OGH DBA Dag 14 september 2010 Frits Hoogland

More documents

Recommendations

Info

Bibliography & Links Google hacking– http://www.certconf.org/presentations/2005/files/WD4.pdf– http://www.thenetworkadministrator.com/googlesearches.htm Corkscrew (getting ssh through a proxy)– http://www.agroman.net/corkscrew/ Center for Internet Security (securityconfiguration benchmarks)– http://www.cisecurity.org/ Mod_security (apache http audit / filter)– http://www.modsecurity.org/ nmap (network mapper / scanner)56– http://nmap.org/Tuesday, September 14, 2010
Bibliography & Links hping (packet generator and analyzer)– http://www.hping.org/ Wireshark (protocol analyzer)– http://www.wireshark.org/ Nessus (vulnerability scanner)– http://www.nessus.org/nessus/ OpenVAS (open source vulnerability scanner)– http://www.openvas.org/ Metasploit (creating tools and using exploits)– http://www.metasploit.com/home/ Nikto (web server scanner)57– http://cirt.net/nikto2Tuesday, September 14, 2010
Page 1:
Oracle HTTP serversecurityOGH DBA D
Page 7 and 8: Firewall!7Tuesday, September 14, 20
Page 9 and 10: Firewallhost.example.comFirewallhos
Page 11 and 12: Firewall Examples of firewalls:- PI
Page 13 and 14: Architecturehost.example.comhost.dm
Page 15 and 16: Webserver Clients communicate with
Page 17 and 18: Tuesday, September 14, 201017
Page 19 and 20: Figure 6 shows the change over time
Page 26 and 27: How to harden? Webserver scanner: N
Page 28 and 29: Example: incorrect config We got a
Page 33 and 34: HTTPSQ: Does HTTPS make your site m
Page 37 and 38: HTTPS HTTPS encrypts communication-
Page 39 and 40: Scanning yourself To harden for the
Page 41 and 42: Information spilling- To ‘Prod’
Page 43 and 44: Information spilling No guarantee,
Page 45 and 46: Information spilling Web cache mana
Page 47 and 48: Ports < 1024 On Linux/Unix requires
Page 49 and 50: mod_security Apache module- Functio
Page 51 and 52: mod_security It’s easy to add mod
Page 53 and 54: mod_security Some of the rules it t
Page 55: Q & AThank you for attending!55Tues
show all

OGH DBA Dag 14 september 2010 Frits Hoogland

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?