that allowed us to bypass this prompt, and as a malicious application, get access to protected resources without any additional privileges or user's consent. Together, we submitted over 40 vulnerabilities just to Apple through the past year, which allowed us to bypass some parts or the entire TCC. We also found numerous vulnerabilities in third-party apps (including Firefox, Signal, and others), which allowed us to avoid the OS restrictions by leveraging the targeted apps' privileges.
In the first part of the talk, we will give you an overview of the TCC framework, its building blocks, and how it limits application access to private data. We will explore the various databases it uses and discuss the difference between user consent and user intent.
Next, we will go through various techniques and specific vulnerabilities that we used to bypass TCC. We will cover how we can use techniques like process injection, mounting, application behavior, or simple file searches to find vulnerabilities and gain access to the protected resources.
The audience will leave with a solid understanding of the macOS privacy restrictions framework (TCC) and its weaknesses. We believe there is a need to raise awareness on why OS protections are not 100% effective, and in the end, users have to be careful with installing software on their machines. Moreover - as we're going to publish several exploits - red teams will also benefit from the talk.
SQL Injection: complete walkthrough (not only) for PHP developersKrzysztof Kotowicz
Learn what is SQL injection, how to use prepared statements, how to escape and write secure stored procedures. Many PHP projects are covered - PDO, Propel, Doctrine, Zend Framework and MDB2. Multiple gotchas included.
Hack Into Drupal Sites (or, How to Secure Your Drupal Site)nyccamp
Over 70% of the security issues in Drupal sites are either XSS, CSRF, or SQL Injection. Let's talk about how sites get hacked and how you can write secure Drupal code and maintain security throughout your development process and live maintenance.
About the Presenter:
Ben Jeavons is a member of the Drupal Security team and co-author of the Drupal Security Report. As an engineer at Acquia he works on the Acquia Network including the security and performance analysis tool, Acquia Insight.
Experience Level: Intermediate
Внедрение безопасности в веб-приложениях в среде выполненияPositive Hack Days
В данной работе рассматриваются результаты исследования по реализации алгоритма исправления ошибок в приложении в среде выполнения. Исследование проводилось на приложении с незащищенным кодом с целью его защиты от внедрения кода и других уязвимостей веб-приложений. Также в работе будет представлена технология защиты веб-приложений нового поколения под названием Runtime Application Self-Protection (RASP) (самозащита приложения в среде выполнения), которая защищает от веб-атак, работая внутри веб-приложения. Технология RASP основана на исправлении ошибок в среде выполнения путем «внедрения» безопасности в веб-приложения в неявном виде, без внесения дополнительных изменений в код. В завершении доклада перечисляются основные проблемы при реализации этой новой технологии и обзор перспектив защиты среды выполнения.
В последнее время все чаще происходят сложные целенаправленные атаки (APT) с использованием скрытой загрузки. Существующие системы автоанализа, как правило, не способны анализировать вредоносное ПО, используемое для APT-атак, и исследователи вредоносного ПО вынуждены анализировать его вручную. Докладчик представит новую систему автоанализа памяти в режиме реального времени (Malware Analyst). Данная система не генерирует дамп памяти при помощи LibVMI, а имеет непосредственный доступ в память для ускорения диагностики и четко распознает подозрительное поведение вредоносного ПО.
Supporting Debian machines for friends and familyFrancois Marier
Many Debian developers find themselves providing some form of technical support to friends and family. Achieving the mystical five nines is well beyond the means of an amateur sysadmin like myself, but giving my dad reliable boxes to use can be achieved without eating all of my free time.
