<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
On 24/05/2011 21:52, <a class="moz-txt-link-abbreviated" href="mailto:patrick.gaikowski@kaufland.com">patrick.gaikowski@kaufland.com</a> wrote:
<blockquote
cite="mid:OFE4921435.A546A78F-ONC125789A.0070E52C-C125789A.0072A798@de.int.kaufland"
type="cite">
<p><font face="sans-serif" size="2">Hi,</font><br>
<br>
<font face="sans-serif" size="2">i'm preparing Zendto for
Penetration Test and used some Scanner like Paros, Nikto ...</font><br>
<br>
<font face="sans-serif" size="2">1.) deactivate X-Powered-By
(Server sends exact PHP-Version to client)</font><br>
<br>
<font face="sans-serif" size="2">in php.ini --> expose_php =
Off</font><br>
<br>
<font face="sans-serif" size="2">2.) deactivate HTTP TRACE (used
by Security Scanner for XSS)</font><br>
<br>
<font face="sans-serif" size="2"><a moz-do-not-send="true"
href="http://www.ducea.com/2007/10/22/apache-tips-disable-the-http-trace-method/">http://www.ducea.com/2007/10/22/apache-tips-disable-the-http-trace-method/</a></font><br>
</p>
</blockquote>
Thanks for those two. I will try to make sure they get into the 4.02
(or is it 4.03?) release of the ZendTo VM images.<br>
<blockquote
cite="mid:OFE4921435.A546A78F-ONC125789A.0070E52C-C125789A.0072A798@de.int.kaufland"
type="cite">
<p>
<br>
<font face="sans-serif" size="2">3.) using mod_security as
module for apache</font><br>
</p>
</blockquote>
Do I need this? It adds another level of complexity to things,
unless there are yum and apt packages of it that I can just include.
Do you know if there are?<br>
<br>
Many thanks,<br>
Jules.<br>
<br>
<blockquote
cite="mid:OFE4921435.A546A78F-ONC125789A.0070E52C-C125789A.0072A798@de.int.kaufland"
type="cite">
<p>
<br>
<font face="sans-serif" size="2">Mod_Security is an open source
Web application firewall with a lot of preconfigured rulesets.
Mod_Security prevents Injections, XSS, Commands ... I played
with mod_security and add an sample (not complete)</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2"># Prevents Path
disclosure for PHP Fatal Error</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
RESPONSE_BODY "Fatal Error:"
"deny,status:500,log,auditlog,msg:'PHP Fatal Error blocked'"</font><br>
<font color="#ff0000" face="sans-serif" size="2">ErrorDocument
500 /security-error.php</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">#Prevent
Security Scanner from Scanning the WebApplication"</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
HTTP_User-Agent "(?:\b(?:m(?:ozilla\/4\.0
\(compatible\)|etis)|webtrends security
analyzer|pmafind)\b|n(?:-stealth|sauditor|essus|ikto)|b(?:lack
?widow|rutus|ilbo)|(?:jaascoi|Paro)s|internet
explorer|webinspect|\.nasl)" \</font><br>
<font color="#ff0000" face="sans-serif" size="2">"deny,log,msg:'Request
Indicates a Security Scanner Scanned the
Site',,status:500,phase:2"</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">SecDefaultAction
phase:2,redirect:/security-error.php,status:509,log,auditlog</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">#Hides the
Webserver signature (IIS, Apache ...)</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecServerSignature
"Hotzenplotz"</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">#Root-Path</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
REQUEST_URI "^/$" "log,allow,phase:2"</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">#needed for
ReCaptcha</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
REQUEST_URI "<a moz-do-not-send="true"
href="https://www.google.com/recaptcha/api/image$">https://www.google.com/recaptcha/api/image$</a>"
"log,allow,phase:2"</font><br>
<br>
<font color="#ff0000" face="sans-serif" size="2">#PHP-Sites</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
REQUEST_FILENAME "^/security-error.php$" "log,allow,phase:2"</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
REQUEST_FILENAME "^/about.php$" "log,allow,phase:2"</font><br>
<font color="#ff0000" face="sans-serif" size="2">SecRule
REQUEST_FILENAME "^/verify.php$" "log,allow,phase:2"</font><br>
<font color="#ff0000" face="sans-serif" size="2">....</font><br>
<br>
<font face="sans-serif" size="2">The sample is not complete ...</font><br>
<br>
<font face="sans-serif" size="2">Mit freundlichen Grüßen / Best
regards<br>
<br>
Patrick Gaikowski<br>
Tel: +49 7132 94 3568<br>
Fax: +49 7132 94 73568<br>
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:patrick.gaikowski@kaufland.com">patrick.gaikowski@kaufland.com</a><br>
KI 967800 IT International / Infrastruktur<br>
Office:<br>
Lindichstrasse 11<br>
D-74189 Weinsberg</font><br>
<br>
<br>
<font face="sans-serif" size="2"><a moz-do-not-send="true"
href="http://www.kaufland.de">http://www.kaufland.de</a> </font><br>
<font face="sans-serif" size="2">Wir sind die Nr. 1:</font><br>
<font face="sans-serif" size="2">Kaufland ist "Bester
Lebensmittelmarkt 2011"!</font><br>
<br>
<font face="sans-serif" size="2">Kaufland Informationssysteme
GmbH & Co. KG</font><br>
<font face="sans-serif" size="2">Postfach 12 53 - 74149
Neckarsulm<br>
Kommanditgesellschaft<br>
Sitz: Neckarsulm<br>
Registergericht: Amtsgericht Stuttgart HRA 104163</font><br>
</p>
<pre wrap="">
<fieldset class="mimeAttachmentHeader"></fieldset>
_______________________________________________
ZendTo mailing list
<a class="moz-txt-link-abbreviated" href="mailto:ZendTo@zend.to">ZendTo@zend.to</a>
<a class="moz-txt-link-freetext" href="http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto">http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">Jules
--
Julian Field MEng CITP CEng
<a class="moz-txt-link-abbreviated" href="http://www.Zend.To">www.Zend.To</a>
Follow me at twitter.com/JulesFM
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
'Teach a man to reason, and he will think for a lifetime.' - Phil Plait 'All programs have a desire to be useful' - Tron, 1982
</pre>
</body>
</html>