Search for a command to run...
No comments yet. Be the first to comment.
AWS Network Security Services cheat sheet AWS Firewall Manager: AWS Firewall Manager is a security management service that allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new...
How To Remove Personal Information From The Internet in 2023 https://support.google.com/websearch/answer/9673730 Follow the video guide What can be removed with the new Google removal tool The personally identifiable information that may be removed...
[#whatsapp proxy settings | use proxy WhatsApp | set proxy WhatsApp |WhatsApp new update 2023WhatsApp proxy settings | use proxy WhatsApp | set proxy WhatsApp |WhatsApp new update 2023https://www.whatsapp.com/A…youtube.com](https://youtube.com/shorts...
Palo Alto and Panorama — Hardening the Configuration As per Hardening Network Devices National Security Agency Cybersecurity Information, the below points are covered in this Course. Palo Alto and Panorama — Hardening the Configuration (gumroad.com) ...
https://cyberbruharmy.gumroad.com/l/Ransomware [Ransomware Attack & Prevention: Everything You Need To KnowRansomware is a type of malicious software that encrypts files and then demands a fee to decrypt them. This sort of…cyberbruharmy.gumroad.com](...
Cyber Security
51 posts
Welcome to CyberBruhArmy's help center! We're here to answer your questions. Can't find what you're looking for? Send our support team a note at contact@cyberbruharmy.in!
The Internet(Web clients) — -> Apache Reverse Proxy with Modsecurity Service — -> Web Server
A-1.1 — Installed and Configure Apache as reverse proxy
Reverse Proxy: A reverse proxy accepts a request from a client, forwards it to a server that can fulfill it, and returns the server’s response to the client.
A reverse proxy can hide the topology and characteristics of your back-end servers by removing the need for direct internet access to them.
A-1.2 Installed and Configured Application — demo.testfire.net
Installation steps are below:
1. Download AltoroJ for application (demo.testfire.net)
Setup Github Link: https://github.com/HCL-TECH-SOFTWARE/AltoroJ
Prerequisites:
AltoroJ has been developed using Eclipse and designed to run on Tomcat 7, but since it’s a relatively simple J2EE app, it should be pretty easy to port it to a different J2EE IDE or another J2EE web application server. Here are out-of-the-box requirements:
Installation of Altotoj Application
5. Go to Window -> Preferences
6. On the right hand side click Add button > Select to add Standard VM
7. click Directory and point to usr directory where Open JDK 1.8 was previously installed. Eclipse should find automatically find the JVM and add the required JARs as shown below
8. check it usr to make it default as shown here
9. Configure Apache Tomcat 7
go to Window -> Preferences -> Server -> Runtime Environments
click Add > choose Apache Tomcat 7.0
10. Point to the installation directory (where we extracted the tar.gz for Tomcat )
11. Import AltoroJ project from GitHub
Go to File -> Import -> Git -> Projects from Git
Choose “Clone URI” and use the following URI on the next screen:
Proceed through the wizard without making any changes until you get to Wizard for Project import. At this point, choose to “Import existing Eclipse projects” and then continue through and finish the wizard
Run AltoroJ — application — demo.testfire.net
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/bhavin.key -out /etc/ssl/certs/bhavin.crt
2. After running the commands above, It will prompt you to answer a few questions about the certificate you’re generating… answer them and complete the process.
Country Name (2 letter code) [AU]:IN
State or Province Name (full name) [Some-State]: STATE NAME
Locality Name (eg, city) []:CITYNAME
Organization Name (eg, company) [Internet Widgits Pty Ltd]:company
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:demo.testfire.net
Email Address []:abc@email.com
3. Generated self signed SSL certificate — bhavin.crt
ModSecurity is an open-source web-based firewall application (or WAF) supported by different web servers: Apache, Nginx and IIS.