This talk will draw on my experience supporting and maintaining my dad's Debian-based computers. I will briefly describe the hardware setup, introduce some useful packages and share some configuration hints. Areas of focus will include system updates, reliability, monitoring and security.
http://nz2015.mini.debconf.org/Programme/Francois/
20+ ways to bypass your mac os privacy mechanismsCsaba Fitzl
"TotallyNotAVirus.app" would like to access the camera and spy on you. To protect your privacy, Apple introduced Transparency, Consent, and Control (TCC) framework that restricts access to sensitive personal resources: documents, camera, microphone, emails, and more. Granting such access requires authorization, and the mechanism's main design concern was clear user consent.
In this talk, we will share multiple techniques that allowed us to bypass this prompt, and as a malicious application, get access to protected resources without any additional privileges or user's consent. Together, we submitted over 40 vulnerabilities just to Apple through the past year, which allowed us to bypass some parts or the entire TCC. We also found numerous vulnerabilities in third-party apps (including Firefox, Signal, and others), which allowed us to avoid the OS restrictions by leveraging the targeted apps' privileges.
In the first part of the talk, we will give you an overview of the TCC framework, its building blocks, and how it limits application access to private data. We will explore the various databases it uses and discuss the difference between user consent and user intent.
Next, we will go through various techniques and specific vulnerabilities that we used to bypass TCC. We will cover how we can use techniques like process injection, mounting, application behavior, or simple file searches to find vulnerabilities and gain access to the protected resources.
The audience will leave with a solid understanding of the macOS privacy restrictions framework (TCC) and its weaknesses. We believe there is a need to raise awareness on why OS protections are not 100% effective, and in the end, users have to be careful with installing software on their machines. Moreover - as we're going to publish several exploits - red teams will also benefit from the talk.
SQL Injection: complete walkthrough (not only) for PHP developersKrzysztof Kotowicz
Learn what is SQL injection, how to use prepared statements, how to escape and write secure stored procedures. Many PHP projects are covered - PDO, Propel, Doctrine, Zend Framework and MDB2. Multiple gotchas included.
Caution: This is a dated presentation; uploaded for reference. While the principles remain valid, specifics may have changed.
This presentation was made for software developers in Chandigarh - as a part of the NULL & OWASP Chandigarh Chapter activities.
It covers the basics of secure software development and secure coding using OWASP Top 10 as a broad guide.
"Web Application Security" by Lee Christense at Utah Code Camp in March 2014. Covers SQL injection(SQLi), cross-site scripting(XSS), cross-site request forgery(CSRF), and password hashing.
Web security: OWASP project, CSRF threat and solutionsFabio Lombardi
In a society in where we can all see an exponential growth in hacking attacks, this presentation raises awareness of web security vulnerabilities, what web developers can do to protect their web applications and which tools are available to ease the task.
In particular, I'm going to provide an overview on the OWASP top ten vulnerabilities, then focusing on CSRF (Cross-Site Request Forgery) attack, showing how it works, the impacts it can have, and how it is possible to prevent it.
Finally, I will briefly describe the OWASP LAPSE project, a useful Eclipse plugin for detecting vulnerabilities in Java EE applications.
The top two attack vectors for malware are email and web browsers. Watering-hole attacks conceal malware on member-based sites and phishing scams can target individuals with personal details. This PPT describes a different security approach to protect against these threats while achieving business growth, efficiency and lowered expenses. The presentation features Cisco Email, Web and Cloud Web Security and covers basic features, offers, benefits, newest features and product integrations. Watch the webinar: http://cs.co/9004BGqvy
This apresentation part of course Utah Networxs Hardening Web Servers.
The target is show any options to configure security apache web server and protect to possible hackers attacks.
The package debian_hardening-0.1_beta.deb is available in http://www.utah.com.br/deb/debian_hardening-0.1_beta.deb and source code to change or generate a new debian available in http://www.utah.com.br/src/debian_hardening-0.1_beta.tar.gz
Thanks...
Utah Networxs
Walking to Giants
Low Hanging Fruit, Making Your Basic MongoDB Installation More SecureMongoDB
Your MongoDB Community Edition database can probably be a lot more secure than it is today, since Community Edition provides a wide range of capabilities for securing your system, and you are probably not using them all. If you are worried about cyber-threats, take action reduce your anxiety!
