Posts on vanstechelman.eu

Phases in a DevSecOps agile cycle

Wed, 20 Dec 2023 10:21:10 +0000

A general DevSecOps lifecycle can be outlined with key activities integrated into an Agile development framework. Here’s a broad overview:

Plan and Design: This phase involves planning the development process, including security considerations. Security requirements are identified, and threat modeling may be performed to anticipate potential risks.
Develop: During this phase, developers write code, adhering to secure coding practices. Security tools may be integrated into the development environment for continuous code analysis.
Commit and Build: Code changes are committed to version control, triggering automated builds. Security testing, such as static code analysis, is conducted as part of the build process to catch vulnerabilities early.
Test: This phase involves a range of testing activities, including dynamic application security testing (DAST), penetration testing, and other security assessments. The goal is to identify and remediate vulnerabilities before moving further in the development pipeline.
Deploy: The deployment phase involves pushing the code changes into production or staging environments. Security controls, such as environment configuration checks and secure deployment practices, are implemented.
Operate: In the operational phase, the application is actively monitored, and security controls are continuously assessed. This includes activities such as certificate management, access control monitoring, and ongoing vulnerability assessments.
Monitor and Respond: Continuous monitoring of security events and incidents is essential. Any security incidents are detected, analyzed, and responded to promptly. This phase includes incident response and, if needed, the application of security patches or updates.
Feedback and Improve: Feedback loops are crucial for continuous improvement. Teams collect feedback from each phase, including incidents, and use it to refine their processes. Security practices are iteratively improved to enhance the overall security posture.

It’s important to note that the exact phases and their order may vary depending on the specific DevSecOps implementation within an organization. The integration of security practices throughout the entire development lifecycle is a key principle, emphasizing collaboration and automation to achieve a more secure and efficient software delivery process.

Security roles in a DevSecOps strategy

Thu, 07 Dec 2023 07:13:41 +0000

In a DevSecOps environment, several types of security professionals are typically involved to ensure a comprehensive approach to security. These may include:

Security Engineers/Analysts: They focus on designing, implementing, and maintaining security measures within the DevSecOps pipeline.
Application Security Specialists: These experts concentrate on securing applications, identifying vulnerabilities, and ensuring secure coding practices.
Penetration Testers (Ethical Hackers): They conduct controlled attacks on systems to identify vulnerabilities and weaknesses in applications and infrastructure.
Security Architects: They design and implement security systems, including the selection of appropriate tools, technologies, and processes.
Compliance and Risk Management Experts: They ensure that security practices align with industry regulations, standards, and internal policies.
Security Automation Engineers: They focus on automating security tasks, integrating security tools into the DevOps pipeline, and enabling continuous security testing.
Security Auditors and Compliance Officers: They evaluate processes and systems to ensure they meet regulatory and compliance requirements.
Security Incident Response Team (SIRT): They handle security incidents, conduct investigations, and coordinate responses to security breaches or incidents.
Security Awareness and Training Specialists: They educate development and operations teams about security best practices and promote a security-conscious culture.
DevSecOps Evangelists/Advocates: These are individuals who promote security awareness and advocate for security practices within the DevOps and development teams.

Remember that the specific roles and titles may vary depending on the organization’s size, structure, and industry. It’s crucial for these professionals to work collaboratively with developers, operations, and other stakeholders to integrate security seamlessly into the development process.

Managing Windows firewall with PowerShell

Wed, 21 Apr 2021 09:38:13 +0000

To check the status of the Windows firewall with PowerShell, type the following:

$FWProfiles = (Get-NetFirewallProfile);
Write-Host "Windows Firewall Profile Statuses" -Foregroundcolor Yellow;
$FWProfiles | %{
    If($_.Enabled -eq 1){
        Write-Host "The Windows Firewall $($_.Name) profile is enabled"  -Foregroundcolor Green
        }Else{
        Write-Host "The Windows Firewall $($_.Name) profile is disabled" -Foregroundcolor Red
        }
    };

To disable the Windows firewall for all profiles with PowerShell, type the following:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

The most common BitLocker command-line commands

Wed, 19 Dec 2018 10:25:40 +0000

Make sure to execute these command from an Elevated Prompt!

Add a startup key as additional authentication method:

Adds a TPM and startup key protector for the operating system drive C:. The generated startup key will be stored on the removable drive E:. The effect of this command is that the removable drive on which this startup key is created must always be inserted in the computer when it starts up. Once Windows is starting, the removable drive can be removed from the USB port.\

Testing for CVE-2018-11784 - Apache Struts 2 Open Redirect vulnerability

Thu, 04 Oct 2018 07:57:17 +0000

On Wednesday 3 October 2018 the Apache Software Foundation has released information about an Open Redirect vulnerability in Apache Struts 2. The vulnerability received identifier CVE-2018-11784.

