Showing posts with label Security. Show all posts
Showing posts with label Security. Show all posts

Friday, 24 June 2016

What are the common Security threats ?



  • Man in the middle attacks (MIM / MITM / MITMA)
    • Attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other.
    • Example
      • Alice "Hi Bob, it's Alice. Give me your key." →     Mallory     Bob
      • Alice     Mallory "Hi Bob, it's Alice. Give me your key." →     Bob
      • Alice     Mallory     ← [Bob's key] Bob
  • Session hijacking (replaying data)
    • Exploitation of a valid computer session
    • Also called Cookie hijacking
      •  Theft of a magic cookie used to authenticate a user to a remote server
  • Password cracking
  • Phishing
    • Attempt to acquire sensitive information such as usernames, passwords, and credit card details
    • Phishing emails may contain links to websites that are infected with malware 
    • Often directs users to enter details at a fake website with similar look and feel
  • Social hacking / engineering
    • Psychological manipulation of people into performing actions or divulging confidential information.
    • Techniques
      • Baiting : Leaving a malware infected CD / USB drive (preferably, Auto-run) expected to be used by a company staff
      • Quid pro quo : Calling random numbers at a company, claiming to be calling back from technical support and gain access or launch malware for the solution of the problem
      • Phishing, IVR and Phone Phishing
      • Tailgating
      • Pretexting, Diversion theft

  • Network sniffing
    • Locating network problems by allowing you to capture and view the packet level data on your network 
  • Cross-site scripting
    • Injecting client-side scripts into web pages viewed by other users
    • used to bypass access controls 
  • SQL Injection
    • SQL code injection technique, used to attack data-driven applications 
  • Denial-of-service (DoS)
    • Attempt to make a machine or network resource unavailable to its intended users

What a Security Model should contain ?


  • Underlying System infrastructure (Hardware, including the Networking layer and components)
  • User Authentication
  • User Authorization
  • Auditing
  • Data encryption
  • System hardening against specific attacks

How many ways to implement Application Security ?


Application security
  • Authentication and Authorization : Using credentials
  • Message-level data integrity : Using XML signatures 
  • Message-level and transport confidentiality : Using encryption (SSL)

What are different terminologies in Security ?


  • Principal : Entity (Person/System) that can be authenticated by a security module before system access.
  • Credential : Container of information used to authenticate a principal

Monday, 25 April 2016

How to use Fiddler ?

Fiddler is a free and open-source packet analyzer. 
Usage 
  • Network troubleshooting
    Analysis software
    Communications protocol development

Fiddler captures HTTP and HTTPS traffic data between browsers and servers.

Overview
Fiddler sits between the HTTP client and server and listened on a port.
The requests is sent to Fiddler proxy bridge rather than the real server, Fiddler forward the request to server and receive the response and then back to browser.



Using Fiddler
Download and install Fiddler.

Check overall Web sessions
Open a web page in a browser.
Fiddler lists the web requests in web sessions panel, while if you visit more web pages, the recorded requests will continue growing and keep in order.
Information displayed in web session :
  • # Request ID generated by Fiddler
  • Result : Result code from the HTTP response
  • Protocol : The protocol (HTTP / HTTPS / FTP) used by this session
  • Host : Hostname of the server to which the request was sent
  • URL : The path and file requested from the server
  • Body : The number of bytes in the response body
  • Caching : Values from the response’s expires or Cache-Control headers
  • Process : The local Windows process from which the traffic originated
  • Content-Type : The Content-Type header from the response
  • Custom : A text field you can set via scripting
  • Comments : A text field you can set from scripting or the session’s context menu

 
 
Check Inspectors
Click on a HTTP session, then it will display "Inspectors" tab.
Request Inspectors
  • Headers : Request headers and status
  • TextView : Request body
  • WebForms : Request parameters and fields data
  • HexView : Request body in a hexadecimal view
  • Auth : Authentication parameters
  • Cookies : Cookies data in key / value pairs
  • XML , JSON : Request body as an XML DOM in a tree view or JSON

Response Inspectors
  • Transformer : Removes GZip, DEFLATE, and CHUNKED encodings for easier debugging
  • Headers : Response headers and status
  • TextView : Response body
  • HexView : Response body in a hexadecimal view
  • ImageView : Response body as an Image. Supports all .NET image formats.
  • XML : Shows the response body as an XML DOM in a tree view
  • Privacy : Provides P3P statement in the response headers, if present

 


Check statistics
It show the estimated performance statistics for the selected HTTP sessions.
It is useful for performance turning.

Sunday, 24 April 2016

DSA vs. RSA keys


DSA vs. RSA keys

DSA
  • generates a smaller signature than RSA
  • signing is faster than RSA
  • verifying is slower than RSA
  • can only be used for signing/verification
    • RSA can be used for encryption/decryption also

What are SSH keys ?


SSH keys are used to login to a remote server with SSH.

It is more secure way than using a password, as passwords can be cracked.

When you generate a key pair , it provides you with two long string of characters :

  •  A public key : Place public key on the server
  •  A private key : Unlock public key from a client that already has the private key

When public key on server matches with the private key on client, system unlocks it without the password.

You can protect the private key with a passphrase.

How to setup SSH keys ?


