Category: Security
-
PHP Security
A reference book that gives snippets on how to secure your PHP application Input Validation Possible input abuses: Input of metacharacters (e.g. [! $ ^ & * ( ) ~ [ ] \ | { } ‘ ” ; < > ? – `]) Input of the wrong type of data Input of the wrong […]
-
Mastering Linux Security and Hardening
A book to cover tips and tricks to securing a Linux machine. It covers both recommended configurations to make your machine more secure, as well as investigative techniques (i.e. how to read certain syslogs or setup remote logging). In this post, I’ll be focusing on mainly recommended configurations and tweaks to secure a Linux Machine. […]
-
Threat Modeling
Summary of the book: https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998 Overall a superb introduction to the activity of performing threat modeling of software. Although, some chapters do feel like filler content, and the crux of the topic lies in a handful of chapters. Threat Modeling of the System The purpose of threat modeling is to elicit the possible attacks that […]
-
Zero Trust
In this post, we’re gonna talk about Zero Trust Networks and Architectures. Zero Trust, like DevOps, isn’t a set of tools that you buy and suddenly you have Zero Trust, but rather it’s also about culture, policies, and more broadly, organization of resources. The whole premise of Zero Trust is to move away from the […]
-
DevSecOps
We’re all mostly familiar with DevOps, which a culture or methodology a company takes that enables quick deployment time. The main principles of DevOps in this case heavily relies on automation of several tasks, from build the program, running test cases, creating of environments, and deploying it to staging or production. The first two tasks […]
-
Is SUNBURST DNS Tunneling?
With all the news surrounding the breach of SolarWinds update server, and subsequently a majority of clients downloading and installing a backdoor, there has been a lot of analysis of the malware, and the supposed DGA that is being generated. I’m here to question if the behavior fits more of a DNS tunneling event, instead […]
-
DNS: Hunting Perspective
In a separate post, we talked about the possible different attack vectors of DNS. That post is not entire complete, and there are many more creative ways to use DNS as an attack vector. In this post however, we’re going to be looking at the more technical aspects of DNS, such as the protocols, byte […]
-
Server Side Request Forgery
Server Side Request Forgery, or SSRF, is an attack where the attacker is able to make a request to an internal resource by pivoting through the server. By leveraging on the server to make a request to the internal resource, the request become seen as legitimate, because internal systems usually trust each other. SSRF through […]
-
XSS – Revisited
I’ve been doing this lessons by Pentesterlabs, and i’ve learnt a few new things there, which is always great! To be honestly, i’ve never had any proper training or course in terms of offensive cyber security, especially the web. My experiences have mostly been centered around the Linux kernel, which is pretty niche and narrow. In […]
-
DNSSEC
In the previous post, we talked about some of the attack vectors on the DNS. In this post, we’re going to be talking about DNSSEC, which is an attempt to make the DNS more secure. A point to note, DNSSEC does not provide Confidentiality, but only Integrity. Integrity in this case is ensuring that the […]
Code of The Day 