The vulnerability announcements describes the vulnerability as follows:

When the default servlet returned a redirect to a directory (e.g. redirecting to ‘/foo/’ when the user requested ‘/foo’) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

Testing for impact of Infineon's vulnerable RSA generation (CVE-2017-15361)

Tue, 17 Oct 2017 14:19:45 +0000

A security vulnerability exists in the firmware of certain Infineon Trusted Platform Module (TPM) chipsets. The vulnerability weakens key strength. It is weakened so much that it is possible to derive the private key from the public key for RSA key pairs of up to 2048-bit. This page contains a number of manners in which you can verify whether your computer contains an affected Infineon TPM chip that generates vulnerable RSA key pairs.

How to run the WSUS Server Cleanup Wizard from command-line

Thu, 13 Jul 2017 18:34:06 +0000

When running the WSUS Server Cleanup Wizard from the MMC snap-in, it can occur that you receive the following WSUS database error:

Error: Database Error
An error occurred when trying to perform a database operation. This can happen if the database is very busy, if the database service is stopped, if the connection to the database is lost, of if the Post-Installation task is not completed successfully. Please contact your system administrator if the problem persists.

Click Reset Server Node to try to connect to the server again.

If you haven’t performed the cleanup in a long time, then this can happen. So you might decide to read through the manual of the wsusutil.exe tool where you think that the deleteunneededrevisions switch will resolve all your problems, however, it seems that the wsusutil.exe parameter deleteunneededrevisions doesn’t exist on WSUS 3.1.

Luckily, you can achieve the same thing using powershell. The advantages here are:\

Scanning for CVE-2017-0143 (EternalBlue) using nmap (MS17-010)

Sat, 01 Jul 2017 08:30:00 +0000

With both WannaCry and NotPetya using MS17-010 for propagation it is important to be able to detect servers which are vulnerable. This vulnerability has been assigned CVE-2017-0143. The vulnerability is also often nicknamed EternalBlue. This page explains how you can scan for it from a Windows machine using nmap.

The SMBv1 server in many Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets, aka “Windows SMB Remote Code Execution Vulnerability.” This vulnerability is actively being exploited.

Scanning for CVE-2017-5638 using nmap

Tue, 14 Mar 2017 21:00:00 +0000

On March 6, 2017, Apache disclosed a vulnerability in the Jakarta multipart parser used in Apache Struts2 that could allow an attacker to execute commands remotely on the targeted system using a crafted Content-Type header value.
This vulnerability has been assigned CVE-ID CVE-2017-5638.
This page explains how you can scan for it from a Windows machine using nmap.

How to use SHA-256, SHA-384, and SHA-512 hash functions in AutoIt

Tue, 14 Jun 2016 15:51:55 +0000

In the AutoIt scripting language it is possible to hash data using the _Crypt_HashData() function.

The hashing functionality is however limited to the MD2, MD4, MD5, and SHA1.

Computers running Windows XP SP3 or higher also have support for the newer SHA2 hashing functions, being SHA256, SHA384, and SHA512.

If you want to use these newer hashing functions in your applications, simply define these functions as follows:

Global Const $CALG_SHA_256 = 0x0000800c

How to allow a normal user to start, stop, and pauze/continue a Windows service

Mon, 12 Oct 2015 07:06:15 +0000

By default, starting and stopping Windows services are tasks that can only be performed by administrators. There are cases where you want regular users to be able to start or stop services. This can be easily accomplished using the subinacl.exe command-line tool.

This is the subinacl.exe syntax of how you can allow a normal user to start, stop, and pauze/continue a service.

subinacl.exe /service SERVICE_NAME /grant=COMPUTER_NAME\USERNAME=TOP

Note that the COMPUTER_NAME is optional. So you can also use:

How to list hidden shares remotely

Tue, 22 Sep 2015 09:41:22 +0000

When sharing Windows folders on the network, it is possible to hide the shared folder from the list of shares. This can be done by adding a $-sign to the end of a share name.
It is important to mention that this does not really hide such shares from the network. If you ask a Windows machines for a list of its shares, then it reports all shares, including those with a $-sign. It are then the clients who filter out all shares that end in a dollar-sign.

