5 ms·

Or, you know, install these tools and get started: Scanners: - Nikto (https://cirt.net/nikto2) - A comparison of tools from 2017 (http://sectoolmarket.

Or, you know, install these tools and get started: Scanners: - Nikto (https://cirt.net/nikto2) - A comparison of tools from 2017 (http://sectoolmarket.com/price-and-feature-comparison-of-web-application-scanners-unified-list.html) Web Application Firewalls: - ModSecurity (https://geekflare.com/install-modsecurity-on-nginx/) - Enable OWASP rules in ModSecurity (https://geekflare.com/modsecurity-owasp-core-rule-set-nginx/) - Vulture (https://www.vultureproject.org/) - Pay $500 to have SpiderLabs configure ModSecurity for you (https://ssl.trustwave.com/web-application-firewall) - Nginx (https://www.nginx.com/products/nginx-waf/) - Azure (https://azure.microsoft.com/en-us/blog/azure-web-application-firewall-waf-generally-available/) - AWS (https://aws.amazon.com/waf/) - Symantec (https://www.symantec.com/products/web-application-firewall-reverse-proxy) - Incapsula (https://www.incapsula.com/website-security/web-application-firewall.html) - Smoothwall (holy cow, they're still around? https://us.smoothwall.com/utm/) - Shadow daemon (probably defunct, https://shadowd.zecure.org/overview/introduction/) - IronBee (same, https://github.com/ironbee/ironbee) Hardening guides: - Apache (https://www.tecmint.com/apache-security-tips/) - Nginx (https://geekflare.com/nginx-webserver-security-hardening-guide/)

tptacek 9y ago
Don't do most of this.
- andyfleming 9y ago
  Care to elaborate?
  - tptacek 9y ago
    You almost certainly don't want to set up a WAF. Don't use any of those scanners, all of which look almost exclusively for vulnerabilities you don't have. Do look into getting a Burp license for every developer on your team. By all means, harden Nginx. Don't pay SpiderLabs to do it for you.
    - peterwwillis 9y ago
      A WAF will stop a lot of the stupid junk that a kid with a "how 2 hax0r" book can make work a disturbing amount of the time.
      - tptacek 9y ago
        If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Don't waste time with this stuff.
        nxc18 9y ago
        I assume you are writing in an attempt to persuade. Your message is being lost/ignored as a result of your delivery. We want to understand your message, but you aren't giving enough background. I don't trust your message because there is no supporting background. If you're going to tell me to not do something, either: A) provide a compelling alternative (not doing $it is not a compelling alternative to $it in nearly all cases) B) explain in detail why you shouldn't do $it. Provide more details if asked. I want to believe what you are saying and be convinced by it, please help me. (Note: I'm not trying to be a dick, I've just known a lot of people who are perpetually ignored because of this communication style and take forever to learn that lesson because no one bothers to say anything)
        tptacek 9y ago
        In this instance, I'm just interested in getting the right answer written down and moving on.
        pvg 9y ago
        I'm not trying to be a dick You are succeeding without trying. You're essentially complaining some free advice does not fit your exact expectations and specifications. Which is fine, lots of free advice doesn't. Trying to pass this complaint off as some kind of favour to the person giving you free advice, though, is... less than great.
  - peterwwillis 9y ago
    The problem with throwing tools at the thing is you have no idea what it's doing or how it works or IF it works, and it becomes forgotten about. But it's better than nothing in the short term while you figure out how to secure your application. Slap ModSecurity in front of your app while you go over OWASP and managing cloud infrastructure securely.
  - technion 9y ago
    In addition to the points discussed.. If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning: >NOTE: Some instabilities in the Nginx add-on have been reported (see the Github issues page for details). Please use the "nginx_refactoring" branch where possible for the most up to date version and stay tuned for the ModSecurity version 4. That's not something I would suggest throwing in production, given that warning has been there for years. The post itself describes Shadow daemon as "probably defunct". Ironbee's last commit was two years ago and I get an nxdomain looking for their website. AWS WAF is both expensive and and extremely manual. You won't get anything out of it without a major labour investment. Nginx's built in WAF is only in the pro edition, and outside the price of many people. This whole discussion however depends on your customer. I have an agency I support where I have to provide a report on every single hack attempt. That means if my Rails application gets hit with said three year old Wordpress exploit, and the web server "404", I have to report on how we "blocked" it. And no, "not applicable" is not an answer. So we throw money at commercial products. And sometimes I recommend doing so. But like security can involve just being aware of your risks, this use of a WAF is about being aware of the real problem you're solving, which is a paper work based one.

tptacek 9y ago

Don't do most of this.

andyfleming 9y ago
Care to elaborate?
- tptacek 9y ago
  You almost certainly don't want to set up a WAF. Don't use any of those scanners, all of which look almost exclusively for vulnerabilities you don't have. Do look into getting a Burp license for every developer on your team. By all means, harden Nginx. Don't pay SpiderLabs to do it for you.
  - peterwwillis 9y ago
    A WAF will stop a lot of the stupid junk that a kid with a "how 2 hax0r" book can make work a disturbing amount of the time.
    - tptacek 9y ago
      If any of that stuff is actually working on your site, not having a WAF is the least of your problems. Don't waste time with this stuff.
      - nxc18 9y ago
        I assume you are writing in an attempt to persuade. Your message is being lost/ignored as a result of your delivery. We want to understand your message, but you aren't giving enough background. I don't trust your message because there is no supporting background. If you're going to tell me to not do something, either: A) provide a compelling alternative (not doing $it is not a compelling alternative to $it in nearly all cases) B) explain in detail why you shouldn't do $it. Provide more details if asked. I want to believe what you are saying and be convinced by it, please help me. (Note: I'm not trying to be a dick, I've just known a lot of people who are perpetually ignored because of this communication style and take forever to learn that lesson because no one bothers to say anything)
        tptacek 9y ago
        In this instance, I'm just interested in getting the right answer written down and moving on.
        pvg 9y ago
        I'm not trying to be a dick You are succeeding without trying. You're essentially complaining some free advice does not fit your exact expectations and specifications. Which is fine, lots of free advice doesn't. Trying to pass this complaint off as some kind of favour to the person giving you free advice, though, is... less than great.
- peterwwillis 9y ago
  The problem with throwing tools at the thing is you have no idea what it's doing or how it works or IF it works, and it becomes forgotten about. But it's better than nothing in the short term while you figure out how to secure your application. Slap ModSecurity in front of your app while you go over OWASP and managing cloud infrastructure securely.
- technion 9y ago
  In addition to the points discussed.. If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning: >NOTE: Some instabilities in the Nginx add-on have been reported (see the Github issues page for details). Please use the "nginx_refactoring" branch where possible for the most up to date version and stay tuned for the ModSecurity version 4. That's not something I would suggest throwing in production, given that warning has been there for years. The post itself describes Shadow daemon as "probably defunct". Ironbee's last commit was two years ago and I get an nxdomain looking for their website. AWS WAF is both expensive and and extremely manual. You won't get anything out of it without a major labour investment. Nginx's built in WAF is only in the pro edition, and outside the price of many people. This whole discussion however depends on your customer. I have an agency I support where I have to provide a report on every single hack attempt. That means if my Rails application gets hit with said three year old Wordpress exploit, and the web server "404", I have to report on how we "blocked" it. And no, "not applicable" is not an answer. So we throw money at commercial products. And sometimes I recommend doing so. But like security can involve just being aware of your risks, this use of a WAF is about being aware of the real problem you're solving, which is a paper work based one.