Identifying Web Servers: A First-look Into the Future of Web Server Fingerpri...Jeremiah Grossman
Many diligent security professionals take active steps to limit the amount of system specific information a publicly available system may yield to a remote user. These preventative measures may take the form of modifying service banners, firewalls, web site information, etc.
Software utilities such as NMap have given the security community an excellent resource to discover what type of Operating System and version is listening on a particular IP. This process is achieved by mapping subtle, yet, distinguishable nuances unique to each OS. But, this is normally where the fun ends, as NMap does not enable we user's to determine what version of services are listening. This is up to us to guess or to find out through other various exploits.
This is where we start our talk, fingerprinting Web Servers. These incredibly diverse and useful widespread services notoriously found listening on port 80 and 443 just waiting to be explored. Many web servers by default will readily give up the type and version of the web server via the "Server" HTTP response header. However, many administrators aware of this fact have become increasingly clever in recent months by removing or altering any and all traces of this telltale information.
These countermeasures lead us to the obvious question; could it STILL possible to determine a web servers platform and version even after all known methods of information leakage prevention have been exhausted (either by hack or configuration)?
The simple answer is "yes"; it is VERY possible to still identify the web server. But, the even more interesting question is; just how much specific information can we obtain remotely?
Are we able to determine?
* Supported HTTP Request Methods.
* Current Service Pack.
* Patch Levels.
* Configuarations.
* If an Apache Server suffers from a "chunked" vulnerability.
Is really possible to determine this specific information using a few simple HTTP requests? Again, the simple answer is yes, the possibility exists.
Proof of concept tools and command line examples will be demonstrated throughout the talk to illustrate these new ideas and techniques. Various countermeasures will also be explored to protect your IIS or Apache web server from various fingerprinting techniques.
Prerequisites:
General understanding of Web Server technology and HTTP.
A set of good practices in a Liferay project following some of the OWASP Top 10 Web Application Security Risks recommendations.
The slides were used in a meetup of the Liferay User Group Spain.
Follow @LUGSpain in twitter
Author: @jajcampoy
Hardening Your Config Management - Security and Attack Vectors in Config Mana...Peter Souter
Configuration management is a great tool for helping with hardening and securing servers. But with any addition of new technology comes a new attack vector: Who watches the watchers?
Security is painful. Luckily the invention of configuration management tools has made this process easier, by allowing repeatable configuration for common hardening. However there comes a catch-22: How do we harden the configuration management itself?
When you have a tool that enables you to change systems at a fundamental level, it's a fairly tempting target for malicious agents, and one that would cause a lot of problems if compromised.
We'll be discussing some general patterns we can use to mitigate these problems: - Whitelisting "master" API's - Encrypting sensitive data - Adding a security element to code review
And we'll talk about some application specific options for some of most popular tools out there, such as Puppet, Chef, Ansible, cfengine and Salt.
+ Background & Basics of Web App Security, The HTTP Protocol, Web.
+ Application Insecurities, OWASP Top 10 Vulnerabilities (XSS, SQL Injection, CSRF, etc.)
+ Web App Security Tools (Scanners, Fuzzers, etc), Remediation of Web App
+ Vulnerabilities, Web Application Audits and Risk Assessment.
Web Application Security 101 was conducted by:
Vaibhav Gupta, Vishal Ashtana, Sandeep Singh from Null.
DerbyCon 2016
Nick Landers @monoxgas
External mail via Exchange is one of the most common services offered by organizations today. The Microsoft Office suite is even more prevalent making Outlook the most common mail client around. This talk focuses on the abuse of these two products for the purpose of gaining code execution inside remote networks. Subjects include E-Mail and password scraping, OWA/EWS brute forcing techniques, and new research into abusing Outlook mail rules for remote code execution. Learn about the capabilities of client side rules, the underlying Windows APIs, and how to modify these rule objects to make phishing attacks obsolete. Security Consultant at Silent Break Security. Professional Hacker for 2 years. Current work involves writing custom malware and researching unique attack vectors that abuse functionality in windows environments.