So how can you get a list of all the hidden shares on a server?
Easy: open a DOS prompt and issue the following command: net view \test-server /all

The output will be the following:

C:\Users\Lode>net view \test-server /all
Shared resources at \test-server

Share name                 Type Used as Comment
——————————————————————————-
ADMIN$                     Disk           Remote Admin
C$                         Disk           Default share
IPC$                       IPC            Remote IPC
Temp                       Disk
The command completed successfully.\

Anatomy of the SQL injection in Drupal’s database comment filtering system SA-CORE-2015-003

Thu, 20 Aug 2015 20:54:03 +0000

In the Drupal security advisory that was released on August 19th, 2015 Drupal’s security team announced that it solved an SQL injection vulnerability in the Drupal database API.

The security advisory contained the following description of the SQL injection vulnerability:

A vulnerability was found in the SQL comment filtering system which could allow a user with elevated permissions to inject malicious code in SQL comments.

The following sections in this article explain where exactly the problem is located in Drupal and what the vulnerability is. Next it will explain when a Drupal site is vulnerable and how the vulnerability has been solved in the Drupal core code.

ICACLS command line options

Fri, 12 Jun 2015 07:16:26 +0000

\

ICACLS name /save aclfile [/T] [/C] [/L] [/Q]

stores the DACLs for the files and folders that match the name

into aclfile for later use with /restore. Note that SACLs,

owner, or integrity labels are not saved.

\

ICACLS directory [/substitute SidOld SidNew [...]] /restore aclfile

[/C] [/L] [/Q]

applies the stored DACLs to files in directory.

\

ICACLS name /setowner user [/T] [/C] [/L] [/Q]

changes the owner of all matching names. This option does not

force a change of ownership; use the takeown.exe utility for

that purpose.

\

ICACLS name /findsid Sid [/T] [/C] [/L] [/Q]

finds all matching names that contain an ACL

explicitly mentioning Sid.

\

ICACLS name /verify [/T] [/C] [/L] [/Q]

finds all files whose ACL is not in canonical form or whose

lengths are inconsistent with ACE counts.

\

ICACLS name /reset [/T] [/C] [/L] [/Q]

replaces ACLs with default inherited ACLs for all matching files.

\

ICACLS name [/grant[:r] Sid:perm[...]]

[/deny Sid:perm [...]]

[/remove[:g|:d]] Sid[...]] [/T] [/C] [/L] [/Q]

[/setintegritylevel Level:policy[...]]

\

/grant[:r] Sid:perm grants the specified user access rights. With :r,

the permissions replace any previously granted explicit permissions.

Without :r, the permissions are added to any previously granted

explicit permissions.

\

/deny Sid:perm explicitly denies the specified user access rights.

An explicit deny ACE is added for the stated permissions and

the same permissions in any explicit grant are removed.

\

/remove[:[g|d]] Sid removes all occurrences of Sid in the ACL. With

:g, it removes all occurrences of granted rights to that Sid. With

:d, it removes all occurrences of denied rights to that Sid.

\

/setintegritylevel [(CI)(OI)]Level explicitly adds an integrity

ACE to all matching files.  The level is to be specified as one

of:

L[ow]

M[edium]

H[igh]

Inheritance options for the integrity ACE may precede the level

and are applied only to directories.

\

/inheritance:e|d|r

e - enables inheritance

d - disables inheritance and copy the ACEs

r - remove all inherited ACEs

\

\

Note:

Sids may be in either numerical or friendly name form. If a numerical

form is given, affix a * to the start of the SID.

\

/T indicates that this operation is performed on all matching

files/directories below the directories specified in the name.

\

/C indicates that this operation will continue on all file errors.

Error messages will still be displayed.

\

/L indicates that this operation is performed on a symbolic link

itself versus its target.

\

/Q indicates that icacls should suppress success messages.

\

ICACLS preserves the canonical ordering of ACE entries:

Explicit denials

Explicit grants

Inherited denials

Inherited grants

\

perm is a permission mask and can be specified in one of two forms:

a sequence of simple rights:

N - no access

F - full access

M - modify access

RX - read and execute access

R - read-only access

W - write-only access

D - delete access

a comma-separated list in parentheses of specific rights:

DE - delete

RC - read control

WDAC - write DAC

WO - write owner

S - synchronize

AS - access system security

MA - maximum allowed

GR - generic read

GW - generic write

GE - generic execute

GA - generic all

RD - read data/list directory

WD - write data/add file

AD - append data/add subdirectory

REA - read extended attributes

WEA - write extended attributes

X - execute/traverse

DC - delete child

RA - read attributes

WA - write attributes

inheritance rights may precede either form and are applied

only to directories:

(OI) - object inherit

(CI) - container inherit

(IO) - inherit only

(NP) - don't propagate inherit

(I) - permission inherited from parent container

\

Examples:

\

icacls c:\windows\* /save AclFile /T

- Will save the ACLs for all files under c:\windows

and its subdirectories to AclFile.

