作者归档：flyinweb

ZAP介绍

发表回复

Zed Attack Proxy简写为ZAP，是一个简单易用的渗透测试工具，是发现Web应用中的漏洞的利器，更是渗透测试爱好者的好东西。

ZAP下载地址：https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

ZAP中国：http://www.owasp.org.cn/

BackTrack5R3中集成了ZAP，下面我来演示了一下ZAP的简单实用。

打开方式：

1.

cd /pentest/web/owasp-zap
./zap.sh

2.

Applications|BackTrack|Vulnerability Assessment|Web Application Assessment|Web Vulnerability Scanners|owasp-zap

使用方法：

1.设置

ZAP像Burp suite一样使用代理的方式来截取网站。

ZAP介绍

在Tools|Local proxy中设置相关选项。

ZAP介绍

默认已经设置好了，如果端口冲突就自己改。

在Firefox中设置代理。

Edit|Preferences|Advanced|Network|Setting

选择Manual proxy configuration单选项。

ZAP介绍

浏览目标机器，这里使用Metasploitable2来示例。

用Firefox访问后，在ZAP中出现了Sites。

2.Spider site

右键选择Attack|Spider site

ZAP介绍

扫描要很久，因为是示例所以就先停了。

3.Brute Force

在Site选择目标，在List中选择字典。有big medium small等类型的字典。

ZAP介绍

4.Port Scanner

ZAP介绍

虽然扫描速度很快，但是不够Nmap准确。

5.Active Scan

主动扫描是ZAP最强大的功能之一。

ZAP介绍

6.Alerts

扫描出来的漏洞就在这里了。

ZAP介绍

7.插件

Remove Unwanted HTTP Response Headers

发表回复

From:https://blogs.msdn.microsoft.com/varunm/2013/04/23/remove-unwanted-http-response-headers/

The purpose of this blog post is to discuss how to remove unwanted HTTP response headers from the response. Typically we have 3 response headers which many people want to remove for security reason.

  • Server – Specifies web server version.
  • X-Powered-By – Indicates that the website is “powered by ASP.NET.”
  • X-AspNet-Version – Specifies the version of ASP.NET used.

Before you go any further, you should evaluate whether or not you need to remove these headers. If you have decided to remove these headers because of a security scan on your site, you may want to read the following blog post by David Wang. 继续阅读 →

How to remove all information about IIS Server from Response Header?

发表回复

It is amazing technique to remove any information from response header about IIS server is very scarce online. So I decide to blog this.

The reason why you would want this is because you would not want to readily disclose what version of server or what server you are running. For example see blow response header I gathered from  one of the site running IIS:

 

Notice that you have information about Server, X-AspNet-Version, X-Powered-By. There are enough information to know it is running on IIS. Why hide these info? Because why if certain version of IIS server had security hole that the hacker can expose? Sometimes, in Enterprise environment there will be external third party security firms like WhiteHat tagging such exploits so you have to fix. 继续阅读 →

Adjusting child processes for PHP-FPM (Nginx)

发表回复

Problem:

The following warning message appears in the logs:

[26-Jul-2012 09:49:59] WARNING: [pool www] seems busy (you may need to increase pm.start_servers, or pm.min/max_spare_servers), spawning 32 children, there are 8 idle, and 58 total children
[26-Jul-2012 09:50:00] WARNING: [pool www] server reached pm.max_children setting (50), consider raising it

It means that there are not enough PHP-FPM processes. 继续阅读 →

CentOS / RHEL 7 : How to modify Network Interface names

发表回复

On CentOS / RHEL 7, a new naming scheme is introduced.
For instance:

# ip addr show
.....
eno1: [BROADCAST,MULTICAST,UP,LOWER_UP] mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 6c:0b:84:6c:48:1c brd ff:ff:ff:ff:ff:ff
inet 10.10.10.11/24 brd 10.10.10.255 scope global eno1
inet6 2606:b400:c00:48:6e0b:84ff:fe6c:481c/128 scope global dynamic
valid_lft 2326384sec preferred_lft 339184sec
inet6 fe80::6e0b:84ff:fe6c:481c/64 scope link
valid_lft forever preferred_lft forever

This post describes how to revert to legacy naming scheme with Network Interface names as eth0, eth1, etc. 继续阅读 →

Linux audit files to see who made changes to a file

发表回复

How do I audit file events such as read / write etc? How can I use audit to see who changed a file in Linux?