Application Security Vulnerabilities: OWASP Top 10 -2007Vaibhav Gupta
General concepts of web application security vulnerabilities primarily based on OWASP Top 10 list-2007(I know its too old :-))
I, along with Sandeep and Vishal, presented on this at IIIT-Delhi college in April, 2014
Attack Chaining: Advanced Maneuvers for Hack FuRob Ragan
Just as a good chess player thinks five moves ahead, a great penetration tester should be able to visualize their attack in order to compromise high-value targets. This presentation will explore how a penetration tester can learn to leverage attack chaining for maximum impact. A penetration test is supposed to be a simulation of a real-world attack. Real-world attackers do not use expensive automated tools or a checklist. Nor do they use a single technique or exploit to compromise a target. More commonly they combine several techniques, vulnerabilities, and exploits to create a “chained” attack that achieves a malicious goal. Chained attacks are far more complex and far more difficult to defend against. We want to explore how application vulnerabilities relate to one another and build a mind map that guides penetration testers through various attack scenarios. Prepare to be blown away on this roller coaster ride with real-world examples of massive compromises. If you are not a thrill seeker, this presentation may leave you a bit queasy.
The Golden Ticket: Docker and High Security Microservices by Aaron GrattafioriDocker, Inc.
True microservices are more than simply bolting a REST interface on your legacy application, packing it in a Docker container and hoping for the best. Security is a key component when designing and building out any new architecture, and it must be considered from top to bottom. Umpa Lumpas might not be considered "real" microservices, but Willy Wonka still has them locked down tight!
In this talk, Aaron will briefly touch on the idea and security benefits of microservices before diving into practical and real world examples of creating a secure microservices architecture. We'll start with designing and building high security Docker containers, using and examining the latest security features in Docker (such as User Namespaces and seccomp-bpf) as well as examine some typically forgotten security principals. Aaron will end on exploring related challenges and solutions in the areas of network security, secrets management and application hardening. Finally, while this talk is geared towards Microservices, it should prove informational for all Docker users, building a PaaS or otherwise.
Securing Network Access with Open Source solutionsNick Owen
My presentation from Atlanta Linux Fest on how to allow users secure access to your network using open source technologies. Examples include how to add two-factor authentication to Apache, OpenVPN, Astaro, NX etc.
Why You Should Replace Windows 11 with Nitrux Linux 3.5.0 for enhanced perfor...SOFTTECHHUB
The choice of an operating system plays a pivotal role in shaping our computing experience. For decades, Microsoft's Windows has dominated the market, offering a familiar and widely adopted platform for personal and professional use. However, as technological advancements continue to push the boundaries of innovation, alternative operating systems have emerged, challenging the status quo and offering users a fresh perspective on computing.
One such alternative that has garnered significant attention and acclaim is Nitrux Linux 3.5.0, a sleek, powerful, and user-friendly Linux distribution that promises to redefine the way we interact with our devices. With its focus on performance, security, and customization, Nitrux Linux presents a compelling case for those seeking to break free from the constraints of proprietary software and embrace the freedom and flexibility of open-source computing.
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
State of ICS and IoT Cyber Threat Landscape Report 2024 previewPrayukth K V
The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development.
The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers:
State of global ICS asset and network exposure
Sectoral targets and attacks as well as the cost of ransom
Global APT activity, AI usage, actor and tactic profiles, and implications
Rise in volumes of AI-powered cyberattacks
Major cyber events in 2024
Malware and malicious payload trends
Cyberattack types and targets
Vulnerability exploit attempts on CVEs
Attacks on counties – USA
Expansion of bot farms – how, where, and why
In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East
Why are attacks on smart factories rising?