\

icacls c:\windows\ /restore AclFile

- Will restore the Acls for every file within

AclFile that exists in c:\windows and its subdirectories.

\

icacls file /grant Administrator:(D,WDAC)

- Will grant the user Administrator Delete and Write DAC

permissions to file.

\

icacls file /grant *S-1-1-0:(D,WDAC)

- Will grant the user defined by sid S-1-1-0 Delete and

Write DAC permissions to file.

\

Windows Software Licensing Management Tool (slmgr.vbs)

Fri, 12 Jun 2015 06:13:31 +0000

This page lists the Windows Software Licensing Management Tool (slmgr.vbs) command line options.

Remove whitelisted events from Splunk search results

Wed, 06 May 2015 07:28:46 +0000

Splunk is a great tool to monitor and review many different kinds of log files. In some cases it can occur that you want to be alerted of specific types of events, but only for occurrences of the events that are not defined in an exceptions whitelist. For example: you may want to be alerted of all logons to your server by users who are not IT employees. While it is possible to enumerate all exceptions in the search query, this article shows how this can be done by storing all exceptions in a CSV-file.

Importing vbscript code at runtime

Thu, 30 Apr 2015 10:13:27 +0000

Many script languages have an import function that allows to import and execute code that is stored in another file. Microsoft’s vbscript however is lacking such functionality. This page shows how it can be accomplished to import and execute vbscript code that is stored in another file.

Assume that you have the following file with some functions that you have defined:\

' Filename = modMathFunction.vbs
Function Square(intNumber)
    Square = intNumber * intNumber
End Function

Normally you would have to copy this function in each script in which you want to use this function. It is however possible to define an import function in your vbscript code via which you can use this function without having to copy it.

Drupal: create a view block of all children of a book page

Wed, 15 Apr 2015 18:18:33 +0000

This article explains how you can create a view block that contains all the children of a certain book page.

Scan for FREAK using nmap

Sun, 08 Mar 2015 19:56:11 +0000

Not everyone is vulnerable to the potential attack vector that researchers from INRIA, a French research institute, and Microsoft disclosed recently. In order to be vulnerable, the computer or server must support a class of deliberately weak export cipher suites. Support for these weak algorithms has remained in many implementations, however they are typically disabled by default. Nevertheless, the researchers discovered that several implementations incorrectly allow the message sequence of export ciphersuites to be used even if a non-export ciphersuite was nogotiated. This post shows how you can test a server to detect if it has been configured to allow export cipher suites to be used.
\

Creating an UEFI bootable Linux USB stick

Thu, 26 Feb 2015 15:48:18 +0000

This article explains how to create a bootable USB stick with Linux that can be used to boot UEFI-systems.

AutoIt DllCall examples

Wed, 07 Jan 2015 16:24:13 +0000

Using AutoIt's DllCall function might be confusing at first. The biggest issue I encountered was on how to "translate" the C++ variable types to AutoIt variable types. In this article, we give some example of how some standard Microsoft DLL calls can be translated into AutoIt DLL calls. We give a brief explation of each function and then first show the function definition in C++ and then show how you can call the function from within AutoIt.

Meaning of the extended flag value when using AutoIt's RunAs and RunAsWait

Wed, 07 Jan 2015 07:39:51 +0000

When using the RunAs or RunAsWait functions in AutoIt, you want to run an external program under the context of a different user. While doing this, there can be many things that may be the reason why the functions fails. The AutoIt Function Reference only states that if the function call failed that the return value is zero and that the @error flag is set to non-zero. In order to really know what went wrong, you have to look at the value of the @extended flag.

The table below lists some of the most values of the @extended flag and their meaning. If you encounter other values, please report them via the comments section at the bottom of the page.\

How to activate a Windows computer that is not connected to the internet

Thu, 27 Nov 2014 17:24:02 +0000

If you are building a secure computer, then the best approach is to never connect it to the internet. If the operating system on this computer is Windows, then you will have to activate it before you will be able to use it. This article explains how you can activate it by phone.
\

Windows can’t be activated right now

If you try to use the standard Windows activation interface, then you will most probably receive the error Windows can’t be activated right now. This makes perfect sense since the activation application tried to connect to Microsoft’s activation servers. However, since you are offline, the computer can not connect these servers. It shouldn’t even be possible to resolve the DNS names of these servers!