The answer is to use 2.6 kernel’s audit system. Modern Linux kernel (2.6.x) comes with auditd daemon. It’s responsible for writing audit records to the disk. During startup, the rules in /etc/audit.rules are read by this daemon. You can open /etc/audit.rules file and make changes such as setup audit file log location and other option. The default file is good enough to get started with auditd.

In order to use audit facility you need to use following utilities
=> auditctl – a command to assist controlling the kernel’s audit system. You can get status, and add or delete rules into kernel audit system. Setting a watch on a file is accomplished using this command:

=> ausearch – a command that can query the audit daemon logs based for events based on different search criteria.

=> aureport – a tool that produces summary reports of the audit system logs.

Note that following all instructions are tested on CentOS 4.x and Fedora Core and RHEL 4/5 Linux. 继续阅读 →

HOWTO configure the auditing of the system (auditd)

发表回复

Introduction

The audit service is provided for system auditing. By default, this service audits about SELinux AVC denials and certain types of security-relevant events such as system logins, account modifications, and authentication events performed by programs such as sudo.

Under its default configuration, auditd has modest disk space requirements, and should not noticeably impact system performance. The audit service, configured with at least its default rules, is strongly recommended for all sites, regardless of whether they are running SELinux. Networks with high security level often have substantial auditing requirements and auditd can be configured to meet these requirements:

  • Ensure Auditing is Configured to Collect Certain System Events
  • Information on the Use of Print Command (unsuccessful and successful)
  • Startup and Shutdown Events (unsuccessful and successful)
  • Ensure the auditing software can record the following for each audit event:
    • When the event appears
    • Who initiated the event
    • Type of the event
    • Success or failure of the event
    • Origin of the request (example: terminal ID)
    • For events that introduce an object into a user’s address space, and for object deletion events, the name of the object, and in MLS systems, the objects security level.
  • Ensure daily of the audit logs
  • Ensure that the audit data files have restrictive permissions (at least 640).

继续阅读 →

使用Informix审计功能

发表回复

关于本教程

在本教程中，您将了解到如何通过预防对数据或其他数据库对象进行未授权查看和更改来保障数据安全。此处提供的材料主要包括考试第 8 部分的相关内容，标题为 Security，本教程涉及的主题包括：

  • 连接安全
  • 网络加密
  • 审计
  • 自主访问控制

目标

通过对本教程的学习，您将能够：

  • 了解身份验证、授权和加密的概念及使用方法
  • 允许 non-OS 用户访问数据库
  • 利用 onaudit 在数据库服务器上设置并配置安全审计
  • 利用可信连接和可信上下文连接来增强安全性
  • 使用角色特权来保护数据安全
  • 设置角色分离来加强对数据库服务器用户的访问控制

先决条件

Informix 11.70 安装在本系列教程的第 1 部分进行了介绍。如果还没安装，可下载并安装 IBM Informix 11.70 的副本。Informix 服务器能够帮助您了解 IBM Informix V11.70 系统管理认证考试当中涉及的许多概念。

系统要求

学习本教程时，不需要 IBM Informix 的副本。但是，如果下载了 Informix Innovator-C Edition（参见 参考资料）的免费试用版，并与本教程配套使用，您将收获更大。 继续阅读 →

Informix数据库的安全审计

发表回复

Informix动态服务器提供两个级别的访问特权，来保证数据库的安全性。数据库特权控制对数据库的访问和在数据库上创建表和索索引的权力。表的特权指定用户在特定的表上所能进行的操作。

Informix动态服务器支持表级的修改，插入和删除的安全性，同时增强了列级的更新和查询的安全性。分离特权语句用于向用户授予适当的访问基级别的特权，或回收特权。由于Informx安全性是在用户级别上的，因此，不需要进行分离的数据库登录。

存储过程通过建立他们自己的，有别于数据库的许可权限而提供了附加的安全机制。存储过程的所有者向用户授予执行该存储过程的权限，允许用户执行该存储过程中所有的SQL操作，但对其他的数据库访问加以限制。通过使用存储过程来限制用户执行某些用户执行某些数据库的操作，数据库管理员可以提高系统的安全性 继续阅读 →

Setting up IDS auditing, onaudit

发表回复

Technote (FAQ)

Question

What are the minimum requirements needed to start IDS auditing?
What are the minimum requirements needed to start onaudit?

Answer

BACKGROUND

IBM® Informix® Dynamic Server™ (IDS) auditing enables the recording of selected user activities on the database server.

This article briefly discusses the set up procedure and provides a demonstration for database server-managed auditing using Informix Dynamic Server for Unix without Role Separation.

继续阅读 →