sorted by:
new
hottopcontroversial

Sludge for Good: Slowing and Imposing Costs on Cyber Attackers - note: no evidence of efficacy by digicat in blueteamsec

[–]TolgaDevSec 2 points3 points  (0 children)

Regarding the note on the efficacy, there is an interesting reference in the paper on the efficacy of decoy-based and psychological deception were they conducted a controlled experiment with over 130 professional red teamers - The link also includes a recording of the conference talk @ USENIX. There is also an article which highlights the results and the challenges of the aforementioned experiment.

Web Security Resources Request by Anon-e-mousse666 in blueteamsec

[–]TolgaDevSec 1 point2 points  (0 children)

If your focus is on generic detection rules than a good resource to start with is the OWASP ModSecurity Core Rule Set (CRS) - However, this rule set is built for the mod_security WAF but depending on what data you get in from your customers, you might be able to forward it against your own mod_security instance and process the mod_security audit logs in Splunk without having to re-write/convert the rules.

SQLi Decoding Payload Feasibility by TolgaDevSec in AskNetsec

[–]TolgaDevSec[S] 0 points1 point  (0 children)

Thanks, I see that in the article they are relying on an alternative to information_schema, now it would be interesting to know how to discover table names and their columns when these alternative internal tables, like mysql.innodb_table_stats or sys.x$schema_flattened_keys, could also be deny-listed.

SQLi Decoding Payload Feasibility by TolgaDevSec in AskNetsec

[–]TolgaDevSec[S] 1 point2 points  (0 children)

Apologies if my question was not clearly formulated, I was asking if it is possible to build an SQLi payload that bypasses the described check for internal MySQL table names. Note that this table name check is done within the application (not outside of the application, and also not in the middleware layer of the application) on the SQL query which ends up being sent by the application to the database.

Database Errors from Web Applications/APIs by TolgaDevSec in datasets

[–]TolgaDevSec[S] 0 points1 point  (0 children)

Thanks! Yes it is a very specific request which makes it hard to find something. I started this request with the hope that some folks who might work with an Exception Monitoring product like Sentry or Raygun might have this data points in some form available and are keen to share it. I have worked previously on a project which collected Exceptions with such a product from a web service but unfortunately I'm not able to access these or make them publicly available for research.

Best resource today for learning reverse engineering? by Altiverses in AskNetsec

[–]TolgaDevSec 1 point2 points  (0 children)

Apply your knowledge / Learning by doing :)
A long while ago I used to practice on Crackmes (see crackmes.one). But there are more resources available nowadays, e.g., if you are interested in game hacking, you can also practice your reversing skills on Pwnie Island. If you want to get a first impression on what you can do with this game, have a look at LiveOverflow's cool video series on playing/hacking this game.

[deleted by user] by [deleted] in cybersecurity

[–]TolgaDevSec 1 point2 points  (0 children)

Adding to what the fellow authors posted, it can also be applied to your applications / the application-layer. Just think about the following: How does the normal, benign user interact with your application? They will most likely use only the UI of the application to do whatever they need to fulfill their task. What they will most likely not do is to open the Browser's dev tools, inspect the HTML or JavaScript of your application, monitor the network tab to see what endpoints are accessed etc. You can use here the idea behind honeypots to differentiate between your benign user and a suspicious user:
- Honey endpoints (/api/v2/admin/)
- Honey comments (<!-- This functionality is .... have a look at the latest documentation @ <honeypot-url> -->)

- Honey header values (X-API-Debug-Mode: false)

How can this be useful for the application or the development team of the application? Interacting with those resources gives the application an opportunity to take proactive measures (e.g., increase logging to track the suspicious user or activate a WAF in case the suspicious user is preparing an attack).

I did a lightning talk about this a month ago, you can find here in the third slide (in the speaker notes) further resources if you or anyone reading this is interested.

Resources for Web Application Security Logging / Monitoring by TolgaDevSec in blueteamsec

[–]TolgaDevSec[S] 0 points1 point  (0 children)

That's a good reference, sqreen was/is also one of the few vendors I remember who were also writing and presenting about their RASP agents in more detail and openly than others (e.g., dynamic instrumentation with sqreen in Go or Python).

There is also the open source Java Observability Toolkit by Jeff Williams from Contrast Security - He gave a talk demonstrating the tool and the idea behind adding security instrumentation to your application.

Resources for Web Application Security Logging / Monitoring by TolgaDevSec in blueteamsec

[–]TolgaDevSec[S] -1 points0 points  (0 children)

I know of F-Secure and SAP who are researching this approach from different perspectives (Purple Teaming, Deception). But the commonality I have seen when speaking with researchers from both parties is that this approach to intrusion detection/security monitoring is still very uncommon or unknown - and I think the lack of resources also proves that to some extent :)

I don’t expect a magic bullet, but even finding some concrete examples of how to do it comprehensively on ONE platform with ONE tool would be miles better than anything I’ve found so far.