The answer here is to activate the computer by phone. To start the Windows Activation Wizard, click Start, click Run, type slui.exe 4, and then click OK. An alternative approach is to press the Windows+R keyboard combination to open the Run window.
If you are running Windows 8, follow these steps:\

Prevent spammers from sending mails that abuse your domain name using an SPF record

Sun, 26 Oct 2014 06:49:46 +0000

All mail server administrators will have encountered the following problem: spammers send out spam and they spoof the mails so that the sender appears to be a user in the domain you are managing. Unfortunately there is not a lot that can be done to prevent spammers from sending such these spam mail. There is however a way in which receiving mail servers can check whether the mail was send from your mail server or whether is was a spammer who used a mail server that is not authorized to send mails from your domain. This can be accomplished with SPF (Sender Policy Framework).

Scan for POODLE using nmap from a Windows machine

Wed, 15 Oct 2014 10:17:34 +0000

Researchers from the Google Security Team have published findings about a vulnerability in SSL 3.0. CVE-2014-3566 has been allocated for this protocol vulnerability. It is possible to use nmap to scan for the presence of this vulnerability by doing a scan on the supported SSL/TLS protocols. This post shows how to scan for the POODLE weakness using nmap.

Cookie replay attacks in ASP.NET when using forms authentication

Sat, 13 Sep 2014 08:08:15 +0000

Microsoft ASP.NET 4.5 and earlier versions contain a weakness in the Forms Authentication functionality whereby user sessions are not properly terminated when a user logs out of the session. As a result, users are vulnerable to session hijacking even after logging out of the web application.\

This weakness isn’t new. There exists an article on Microsofts Knowledge Base that explains exactly this issue. So why is it important to mention it here again? Because the above KB-article was written for ASP.NET 2! The original KB publication date is unknown, but the revision information show that the KB-article was last updated in May 2007! This means that this issue in ASP.NET is already known for more than 7 years and it has survived several major ASP.NET versions.\

Translating C++ variable types to AutoIt types when using DllCall

Tue, 08 Jul 2014 11:29:38 +0000

Using DllCall in AutoIt given you enormous power to extend the functionality of AutoIt. It allows you to implement almost everyting in AutoIt that you can implement in C++. \ However, one of the most difficult things when working with DllCall is to know how to type the variables that you pass to DllCall.\ The table below show how to convert C++ and Windows API types to AutoIt types:\ \ \ | C++ | AutoIt | \ | LPCSTR LPSTR | str | \ | LPCWSTR LPWSTR | wstr |

Scan for Heartbleed using nmap from a Windows machine

Thu, 10 Apr 2014 08:01:14 +0000

You may have heard of “Heartbleed”, a flaw in OpenSSL that could allow the theft of data normally protected by SSL/TLS encryption.

It is possible to scan for the presence of this vulnerability using different methods.
This page explains how you can scan for it from a Windows machine using nmap.

Credential validation using RADIUS in PHP

Mon, 31 Mar 2014 12:55:57 +0000

Validating a username and password pair against a remote RADIUS server is an easy task in PHP. This page shows two methods via which credentials can be checked using the RADIUS protocol.

Solution for java.lang.ClassNotFoundException when loading your Burp Suite extention

Sat, 27 Jul 2013 15:00:18 +0000

When building your own Burp Suite extension, it can occur that compiling your code and creating the jar works find, but that you get the exception java.lang.ClassNotFoundException when loading your extention in Burp Suite. This article shows the solution to your problem.

Creating and building Burp Suite extention using Java command-line tools

Sat, 27 Jul 2013 14:35:58 +0000

Burp Suite allows you to easily write your own plugins, to perform complex and highly customized tasks within Burp. PortSwigger (the developer behind Burp Suite) created a series of blog posts wherein he explains what can be done with Burp Extensions. In his first blog post about the subject (see Writing your first Burp Suite extension) PortSwigger explains how you can build your own extension using an IDE. Some of us prefer however to not use a heavy IDE, but to compile the jar from the command-line. This article show how to use the javac and the jar command to create your Burp extension from the command-line.

HTML5 LocalStorage

Sat, 22 Jun 2013 09:07:45 +0000

This article presents the HTML5 LocalStorage (and SessionStorage) objects and discusses some security implcations and recommendations. Furthermore JavaScript examples are given on how HTML5 can be easily used.

Minimal HTTP requests

Sat, 06 Apr 2013 09:11:45 +0000

This page lists different HTTP request templates. All templates contain the minimum number of required headers.

Testing randomness with Stompy

Thu, 04 Apr 2013 13:27:11 +0000

Stompy is a fairly advanced entropy verifier for session cookies, XSRF tokens, OTPs, and other random data. It goes well beyond FIPS-140-2, performing n-dimensional spectral testing as well.

