Окт 02 07:19

Security incident with variable overwriting

During our work process we are stumbling upon different web developers’ whims. The last thing that surprised me a lot, was the use of $_REQUEST superglobal array in PHP for storing global variables. This is not a good idea, and I'll try to explain to you why.

Сеп 12 01:42

Doing it securely with OpenSSH

Today, in the Unix world, remote administration is a must. Telnet, while still used here and there, is awfully insecure, old and useless for the task. Most, if not all, administrative tasks can be performed on the command line, so the only universal choice left is OpenSSH/SSH...

Авг 24 07:24

Centralized syslog facility with web interface for easy search

In medium or big corporate network there is always a questions like “how do we log all the activities from server hosts” or “how do we implement audit trails”...

Юли 29 09:59

Reverse SSL proxy vs VPN solutions for internal web applications

In one of my previous jobs we had lots of partners. They all used some internal web applications. Such applications can not be exposed to the whole Internet, so we had to use some technology to protect them. What were our options?

Юли 28 15:43

SELinux - simple use

SELinux is a hot and still new topic in the security world. It's one of the tools that makes RHEL 5 so secure (EAL 4+). Let's see what it is and how hard would it be to utilize it's power for our protection...

Юни 29 12:31

Proxy Scan v0.1

The first version of a hardly working, poorly written, multithread, C# application that uses CONNECT method to scan internal networks through badly configured proxy servers.

Ofcourse you know that proxy servers support the CONNECT request, which browsers use to request connection to HTTPS sites. Those connections are encrypted, so the proxy server can't do much except to create a channel between the browser and the HTTPS site and just pass the traffic back and forth.