Cyber risk predictions
Axis of attacks – Europe
Systemic attacks in the Middle East
Download the full report from here:
https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/
Unlocking Productivity: Leveraging the Potential of Copilot in Microsoft 365, a presentation by Christoforos Vlachos, Senior Solutions Manager – Modern Workplace, Uni Systems
Removing Uninteresting Bytes in Software FuzzingAftab Hussain
Imagine a world where software fuzzing, the process of mutating bytes in test seeds to uncover hidden and erroneous program behaviors, becomes faster and more effective. A lot depends on the initial seeds, which can significantly dictate the trajectory of a fuzzing campaign, particularly in terms of how long it takes to uncover interesting behaviour in your code. We introduce DIAR, a technique designed to speedup fuzzing campaigns by pinpointing and eliminating those uninteresting bytes in the seeds. Picture this: instead of wasting valuable resources on meaningless mutations in large, bloated seeds, DIAR removes the unnecessary bytes, streamlining the entire process.
In this work, we equipped AFL, a popular fuzzer, with DIAR and examined two critical Linux libraries -- Libxml's xmllint, a tool for parsing xml documents, and Binutil's readelf, an essential debugging and security analysis command-line tool used to display detailed information about ELF (Executable and Linkable Format). Our preliminary results show that AFL+DIAR does not only discover new paths more quickly but also achieves higher coverage overall. This work thus showcases how starting with lean and optimized seeds can lead to faster, more comprehensive fuzzing campaigns -- and DIAR helps you find such seeds.
- These are slides of the talk given at IEEE International Conference on Software Testing Verification and Validation Workshop, ICSTW 2022.
In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.
A tale of scale & speed: How the US Navy is enabling software delivery from l...sonjaschweigert1
Rapid and secure feature delivery is a goal across every application team and every branch of the DoD. The Navy’s DevSecOps platform, Party Barge, has achieved:
- Reduction in onboarding time from 5 weeks to 1 day
- Improved developer experience and productivity through actionable findings and reduction of false positives
- Maintenance of superior security standards and inherent policy enforcement with Authorization to Operate (ATO)
Development teams can ship efficiently and ensure applications are cyber ready for Navy Authorizing Officials (AOs). In this webinar, Sigma Defense and Anchore will give attendees a look behind the scenes and demo secure pipeline automation and security artifacts that speed up application ATO and time to production.
We will cover:
- How to remove silos in DevSecOps
- How to build efficient development pipeline roles and component templates
- How to deliver security artifacts that matter for ATO’s (SBOMs, vulnerability reports, and policy evidence)
- How to streamline operations with automated policy checks on container images
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
GridMate - End to end testing is a critical piece to ensure quality and avoid...ThomasParaiso2
End to end testing is a critical piece to ensure quality and avoid regressions. In this session, we share our journey building an E2E testing pipeline for GridMate components (LWC and Aura) using Cypress, JSForce, FakerJS…
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf91mobiles
91mobiles recently conducted a Smart TV Buyer Insights Survey in which we asked over 3,000 respondents about the TV they own, aspects they look at on a new TV, and their TV buying preferences.