Time conversion using Bash

Wed, 30 Jan 2013 12:52:07 +0000

This article show how you can obtain the UNIX epoch time (number of seconds since 1970-01-01 00:00:00 UTC) using the Linux bash “date” command. It also shows how you can convert a UNIX epoch time to a human readable time.

Scanning for SNMP services with default community strings

Thu, 08 Dec 2011 10:03:12 +0000

You can use the following commands to scan a netblock for the presence of systems with an SNMP service which still use the community strings “public” and/or “private”.

VBScript tips

Wed, 09 Nov 2011 08:36:20 +0000

Some tips for doing things in vbscript.

How to bypass domain policy firewall settings

Wed, 17 Aug 2011 07:28:38 +0000

How to enable the Windows Firewall, even though Domain Policies are prohibiting you from enabling it…

How to use SubInAcl.exe

Tue, 12 Jul 2011 14:28:43 +0000

How to use SubInAcl.exe?

Example usage of xcacls.vbs

Tue, 21 Jun 2011 12:47:48 +0000

This webpage contains a series of examples of how xcacls.vbs can be used.

Backtrack 4 customization

Fri, 20 May 2011 07:37:11 +0000

This page is mainly a checklist for myself to know how I have to customize a freshly downloaded version of Backtrack 4. ### Change keyboard layout Use the following command to change the keyboard layout: dpkg-reconfigure console-setup Accept all default, except changing the origin to Belgium (if you want to use be-latin1). ### Update all packages apt-get update apt-get upgrade ### Configure SSH You still have to generate your SSH keys sshd-generate

Using SkipFish through Burp Suite

Wed, 18 May 2011 12:30:08 +0000

This how-to explains you how to use SkipFish through a proxy. It will show you how you have to configure Burp Suite and which parameters you need to supply to SkipFish so that all SkipFish’s traffic will flow nicely through Burp Suite.

Configure static IP Debian Linux

Mon, 21 Feb 2011 12:28:36 +0000

The purpose of this small message is to show how you can configure a static IP address in Debian Linux. I know that other sites have more detailed explanations on this (and the man page too), but I put it here mostly as a reminder to myself.

Deny access to C-drive

Sun, 31 Jan 2010 20:35:23 +0000

In some companies, you can find that access to the C-drive of a Windows computer has been blocked. How do they do this?

HTML event handlers

Mon, 21 Dec 2009 13:31:13 +0000

The following is a list of event handlers which can be used in HTML code to execute Javascript code.

