Collaborate Disseminate
How strong is Windows Firewall?
I have no knowledge on Botnets or how to use them, so I have no way to test Windows firewall’s strength. And I believe it would go against the contract I signed with my host.
In addition to my host anti DDoS… Continue reading How strong is windows firewall on Windows Server 2019?
I see some firewall action types in the logs such as client-rst, server-rst etc. Are these action types valid for all firewall vendors? If so, is there a way to get firewall to create these actions?
I see thousands of entries in my web logs over two days from a specific IP.
The firewall reacted with client-rst, server-rst, deny and close actions.
I have only a few entries that went through SSL 443 port and that website has nothing muc… Continue reading suspicious ip traces [closed]
I run a bare-metal on-premises GitLab server (Ubuntu 22.04) for a very small company. While the server isn’t currently in production use, it is active and accessible over the public internet.
I have UFW set to block everything except HTTP,… Continue reading Unexpected drop in UFW noise, should I be worried?
I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.
Note: In the log report, I replace the name of my website with example.com and my second domain with example2.com and my server… Continue reading Is my website under attack?
https://lolbas-project.github.io/
Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only for Windows.
There are Attack Surface R… Continue reading Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?
In response to low-hanging fruit attacks (accounts creation, image sending etc.) which request rates goes below our rate-limiting rules and are not blocked, we started blocking AS numbers from countries in which we do not operate. We start… Continue reading Is blocking Autonomous Systems numbers in the firewall a good practice?
I was using httpx on subdomains to see if they are live, but I was getting 503 Status code on a large number of domains (like in the image).
One inference that is possible is that the site it behind Akamai WAF,
but does this mean somethin… Continue reading Is there anything we can deduce from 503 status code from a WAF?
I recently stayed at a hotel where outbound SSH traffic (and seemingly only SSH traffic) was blocked on the guest WiFi network, and I’m trying to figure out what security-based rationale they might have had for this policy. Unfortunately, … Continue reading What would be the security rationale for a hotel blocking only SSH traffic?
Is there a way to identify whether "filtered" state for a specific port in nmap output is caused by a network firewall or host-based firewall?