Collaborate Disseminate
I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now left, and I am confused about step 1 below… Continue reading Why create a CSR on my own server to have it signed by a 3rd party?
I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows clients to write complex queries using quer… Continue reading Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?
Microsoft has published a security advisory about a new wave… Continue reading Microsoft Exchange Servers Hit By Stealthy IIS Backdoors
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supports forward secrecy but it doesn’t use GCM mode and use SHA1 TLS_RSA_WITH_AES_256_GCM_SHA384 uses GCM mode and SHA2 but it doesn’t support forward secrecy. Which one is more secure?
What are the common attack vectors for a Microsoft Exchange Server?
My online searches only yield discussion into various APT groups, and technical write-ups of different 0day exploits. There does not seem to be an OWASP top 10 vulnerabili… Continue reading Common attack vectors for Microsoft Exchange Server?
What is the danger of setting IIS errorMode to detailed in webconfig? It helps me marginally with sanity checks on production, but it seems like it wouldn’t really help a bad actor much. I’d like to set production to detailed errors, but… Continue reading What’s wrong with toggling detailed IIS errors for production?
One bug in the January 2022 Patch Tuesday list is getting lots of attention: “HTTP Protocol Stack Remote Code Execution Vulnerability”. Continue reading Wormable Windows HTTP hole – what you need to know
I need some help with sqli in API.
Webserver IIS 8.5
GET request looks like this
…
https://example.com/api/Search?q=Landing
Response look like this
HTTP/1.1 200 OK
…
[{"pageId":1,"pageName":"Landing Page"… Continue reading API Sql Injection Need help
I need some help with an SQL injection at an API.
Webserver IIS 8.5
The GET request looks like this
…
https://example.com/api/Search?q=Landing
The Response looks like this
HTTP/1.1 200 OK
…
[{"pageId":1,"pageName":… Continue reading API Sql Injection
In the past I have dealt with security issues related to Default Service Banners/Verbose Headers/Information Leakage via HttpResponse Headers. These issues are quite common, and usually look something like this for an Asp.Net – IIS Server… Continue reading HttpResponse Headers Information Leakage on Server Error (Verbose Headers)