FSCommand(): attacker can use this when executed from within an embedded Flash object
onAbort(): when user aborts the loading of an image
onActivate(): when object is set as the active element
onAfterPrint(): activates after user prints or previews print job
onAfterUpdate(): activates on data object after updating data in the source object
onBeforeActivate(): fires before the object is set as the active element
onBeforeCopy(): attacker executes the attack string right before a selection is copied to the clipboard - attackers can do this with the execCommand(“Copy”) function
onBeforeCut(): attacker executes the attack string right before a selection is cut
onBeforeDeactivate(): fires right after the activeElement is changed from the current object
onBeforeEditFocus(): Fires before an object contained in an editable element enters a UIactivated state or when an editable container object is control selected
onBeforePaste(): user needs to be tricked into pasting or be forced into it using the execCommand(“Paste”) function
onBeforePrint(): user would need to be tricked into printing or attacker could use the print() or execCommand(“Print”) function
onBeforeUnload(): user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent
onBlur(): in the case where another popup is loaded and window looses focus
onBounce(): fires when the behavior property of the marquee object is set to “alternate” and the contents of the marquee reach one side of the window
onCellChange(): fires when data changes in the data provider
onChange(): select, text, or TEXTAREA field loses focus and its value has been modified
onClick(): someone clicks on a form
onContextMenu(): user would need to right click on attack area
onControlSelect(): fires when the user is about to make a control selection of the object
onCopy(): user needs to copy something or it can be exploited using the execCommand(“Copy”) command
onCut(): user needs to copy something or it can be exploited using the execCommand(“Cut”) command
onDataAvailible(): user would need to change data in an element, or attacker could perform the same function
onDataSetChanged(): fires when the data set exposed by a data source object changes
onDataSetComplete(): fires to indicate that all data is available from the data source object
onDblClick(): user double-clicks a form element or a link
onDeactivate(): fires when the activeElement is changed from the current object to another object in the parent document
onDrag(): requires that the user drags an object
onDragEnd(): requires that the user drags an object
onDragLeave(): requires that the user drags an object off a valid location
onDragEnter(): requires that the user drags an object into a valid location
onDragOver(): requires that the user drags an object into a valid location
onDragDrop(): user drops an object (e.g. file) onto the browser window
onDrop(): user drops an object (e.g. file) onto the browser window
onError(): loading of a document or image causes an error
onErrorUpdate(): fires on a databound object when an error occurs while updating the associated data in the data source object
onExit(): someone clicks on a link or presses the back button
onFilterChange(): fires when a visual filter completes state change
onFinish(): attacker can create the exploit when marquee is finished looping
onFocus(): attacker executes the attack string when the window gets focus
onFocusIn(): attacker executes the attack string when window gets focus
onFocusOut(): attacker executes the attack string when window looses focus
onHelp(): attacker executes the attack string when users hits F1 while the window is in focus
onKeyDown(): user depresses a key
onKeyPress(): user presses or holds down a key
onKeyUp(): user releases a key
onLayoutComplete(): user would have to print or print preview
onLoad(): attacker executes the attack string after the window loads
onLoseCapture(): can be exploited by the releaseCapture() method
onMouseDown(): the attacker would need to get the user to click on an image
onMouseEnter(): cursor moves over an object or area
onMouseLeave(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseMove(): the attacker would need to get the user to mouse over an image or table
onMouseOut(): the attacker would need to get the user to mouse over an image or table and then off again
onMouseOver(): cursor moves over an object or area
onMouseUp(): the attacker would need to get the user to click on an image
onMouseWheel(): the attacker would need to get the user to use their mouse wheel
onMove(): user or attacker would move the page
onMoveEnd(): user or attacker would move the page
onMoveStart(): user or attacker would move the page
onPaste(): user would need to paste or attacker could use the execCommand("Paste") function
onProgress(): attacker would use this as a flash movie was loading
onPropertyChange(): user or attacker would need to change an element property
onReadyStateChange(): user or attacker would need to change an element property
onReset(): user or attacker resets a form
onResize(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeEnd(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onResizeStart(): user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>
onRowEnter(): user or attacker would need to change a row in a data source
onRowExit(): user or attacker would need to change a row in a data source
onRowDelete(): user or attacker would need to delete a row in a data source
onRowInserted(): user or attacker would need to insert a row in a data source
onScroll(): user would need to scroll, or attacker could use the scrollBy() function
onSelect(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectionChange(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onSelectStart(): user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");
onStart(): fires at the beginning of each marquee loop
onStop(): user would need to press the stop button or leave the webpage
onSubmit(): requires attacker or user submits a form
onUnload(): as the user clicks any link or presses the back button or attacker forces a click

Secure Software Development Guides

Mon, 10 Aug 2009 14:33:44 +0000

This page contains a collection of publicly available secure software development guides. Each guide has its own approach to introducting security in the software development lifecycle.

Using tcpdump

Mon, 22 Jun 2009 14:17:53 +0000

Some examples of using tcpdump.

SQL Server Auditing Queries

Wed, 01 Apr 2009 07:07:19 +0000

This page contains some SQL queries that can be used on an SQL Server to test some parts of the security configuration.

Concatenating lines with sed

Wed, 25 Mar 2009 08:11:58 +0000

An example of how you can concatenate lines from an input file using the sed command line tool.

Windows audit settings

Fri, 13 Feb 2009 21:01:59 +0000

The following pages contain information about the default audit settings on Windows operating systems, how you can change these settings, how you can increase the size of the event logs, how all of this should be done via domain controller policies and on stand-alone servers/workstations.

php print l(“Adjust the Windows Event Log size”, “node/229”); ?
php print l(“Audit Policy Settings for Windows XP”, “node/230”); ?

Audit Policy Settings for Windows XP

Thu, 12 Feb 2009 08:05:06 +0000

An Audit policy determines the security events to report to administrators so that user or system activity in specified event categories is recorded. The administrator can monitor security-related activity, such as who accesses an object, when users log on to or log off from computers, or if changes are made to an Audit policy setting. For all of these reasons, Microsoft recommends that you form an Audit policy for an administrator to implement in your environment.

Adjust the Windows Event Log size

Tue, 10 Feb 2009 13:55:55 +0000

When many events logs are being generated, the possibility exists that events are being overwritten to quickly, which causes that important information would be lost. Increasing the maximum size of the Windows Event Logs might help to store events longer on each computer.