Protect web applications from various attacks. ModSecurity supports flexible rule engine to perform both simple and complex operations. It comes with a Core Rule Set (CRS).
https://owasp.org/www-project-modsecurity-core-rule-set/
When ModSecurity is enabled in the reverse proxy deployment, the following firewall architecture is enabled:
ubuntu-vm@ubuntuvm-virtual-machine:~$ sudo apt install libapache2-mod-security2
3. Apache service restarted
ubuntu-vm@ubuntuvm-virtual-machine:~$ sudo systemctl restart apache2
4. Check mod security version: ubuntu-vm@ubuntuvm-virtual-machine:~$ apt-cache show libapache2-mod-security2
Configure ModSecurity
root@ubuntuvm-virtual-machine:/home/ubuntu-vm# cd /etc/modsecurity/
root@ubuntuvm-virtual-machine:/etc/modsecurity# sudo nano modsecurity.conf
root@ubuntuvm-virtual-machine:/etc/modsecurity# cd
root@ubuntuvm-virtual-machine:~# systemctl restart apache2
Download Latest OWASP ModSecurity Rules
The latest Core Rule Set (CRS) for ModSecurity is maintained on GitHub. Install Git if it’s not already included on your system.
root@ubuntuvm-virtual-machine:~# sudo apt install git
root@ubuntuvm-virtual-machine:~# git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git
Copy of the directory as a subdirectory of your current working location.
Open a new directory: cd owasp-modsecurity-crs and Move the crs-setup file
root@ubuntuvm-virtual-machine:~# cd owasp-modsecurity-crs
root@ubuntuvm-virtual-machine:~/owasp-modsecurity-crs# sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf
root@ubuntuvm-virtual-machine:~/owasp-modsecurity-crs# sudo mv rules/ /etc/modsecurity
root@ubuntuvm-virtual-machine:~/owasp-modsecurity-crs# sudo nano /etc/apache2/mods-enabled/security2.conf
Apache service restarted
ubuntu-vm@ubuntuvm-virtual-machine:~$ sudo systemctl restart apache2
Now tested Apache Configuration by adding a detection rule into the default Apache configuration file.
Apache service restarted
ubuntu-vm@ubuntuvm-virtual-machine:~$ sudo systemctl restart apache2
\===================================
Modsecurity rule test — https://demo.testfire.net/AltoroJ/
Modsecurity logs: tail -f /var/log/apache2/error.log
For LFI: https://github.com/xmendez/wfuzz/blob/master/wordlist/Injections/Traversal.txt
Robots file sometimes expose juicy information.
The information in the file may therefore help an attacker to map out the site’s contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.
Logs: ModSecurity rules triggered
2. Cross Site Scripting:
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
https://owasp.org/www-community/attacks/xss/
Payload:
Logs: ModSecurity rules triggered.
3. LFI Attack: Local File Include
Web servers control access to privileged files and resources through configuration settings. Privileged files include files that should only be accessible by system administrators. For example, the /etc/passwd file on UNIX-like platforms or the boot.ini file on Windows systems.
A LFI attack is an attempt to access privileged files using directory traversal attacks. LFI attacks include different styles including the dot-dot-slash attack (../), directory brute-forcing, directoryclimbing, or backtracking.
[Using Burp to Test for Path Traversal Vulnerabilities
Many types of functionality commonly found in web applications involve processing user-supplied input as a file or…portswigger.net](https://portswigger.net/support/using-burp-to-test-for-path-traversal-vulnerabilities "https://portswigger.net/support/using-burp-to-test-for-path-traversal-vulnerabilities")
Payload: https://raw.githubusercontent.com/xmendez/wfuzz/master/wordlist/Injections/Traversal.txt
Logs: ModSecurity rules triggered
4. Execute malicious scripts on a browser
Logs: ModSecurity rules triggered.
SQL Injection:
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.
In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.
Payload : ‘ and 1 in (select min(name) from sysobjects where xtype = ‘U’ and name > ‘.’) —
Logs: ModSecurity rules triggered.
SSRF: Server-side request forgery (also known as SSRF) is a web security vulnerability that allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker’s choosing.
In a typical SSRF attack, the attacker might cause the server to make a connection to internal-only services within the organization’s infrastructure.
Payload: ?forward=http://127.0.0.1
Web App Penetration Testing — Home LAB
Assessing Authentication Schemes // bugbounty
\=====================
Follow:
🔈 🔈Infosec Writeups is organizing its first-ever virtual conference and networking event. If you’re into Infosec, this is the coolest place to be, with 16 incredible speakers and 10+ hours of power-packed discussion sessions. Check more details and register here.
[IWCon2022 - Infosec WriteUps Virtual Conference
Network With World's Best Infosec Professionals. Find How Cybersecurity Pros Achieved Success. Add New Skills to Your…iwcon.live](https://iwcon.live/ "https://iwcon.live/")