Create the key pair on the client machine
ssh-keygen -t rsa
Enter file in which to save the key (/home/shaan/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):

Public key will be located in /home/shaan/.ssh/id_rsa.pub 
Private key will be located in /home/shaan/.ssh/id_rsa

  
Copy the Public Key to server
Copy the public key into the server's authorized_keys file with the ssh-copy-id command : 
ssh-copy-id user@host_or_ip

or series of commands : 
  • Copy the contents of ~/.ssh/id_rsa.pub into the file ~/.ssh/authorized_keys on the machine to which you want to connect.
  • If the file ~/.ssh/authorized_keys exists , append the contents of the file ~/.ssh/id_rsa.pub to the file ~/.ssh/authorized_keys on the other machine.
           
cat ~/.ssh/id_rsa.pub | ssh user@host_or_ip "mkdir -p ~/.ssh && cat >>  ~/.ssh/authorized_keys"

Put the changes into effect by :
Restart SSH service


TROUBLESHOOTING
Check on local and remote servers, if OpenSSH is running 
ssh -V


Check and set permissions of .ssh directory on remote server
chmod 755 ~/.ssh
chmod 644 ~/.ssh/authorized_keys

Check and start the SSH Agent on local server, if not running
ps -ef | grep ssh-agent
ssh-agent $SHELL

Check SSH login to remote server from local
ssh -l username remote_host

Saturday, 23 April 2016

How to use Fiddler ?


Fiddler is a free and open-source packet analyzer.
Usage  
  • Network troubleshooting 
  • Analysis software 
  • Communications protocol development

Fiddler captures HTTP and HTTPS traffic data between browsers and servers.

Overview
Fiddler sits between the HTTP client and server and listened on a port.
The requests is sent to Fiddler proxy bridge rather than the real server, Fiddler forward the request to server and receive the response and then back to browser.


Using Fiddler
Download and install Fiddler.

Check overall Web sessions
Open a web page in a browser.
Fiddler lists the web requests in web sessions panel, while if you visit more web pages, the recorded requests will continue growing and keep in order.

Information displayed in web session :
  • # Request ID generated by Fiddler
  • Result : Result code from the HTTP response
  • Protocol : The protocol (HTTP / HTTPS / FTP) used by this session
  • Host : Hostname of the server to which the request was sent
  • URL : The path and file requested from the server
  • Body : The number of bytes in the response body
  • Caching : Values from the response’s expires or Cache-Control headers
  • Process : The local Windows process from which the traffic originated
  • Content-Type : The Content-Type header from the response
  • Custom : A text field you can set via scripting
  • Comments : A text field you can set from scripting or the session’s context menu
 



Check Inspectors
Click on a HTTP session, then it will display "Inspectors" tab.
Request Inspectors
  • Headers : Request headers and status
  • TextView : Request body
  • WebForms : Request parameters and fields data
  • HexView : Request body in a hexadecimal view
  • Auth : Authentication parameters
  • Cookies : Cookies data in key / value pairs
  • XML , JSON : Request body as an XML DOM in a tree view or JSON

Response Inspectors
  • Transformer : Removes GZip, DEFLATE, and CHUNKED encodings for easier debugging
  • Headers : Response headers and status
  • TextView : Response body
  • HexView : Response body in a hexadecimal view
  • ImageView : Response body as an Image. Supports all .NET image formats.
  • XML : Shows the response body as an XML DOM in a tree view
  • Privacy : Provides P3P statement in the response headers, if present
 


Check statistics
It show the estimated performance statistics for the selected HTTP sessions.
It is useful for performance turning.

Friday, 22 April 2016

pem vs. ppk files


pem file is used to connect to a Cloud VM (like, Amazon EC2) via SSH.
pem file cannot be used to connect on Windows through puTTY - A SSH client
So, .pem file must be converted to .ppk

How to convert pem to ppk ?
Install PuTTY and open PuTTYGen.
Open menu "Conversions" and click Import key
Load .pem file that you downloaded and click Save Private key
Note : Leave passphrase blank.

Save the ppk file at the location which is configured in PuTTY for saving keys.

How to generate SSH keys on Windows ?


1. Download and start PuTTYGen.
2. Choose SSH2 DSA in the "Parameters" section and press Generate button.
3. Move your mouse randomly in order to generate the key pairs.
4. Enter a key comment.
5. Type in the passphrase (to protect your key) and confirm it. It will be asked when you connect via SSH.
6. Click "Save private key" and save your private key.
7. Click "Save public key" and save your public key.

Types of Cookies


1. Session cookies
Temporary cookie files, which are erased when you close your browser.
When you restart your browser and go back to the site that created the cookie, the website will not recognize you.

You will have to login again or select your preferences/themes again then a new session cookie will be generated, which will store your browsing information and will be active until you leave the site and close your browser.


2. Persistent cookies
These remains on your hard drive until you erase them or they expire.
How long a cookie remains on your browser depends on how long the visited website has programmed the cookie to last.

Tuesday, 29 March 2016

Decoding with base-64 and un-GZIP-ing the encoded string


import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.util.zip.GZIPInputStream;
import org.apache.commons.codec.binary.Base64;

public static String decodeBase64AndUnGzip(String inputStr) 
    throws IOException {
     int BUFFER_SIZE = 4096;
     byte[] buffer = new byte[BUFFER_SIZE];
        
     // decode the input string using base 64
     byte[] decodedStr = Base64.decodeBase64(inputStr);
     // Get the GZIP input stream
     InputStream input = new GZIPInputStream( 
                          new ByteArrayInputStream(decodedStr) );
     // Make a byte array in memory
     ByteArrayOutputStream output = new ByteArrayOutputStream();
     // Read the un-GZIPed contents and
     // write to byte array stream using buffer
     int n = input.read(buffer, 0, BUFFER_SIZE);
     while (n >= 0) {
         output.write(buffer, 0, n);
         n = input.read(buffer, 0, BUFFER_SIZE);
     }

     // make a byte array from byte array stream
     byte[] strOut = output.toByteArray();
        
     // close the streams
     output.close();
     input.close();
        
     return new String(strOut);
}