3. WEB SECURITY
Threats, culprits & examples
Threats & how they work
How can we guard against them
Server Environment Security
Application level security
Transport Security
Browser based security
Questions
4. HACKERS: WHO / WHAT ARE THEY
Defacers
Content injection
Data Breaches
"Hactivists"
Intruders: Parasites / Squatters / Malware
Angler EK / Nautilus / Necurs
Layer 7 attacks - HTTP flood
9. USER AGENT SPECIFIC PARASITES
User-Agent:Googlebot/2.1 (+http://www.googlebot.com/bot.html)
10. USER AGENT SPECIFIC PARASITES
User-Agent:Googlebot/2.1 (+http://www.googlebot.com/bot.html)
User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) Chrome/51.0.2704.84 Safari/537.36
11. HACKERS: WHAT ARE THEY
Defacers / Malicious
Content injection
Data Breaches
"Hactivists"
Intruders: Parasites / Squatters / Malware
Angler EK / Nautilus / Necurs
Layer 7 attacks - HTTP flood
19. HACKERS: WHAT ARE THEY
Defacers / Malicious
Content injection
Data Breaches
"Hactivists"
Intruders / Botnets
Ransom: Layer 4 & 7 attacks - HTTP flood
20. DDOS / FLOOD ATTACKS
LAYER 4 LAYER 7
UDP Flood
SYN Flood
DNS Attacks
XML-RPC
HTTP GET/POST
SLOWLORIS
IP Stressers, Booters and shells
21. HACKERS: THEY HAVE IT EASY
Open configuration files
Browsable folders
Out of date CMS
Phishing / Social Engineering
Leverage other breaches / password reuse
Search Engines
24. HTTPS KEEPS YOU SAFE - RIGHT?
not if your
settings.php
is readable
25. HACKERS: THEY HAVE IT EASY
Open configuration files
Browsable folders
Out of date CMS
Phishing / Social Engineering
Leverage other breaches / password reuse
Search Engines
Shells
27. HACKERS: THEY HAVE IT EASY
Open configuration files
Browsable folders
Out of date CMS
Phishing / Social Engineering
Leverage other breaches / password reuse
Search Engines
28. HACKERS: THEY HAVE IT EASY
Open configuration files
Browsable folders
Out of date CMS
Phishing / Social Engineering
Leverage other breaches / password reuse
Search Engines
29. HACKERS: HOW THEY FEED - LOW HANGING FRUIT
Internet of things: shodan.io
Google Dorks
Exploit-db
Drive by
Show off: zone-h
30. Internet of things: shodan.io
Google Dorks
Exploit-db
Drive by / Trawlers
Show off: zone-h
Example to locate Drupalgeddon vulnerable sites - redacted
HACKERS: HOW THEY FEED - LOW HANGING FRUIT
31. Normal day: Attempts to use known hacks by 255 hosts were logged 753 time(s)
/admin/fckeditor/editor/filemanager/upload/php/upload.php
/wp-config.php.bak
/wp-login.php
/backup.sql
/Ringing.at.your.dorbell!
/admin/assets/ckeditor/elfinder/php/connector.php
/wp-admin/admin-ajax.php?action=revslider_ajax_action
//phpMyAdmin/scripts/setup.php
/SQLite/SQLiteManager-1.2.4/main.php
/jenkins/login
/joomla/administrator
/wp-content/plugins/sell-downloads/sell-downloads.php?file=../../.././wp-config.php
/modules/coder/LICENSE.txt
/modules/restws/LICENSE.txt
/sites/all/modules/webform_multifile/LICENSE.txt
SSHD Illegal users:
admin
nagios
ubnt
fluffy
guest
info
library
linux
oracle
shell
test
unix
webmaster
.....
HACKERS: HOW THEY FEED - TRAWLERS
32. Internet of things: shodan.io
Google Dorks
Exploit-db
Drive by / Trawlers
Show off: zone-h
HACKERS: HOW THEY FEED - LOW HANGING FRUIT
33. WEB SECURITY
How can we guard against threats
Server Environment Security
Application level security
Transport Security
Browser based security
36. ATTACK SURFACES
Server (Layer 3)
Other servers (backup, monitoring, local)
Application / Layer 7
In transit
The browser
37. SERVER: PORTS ARE OPEN DOORS
Know what ports you have open, what is listening on them
and who can access.
