Cookies Not Sent over the SSL Vulnerability on a PHP website

Problem  :  

Security Audit comes to you with a Vulnerability Scan Report and Shows following vulnerability has been identified on your PHP website.

Vulnerability : Cookies Not set over the SSL 

Even you make changes to your proxy, force SSL connection to your website at IIS level , the vulnerability remains there. Changes made to web server (IIS or any other)  or Proxy level are not reflected to a PHP site because PHP settings are governed by php.ini file.

Resolution : 

Just add following 2 lines to your php.ini file under the "sessions" section : 

session.cookie_httponly = 1

session.cookie_secure = 1

Restart your website.

You will not find the "Cookies Not set over the SSL" vulnerability again in the Security Audit.

CHEERS!!!

How to Identify the type of Remote Webserver used by the website

Problem: 

Being an administrator we have to find the type of web server (IIS or Apache or IHS) used by a website without logging on to the server.

Resolution : 

• We will check the server type used for wikipedia.org as an example 
• Go to the command prompt and type telnet wikipedia.org 80 and press enter:
• Once you get the black screen (which confirms that you have connected to website on port 80)
• Type Following command on that black screen (Characters will not be visible while typing)  
• HEAD / HTTP/1.0 and press enter twice, 
• You will see the results similar to following : 

HTTP/1.1 200 OK

Server: Apache

X-Powered-By: HHVM/3.3.0-static

Last-Modified: Sun, 20 Jul 2014 01:37:07 GMT

ETag: "380-4fe96073f96c0"

Content-Type: text/html

X-Varnish: 2794515395 2763687083, 2901371103 2901280737

Via: 1.1 varnish, 1.1 varnish

Content-Length: 896

Accept-Ranges: bytes

Date: Tue, 13 Jan 2015 11:52:04 GMT

Age: 27117

X-Cache: cp1066 hit (1695), cp1066 frontend hit (27)

X-Analytics: php=hhvm

Connection: close

Set-Cookie: GeoIP=US:Morristown:40.7968:-74.4815:v4; Path=/; Domain=.154.224

You can find the server type as Apache in the results.

For Linux clients , you can use CURL utility as well.

Happy Blogging ;-)

How to check if SSL 2.0 is disabled on a website

During the PCI compliance Audit , it is generally compulsory to disable SSL 2.0 on the website. But important thing is to identify if SSL 2.0 is disabled on an IIS website or not. 

There are many sites available on internet who can check the status of SSL 2.0 on Public site but if it comes to Intranet websites , we need to use OpenSSL to check the same.

How to :

1. Download and Install OpenSSL for Windows from : http://gnuwin32.sourceforge.net/packages/openssl.htm

2. Once Installed OpenSSL on your machine, Go to the following path on the command prompt of your machine. : C:\Program Files\GnuWin32\bin>

3. Type Following command : openssl s_client -connect hostname:443 -ssl2

4. If the results are as following, SSL V2.0 is disabled on your server 

     419:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:

     420:error:1406D0B8:SSL routines:GET_SERVER_HELLO:no cipher list:s2_clnt.c:450:

5. If you get the actual certificate information then SSL V2.0 in enabled on your Server.

Enjoy

Error 0x80010108 -The object invoked has disconnected from its clients- on TMG Forefront 2010 server

Issue : 

Receiving - error 0x80010108, The object invoked has disconnected from its clients - on TMG forefront 2010 server

Resolution  : 

Reboot the secondary node of the TMG Forefront Array and make sure that following services have been started after the reboot.

1. Microsoft Forefront TMG Control

2. Microsoft Forefront TMG Firewall

3. Microsoft Forefront TMG Job Scheduler

4. Microsoft Forefront TMG Managed Control

5. Microsoft Forefront TMG Storage

In most of the cases this resolves the issue.

Enjoy....

IIS Error : Could not load file or assembly 'System.Web.Extensions, Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.

Error

Some times we face Application error in "/" application after migration the ASP.net site from one server to other ever after making all the changes perfect.

Error :  Could not load file or assembly 'System.Web.Extensions,

Version=1.0.61025.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of
its dependencies. The system cannot find the file specified.

Resolution:

1. Check if you application folder contains a folder with name "ajax" when you copied it from old server.

2. If yes then download and install the Ajax Extensions 1.0 for ASP.NET 2.0 on new server.

3. Reset the IIS (though it is not necessary but its good to reset IIS after such installation.)

You can download Ajax Extensions 1.0 from from Microsoft Download Center.

Solution Applies to:

Windows Server 2003. IIS 6.0, ASP.Net 2.0

How To Check If Trace\Track is Enabled on an IIS server

What is Trace \ Track on IIS

Trace \ Track is a vulnerability that is usually identified on an IIS server when we run PCI compliance and find this vulnerability. A hacker can run a Trace attack on IIS Website and get information about the Backend server and other important information.

In latest versions on IIS (IIS 6.0, 7.5) Trace is disabled by default but still it is good idea to make sure that Trace is disabled on IIS.

Testing if Trace \ Track is Enabled on a IIS website or not

Follow these steps :

1. Go to command Prompt of your Machine.
2. Type telnet <URL of the website> 80 (this will open a telnet session of that website on port 80)
3. Type following commands on the telnet session screen in exact same order: 

      TRACE / HTTP/1.0
    Host: <hostname_you_are_testing>
    TestA: Hello
    TestB: World

4. Press enter twice. 

If Trace is enabled on your server, you should see following results:

      HTTP/1.1 200 OK
    Server: Microsoft-IIS/5.0
    Date: Tue, 04 Aug 2009 20:17:15 GMT
    Content-Type: message/http
    Content-Length: 76 

And If you receive following results on the telnet screen, then Trace is enabled :

     HTTP/1.1 501 Not Implemented
    Content-Type: text/html
    Server: Microsoft-IIS/7.5
    X-Powered-By: ASP.NET
    Date: Tue, 15 Oct 2013 12:21:33 GMT
    Content-Length: 1508

    Connection: close


Disabling Trace or Track on IIS

The easiest way to mitigate the risk of Trace \ Track on iis is  : installing URLScan from Microsoft, 
The urlscan.ini file is included as part of URLScan . This sets by default a configuration setting "UseAllowVerbs=1".  In this [AllowVerbs] section of the ini file, only http methods that are allowed are GET, HEAD, and POST so simply by installing URLScan on an IIS server , we can assume that it  protected from TRACE or TRACK.  

How to connect SQL Embbeded Version via Management Studio

Use the following connection string in SQL Management Studio while trying to connect SQL Database server running Embedded Edition :

\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query


Applicable for SQL Server 2005 and SQL Server 2008