A good grasp of vulnerabilities and how they come to be will help you more than a tool to be honest
Analysis tools only get you so far. In the best case, they show you something you overlooked, and in the worst case they either lull you into a false sense of security or spit out 18.000.000.000 error messages at you that mean nothing
@JohnZhau Probably more important is using a framework that has standard methods of use that are secure by default
It's like the difference between using React/Angular vs jQuery
With the way React and Angular are built, you have to really try hard to end up with an XSS vulnerability. With jQuery you have to really know what you are doing to be safe
Although it is overkill for many project, Django is a good example: coding tools like SQLAlchemy take care of 99% of your SQLi issues automatically. The template system also helps substantially with XSS. Most applications don't need to issue system commands or use eval, so the risk of RCE is usually pretty low anyway.
If you start with something that has decent security baked in, then you just need some good awareness of where those things are not available, and you can try to be extra careful
Although I suppose the above is very focused on web applications...
@MechMK1 Both of these statements are spot on. Tooling can help, but it will only get you so far. I'm all for automation, but for many organizations the best place to start is training. Tooling won't do much if the engineers don't know, care, or understand the basics about security.
Harassment has happened before, but having a whole group of employees doing it?
And they seemed to be very thorough about it
> The eBay team allegedly responsible for the campaign planned to eventually step in and offer to help make it stop. This "white knight" strategy, as the criminal complaint calls it, was intended to create goodwill toward eBay, so that coverage would improve
Dave Bittner on the Cyberwire compared it to tactics out of a cheap detective novel
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance and reliability". Ultimate goal is to enable SPNEGO for single-sign-on within the domain.
Previously, we happily ...
I've never heard of someone using LDAP and Apache to authenticate users to their web application. That just seems crazy to me! Or am I missing something obvious? How does a company end up in that boat? Heaven help you if you need to upgrade apache or you want to migrate to a different hosting setup, or even a new hosting provider...
you don't need to trust internal devs with horrible security awareness to secure your application, every employee knows how the authentication prompt looks like, so less phishing (in theory)
Maybe it just seems like a horrible idea to me because it scales so badly. Not just in terms of actual application scale, but application changes. What about when the application need to be internet-facing and not just internal? When you need to let it other users? When you need some RBAC?
my company does this on some services, and it's fine...
some services use the LDAP backend inside the application, so when I change my intranet password, it works everywhere, but some have an internal password database and I need to change there everytime I am forced to change my intranet password
but feels ugly and ancient when I am greeted by the Firefox/Vivaldi HTTP Auth prompt... reminds me of the turn of the century
got a call from a client, they are being attacked right now... gotta go there.
Do ya'll think I can post this completely rephrased question as a new question (since chances that people will vote for re-opening are minimal), or will it be closed again? security.stackexchange.com/questions/233245/…
@RoryMcCune It's not the LDAP that seems strange to me, it's having Apache use HTTP Basic auth to push an LDAP integration instead of using an identity provider and LDAP integration to manage the login directly in the web application. Using an LDAP integration to login to a web app? Absolutely. Using an LDAP integration through an apache module to log in to your LDAP? Crazy! I see why someone might choose to do that on an internal network, but it's still a terrible idea....
lazy devs... they don't have to integrate the auth in their apps, check every page if the auth is OK, differentiate public and private pages, and so on... just copy the .htaccess from the colleague, alter the message, and done!
.htaccess files have always seemed like a terribly hacky solution to me... Then again many features designed exclusively for convenience end up being like that. I remember downloading a PHP framework that came with a .htaccess file placed in every directory because it assumed you were using Apache and would just drop everything in your public directory
@MartinFürholz I think your best bet is trying to come up with an exploit yourself. Or more generally: what do you think would be a way to take advantage of the API behavior?
@ConorMancone Well I (attacker) could make someone legitimately use my information/data for this request. And then block his next GET request somehow, so that the next time he uses the app he will execute it with my previous information a second time.
@MartinFürholz That's a lot of "ifs". It may be possible but at the end of the day you need to prove vulnerability and business impact (at least in a bug bounty situations). I help manage our bug bounty program and we see some "I bet you could totally do X". Most of the time the submitter has missed important parts of the system so their "I bet" is completely wrong. It is one thing to suspect a vulnerability, but the important (and hard part) is building an exploit.
So like I said, you need to make an exploit. That means understanding how their system works, understanding the actual HTTP flow, and then figuring out how to inject yourself in it. Unfortunately you are the person in the best position to do all of that - without sharing all the details it is unlikely that anyone here will be able to help you
@ThoriumBR indeed! All the more reason why I think it is crazy to rely on an Apache module to manage authentication. That leaves you with absolutely no flexibility. I mean sometimes you gotta do what you gotta do to get things working, but still....
i want to make cc checker
So i found a shopping website and i try to checkout some thing.
When i try checkout by wrong card number the message that get (Invalid account number) it mean the card is wrong and if the card number is correct we get an message with (CVV2 Mismatch)
the problem the res...
It actually sounds like someone is trying to build a system to test stolen credit card numbers and in doing so posted a stolen credit card number on SE... However it's hard to tell because it is very incoherent...
i want to make cc checker
So i found a shopping website and i try to checkout some thing.
When i try checkout by wrong card number the message that get (Invalid account number) it mean the card is wrong and if the card number is correct we get an message with (CVV2 Mismatch)
the problem the res...