On the server:
0.0.0.0:9080 LISTEN 1804/varnishd
127.0.0.1:25 LISTEN 2583/exim4
144.76.185.80:443 LISTEN 1037/pound
0.0.0.0:2812 LISTEN 1007/monit
127.0.0.1:6082 LISTEN 1799/varnishd
0.0.0.0:3306 LISTEN 1727/mysqld
127.0.0.1:11211 LISTEN 849/memcached
127.0.0.1:6379 LISTEN 946/redis-server 12
0.0.0.0:10000 LISTEN 2644/perl
144.76.185.80:80 LISTEN 1037/pound
0.0.0.0:22 LISTEN 851/sshd
0 :::9080 LISTEN 1804/varnishd
0 ::1:25 LISTEN 2583/exim4
0 :::8443 LISTEN 1779/apache2
0 :::8080 LISTEN 1779/apache2
0 :::22 LISTEN 851/sshd
$netstat -nlp | grep tcp
From outside:
$nmap xxx.xxx.xxx.xxx
Not shown: 990 filtered ports
PORT STATE SERVICE
80/tcp open http
443/tcp open https
554/tcp open tsp
7070/tcp open realserver
8080/tcp open http-proxy
8443/tcp open https-alt
9080/tcp open glrpc
10000/tcp open snet-sensor-mgmt
Red: IP / MAC restricted
Grey: Router proxies
38. SERVER: CONFIGURE YOUR FIREWALL
Allow if:
White listed
Allowed port
Not blocked
Rate ok
Otherwise:
Reject / Drop
39. NETWORK: ATTACKS & BLOCK LISTS
The IP 195.154.47.128 has just
been banned by Fail2Ban after
3 attempts against ssh.
Firewall
195.154.47.12
CVE-2016-2118 (a.k.a. BADLOCK)
SSH Brute force
Block
Blocklist
Drop
Firewall
IPSET
IPSET
Any Port
1
2
3
4
5
Log
Report to blocklist
Source/share lists
of bad ips
Block on first visit
Initial
Server
Anyother
Server
Compromised Zombie
Exclude whitelist
44. CONTROL YOUR APPLICATION ENVIRONMENT
Migrate all .htaccess to vhosts
Get a static IP
Limit what files can be read
Limit where PHP can be 'run'
Restrict file permissions (640 / 440)
Update your CMS
45. DENY ACCESS TO SENSITIVE FILES
# Protect files and directories from prying eyes.
<FilesMatch ".(engine|inc|info|install|make|module|profile|test|po|sh|.*sql|
theme|tpl(.php)?|xtmpl)(~|.sw[op]|.bak|.orig|.save)?$|^(..*|Entries.*|
Repository|Root|Tag|Template|composer.(json|lock))$|^#.*#$|.php(~|.sw[op]|
.bak|.orig.save)$">
Require all denied
</FilesMatch>
Disallow access to files by type
Disallow access to hidden directories (i.e. git)
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} "!(^|/).well-known/([^./]+./?)+$" [NC]
RewriteCond %{SCRIPT_FILENAME} -d [OR]
RewriteCond %{SCRIPT_FILENAME} -f
RewriteRule "(^|/)." - [F]
</IfModule>
<Directorymatch "^/.*/.git+/">
Require all denied
</Directorymatch>
.well-known
use for standard files:
favicon, DNT, letsencrypt etc
see:
https://tools.ietf.org/html/rfc5785
https://www.iana.org/assignments/well-
known-uris/well-known-uris.xhtml
https://www.drupal.org/node/2408321
46. LIMIT PHP EXECUTION
<Directory /var/www/yoursite/htdocs/sites/default/files>
# Turn off all options we don't need.
Options None
Options +SymLinksIfOwnerMatch
# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
# Override the handler again if we're run later in the evaluation list.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>
# If we know how to do it safely, disable the PHP engine entirely.
<IfModule mod_php5.c>
php_flag engine off
</IfModule>
</Directory>
Protect folders: tmp, files and private folders and any others.