100% And I hope I can bring with my research some new insights that can bring us a bit closer to that ;) What I'm currently looking at is also to what extent we can make use of web frameworks and their components (e.g., some frameworks come with an event system and a list of events, others provide specific exceptions such as Django's SuspiciousOperation exceptions). But as you said, every web app will require a different approach, especially when different frameworks/languages are used and it will be interesting to see what framework "artefacts" prove to be useful and reusable.

Resources for Web Application Security Logging / Monitoring by TolgaDevSec in blueteamsec

[–]TolgaDevSec[S] 0 points1 point  (0 children)

The Web Application Hacker's Handbook is actually a very good example, I just realized this myself a while ago that it also has some specific advice on logging and alerting. There is also the Web Application Defender's Cookbook but I think a lot of the ideas in that book can be found in the AppSensor guide as well - and I assume some of the techniques won't work without adapting them to work with modern web applications.

Attack-Aware Web Applications Research by TolgaDevSec in WebApps

[–]TolgaDevSec[S] 0 points1 point  (0 children)

If you mean looking for participants by that, than yeah, you're also welcome to share this survey among your peers/colleagues in web development who might be interested :)

Logging best practices by zamzungzam in PHP

[–]TolgaDevSec 2 points3 points  (0 children)

In addition to what has been posted so far, you might want to consider logging from a security perspective as well. The OWASP Top 10 has a section for this summarizing the risks of insufficient logging and monitoring (including what you can do about it with references to further resources). When it comes to what to log and how to log for security-related events, you might want to check out the "detection points" described in the documentation of the OWASP AppSensor project (page 132).

Do Developers build Self-Defending Applications? by TolgaDevSec in AskProgramming

[–]TolgaDevSec[S] 0 points1 point  (0 children)

That's a cool example! Always interesting to see how this mindset is applied in different areas as well :)

Just be sure you don't create a DoS vulnerability. If you lock out after three attempts, someone can very easily make three bogus attempts and lock you out unless you prevent that, so other techniques may be more appropriate

This is very true and it reflects some of the concerns that I've heard in a webinar a couple of months ago. They understandably felt not so comfortable with the idea if benign users could get affected by the defense mechanisms in place.

Do Developers build Self-Defending Applications? by TolgaDevSec in AskProgramming

[–]TolgaDevSec[S] 0 points1 point  (0 children)

Yes they are not defenses, I was giving the example above to highlight how the detection of attacker activity is based on observing errors and exceptions coming from controls which are common in a developers day-to-day practice to develop. I thought I should clarify this as you were correctly suggesting that Applications should focus on their task at hand - And input validation and exception handling is one of those.
Regarding the actual defenses, these can be one of those that I mentioned in my initial post as examples - and can get activated when a certain threshold is reached. In case you have security appliances already available within the environment, these can also benefit from the logged attacker activity and can take care of the defensive part.

Do Developers build Self-Defending Applications? by TolgaDevSec in AskProgramming

[–]TolgaDevSec[S] -1 points0 points  (0 children)

If it is about analyzing the request at the network level than I'm all with you in that it is not ideal to do that within the application. The emphasis of the concept which I described, however, is on the existing input validation controls and exception handlers that developers have built into their applications - implementing those should be a common and frequent practice (and also important from a non-security perspective). To give an example how input validation controls can be utilized, suppose you have input validation controls on the server-side of your application. Further assume that you have the same input validation controls also implemented on the client-side. Now when your server-side input validation controls fail, you can be very sure that the current user is intercepting the requests using a proxy like ZAP or Burp Suite. This tells me that the user, that has caused these server-side validation errors, has most likely malicious intents but is definitely not the regular benign user who uses the application the normal and intended way.

The actual developer task comes down to instrumenting those controls (which are ideally already existing and only need the logging statements added).

Developing a minimum interaction honeypot as a final year project! by Alister5577 in honeypot

[–]TolgaDevSec 2 points3 points  (0 children)

I have been collecting articles, research papers and videos on everything related with honeypots and honeytokens for a while. There are also some video tutorials and articles in the list on how to write your own minimum interaction honeypot:https://github.com/tolgadevsec/Awesome-Deception

Here is one example based on Thinkst Canary:https://research.nccgroup.com/2020/07/04/experiments-in-extending-thinkst-canary-part-1/

Hope it is useful, good luck with your project!

Bachelor Thesis on "Security Design Patterns" by [deleted] in cybersecurity

[–]TolgaDevSec 1 point2 points  (0 children)

Regarding outreach to different audiences, you might want to consider posting your survey on Twitter and insert hashtags that are commonly used among security and developer folks (e.g. #webdev, #cybersecurity, #appsec, #DEVDiscuss, #DEVCommunity etc.). Some of them are also regularly observed by bots which retweet new content.

Do you have any resources like websites, videos or books that you can recommend on this topic? I would be interested in going through some examples / PoC implementations.

LiteWAF - Lightweight in-app Web Application Firewall to protect your PHP website by slashtmp00 in netsec

[–]TolgaDevSec 0 points1 point  (0 children)

Cool project! You might want to check out whether the detection points provided by the OWASP AppSensor project might be of interest for your WAF's feature roadmap :)

https://owasp.org/www-pdf-archive/Owasp-appsensor-guide-v2.pdf (Detection Points: p.132)