Auto-logon in Windows XP Professional

Sun, 23 Nov 2008 13:54:16 +0000

Having trouble finding the place where to enable auto-logon in Windows XP Professional? Since it’s not so secure, it’s well hidden. If you still want the functionality, do the following:

Windows Server 2003 Security Guide - The Member Server Baseline Policy

Mon, 27 Oct 2008 16:33:25 +0000

An overview of all options and settings available in the Windows audit policy and user rights assignments.

Windows Server 2003 Security Guide - The Domain Policy

Sat, 25 Oct 2008 12:00:20 +0000

An overview of all options and settings available in the domain policy.

Nagios plugin to check the currently used bandwidth

Sat, 04 Oct 2008 10:51:09 +0000

This page shows you how you can create a Nagios plugin to check how much bandwidth the server is currently using. In order to do this, we will use the tool vnstat. This tools offers the functionality to check how much bandwidth you use over the last 5 seconds.

Automatically redirect non-existing pages to the home page in Apache

Sun, 07 Sep 2008 09:39:29 +0000

How to configure Apache so that requests for non-existing pages are redirected to the home page.

Create a virtual host on IIS 6 using iisweb

Sun, 27 Jul 2008 08:17:55 +0000

Name-based virtual hosts use multiple host names for the same webserver IP address. This post show how you can create name-based virtual hosts using the iisweb command-line utility.

Doing a DNS zone transfer

Wed, 16 Jul 2008 09:55:14 +0000

This article shows how you can perform a DNS zone transfer using nslookup on Windows and using dig on Linux.

Finding SGID files

Fri, 13 Jun 2008 08:32:14 +0000

How to find SGID files.

Finding SUID files

Fri, 13 Jun 2008 07:46:56 +0000

How to find SUID files.

Dnscmd - Managing the Windows DNS Server

Sun, 13 Apr 2008 09:23:02 +0000

This page explains how you can script the creation of new domains in a Windows DNS server using the dnscmd utility.

WMIC help page

Sun, 09 Mar 2008 09:18:28 +0000

WMIC help page

WMIC Output Formats

Sun, 09 Mar 2008 09:16:13 +0000

WMIC Output Formats

Obtained by executing: wmic [stuff to do] /format /?

Keyword/XSL filename to process XML results.
USAGE:

/FORMAT:<format specifier>
NOTE: <formatspecifier> : ((<transformname>|<transformname> : <paramstring>)[,<formatspecifier>]).
where <paramstring>:((<parametername>=<value>)[,<paramstring>]).

NOTE: <transformname> is a <key word> or an <xsl file name>.

Keywords:

CSV
HFORM
HMOF
HTABLE
HXML
LIST
RAWXML
TABLE
VALUE
htable-sortby
htable-sortby.xsl
texttablewsys
texttablewsys.xsl
wmiclimofformat
wmiclimofformat.xsl
wmiclitableformat
wmiclitableformat.xsl
wmiclitableformatnosys
wmiclitableformatnosys.xsl
wmiclivalueformat
wmiclivalueformat.xsl

Windows Management Instrumentation Command-line (WMIC)

Sun, 09 Mar 2008 09:12:57 +0000

Windows Management Instrumentation (WMI) is a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components can provide information and notification. WMI is Microsoft’s implementation of the Web-Based Enterprise Management (WBEM) Standard from the Distributed Management Task Force (DMTF).

Add a static IP route in Windows

Sun, 09 Mar 2008 09:09:20 +0000

How to add a static IP route in Windows?

The NET command

Sun, 09 Mar 2008 08:59:39 +0000

The NET Command is used to manage network resources as follows:

Security Good Practices

Wed, 13 Feb 2008 17:31:04 +0000

This page contains a list of URLs that contain good practice guides, audit procedures and technology standards that are freely available.

Using openssh without a password

Sun, 10 Feb 2008 16:17:47 +0000

How to configure OpenSSH to use SSH keys for authentication instead of a password.

Using sed

Sun, 10 Feb 2008 16:05:21 +0000

Some more advanced examples of how to use the sed command in Linux.

POSIX character classes

Sun, 10 Feb 2008 15:19:42 +0000

Some of the character classes to use in regular expressions.

CD Burning using the shell

Sun, 10 Feb 2008 15:05:05 +0000

How to burn CD’s using only bash.

Using the WebScarab bean shell to modify requests/responses

Sun, 10 Feb 2008 11:40:57 +0000

This article shows how you can use the WebScarab bean shell to modify requests and responses that are transmitted and received by WebScarab.

Netmask, CIDR and the size of networks

Sun, 10 Feb 2008 10:44:18 +0000

The following table translates the traditional netmask format to its CIDR notation. Additionally you can see how many addresses can exist in a subnet with a certain netmask.