Note you will need these in the folders as .htaccess too just to stop Drupal
complaining
47. No PHP files other than index.php
No text files other than robots.txt
<FilesMatch "([^index].php|[^myrobots|robots].*.txt)$">
AuthName "Restricted"
AuthUserFile /etc/apache2/.htpasswds/passwdfile
AuthType basic
Require valid-user
Require ip 123.123.123.123 <- Your static IP
Require ip 127.0.0.1
</FilesMatch>
LIMIT PHP EXECUTION
48. DO YOUR PHP FILES NEED TO BE IN THE DOCROOT?
https://www.drupal.org/node/2767907
49. APPLICATION LEVEL ATTACKS
Requires Configuration
Slowloris
Know your traffic levels
MOD EVASIVE
Requires Configuration
Know your application patterns
Cautious whitelisting
MOD SECURITY
52. SECURE IN TRANSIT
Setup HTTPS / TLS
Free certificates
Strong Ciphers
Upgrade insecure requests
Strict Transport Security (HSTS)
Pin public keys
Audit TLS
53. TLS AUDIT
Not just for the A+
Consider other browsers / agents
e.g. Screaming frog on OSX / Java
54. CASE STUDY
Your page is everyone's canvas
<style type="text/css">.gm-style .gm-style-cc
span,.gm-style .gm-style-cc a,.gm-style .gm-
style-mtc div{font-size:10px}</style>
<iframe> <script>
56. SECURE HEADERS
X-Content-Type-Options: nosniff
Guards against "drive-by download attacks" by preventing
IE & Chrome from MIME-sniffing a response away from the
declared content-type.
X-Frame-Options: DENY
Provides Clickjacking protection
X-Xss-Protection: 1; mode=block
Configures the XSS audit facilities in IE & Chrome
X-Permitted-Cross-Domain-Policies: none
Adobe specific header that controls whether Flash & PDFs
can access cross domain data - read the crossdomain.xml
57. XSS - CROSS SITE SCRIPTING
Cross-Site Scripting (XSS) attacks are a type of injection,
in which malicious scripts are injected into otherwise
benign and trusted web sites.
X-XSS-Protection: 0
X-XSS-Protection: 1
X-XSS-Protection: 1; mode=block
(do not render the document if
XSS is found)
(disable XSS filter/auditor)
(remove unsafe parts; this is
the default setting if no
X-XSS-Protection header is
present)
http://blog.innerht.ml/the-misunderstood-x-xss-protection/
58. SECURE HEADERS
Strict-Transport-Security: max-
age=31536000; includeSubDomains env=HTTPS
Informs the UA that all communications should be treated
as HTTPS. Prevents MiTM & SSL-stripping attacks
Public-Key-Pins
By specifying the fingerprint of certain cryptographic
identities, you can force the UA to only accept those
identities going forwards.
Content-Security-Policy:
Provides details about the sources of resources the
browser can trust. e.g. Images, scripts, CSS, frames
(both ancestors & children)
See https://securityheaders.io
59. CSRF - CROSS SITE REQUEST FORGERY
an attack that forces an end user to execute unwanted
actions
Drupal protects you against this
60. CONTENT SECURITY POLICY
Connect Source
Media Source
Object Source
Form Action
Upgrade Insecure
Requests
Block All Mixed
Content
Sandbox
Reflected XSS
Base URI
Manifest Source
Plugin Types
Referrer
How to test:
Default Source
Script Source
Style Source
Image Source
Font Source
Child Source
Frame Ancestors
Report Only
Report URI
Others:
Typical elements:
Audit!
66. FINAL THOUGHTS
Bake your principles into practices - Ansible - immutable infrastructure
•Follow some Opsec people:
@Scott_Helme, @troyhunt, @ivanristic,
@briankrebs
•Does your site have to be dynamic?
•Letsencrypt - https.
•Security is a department - not a one off
•Learn your attack surface, test on Tor
•VPN, Password apps, 2Factor Authentication
•Work together (bad ips, honeypot, block list) -
don't hit back