Collaborate Disseminate
If TLS communication uses ciphers that does not support forward secrecy[FS] (like RSA key exchange ciphers), confidentiality of the past communication is compromised if the private key is compromised. But will the integrity also gets compr… Continue reading How integrity is compromised if forward secrecy is not enabled in TLS communication?
What are the fundamental technological pieces to remotely scan a network, such as with Nessus.
Goal: Do risk assessments as a service for small businesses. Thus I’d run tools like Nessus and Nmap and deliver a report with recommendations. … Continue reading Fundamental pieces to remotely scan a network [closed]
I am installing Nessus on ArchLinux. Post-installation and activation, it is stuck on "initializing" compiling plugins for close to 2 hours now. Is this normal? Has anyone else faced this issue? How do I resolve it?
logs/nessusd…. Continue reading Nessus Is Stuck In Initialization Mode For Close To Two Hours–Plugin Schema Out-Of-Date
I stuck on compliance check by Nessus for:
4.1.17 Ensure the audit configuration is immutable
Basing on CIS benchmark "v3.0.1 – 09-21-2020" it wants to do audit with command:
# grep "^\s*[^#]" /etc/audit/rules.d/*.rule… Continue reading CIS and audit commands issues
how to read Nessus reports which are producing contradictory recommendations (on Rhel7) with default firewalld on board by Redhat?
Example, two "Compliance FAILED"
3.5.1.4 Ensure firewalld service is enabled and running – enabled… Continue reading rhel7 cis templates in Nessus – confusing reports
A new Nessus plugin (140735 – HTTP Smuggling Detection) was very recently incorporated into Tenable’s PCI template and is now beeing flagged as a "medium" vulnerability and causing scans to fail.
The only info in the scan report … Continue reading Nessus Plugin "HTTP Smuggling Detection" failing due to support for http/1.1 – how to overcome?
Nessus scan reported NTP mode 6 Scanner, these are some switches/routers and Linux systems. The description says that these systems can be utilised is an amplification based Ddos attacks.
None of these servers is exposed to the internet an… Continue reading NTP Mode 6 Scanner should be remediated on an internal network?
Thousand of people graduate from colleges and universities each year with cybersecurity or computer science degrees only to find employers are less than thrilled about their hands-on, foundational skills. Here’s a look at a recent survey that identified some of the bigger skills gaps, and some thoughts about how those seeking a career in these fields can better stand out from the crowd. Continue reading Thinking of a Cybersecurity Career? Read This
I need to test vulnerability scanners such as Nessus, Nmap, and so on. My teacher told me, that there are some prepared websites (these scanners need the IP address of target to scan) with known vulnerabilities, that can be directly scanne… Continue reading Servers/Websites for vulnerability scanning
I am working on issues reported by Nessus. Most of the issue types are missing headers and cookie flags.
The tricky part here is these issues have been reported at different port numbers, for example 443, 8008 and 8080.
Can anyone pleas… Continue reading Investigating header and cookie flag issues