VirtualTam's bookmarks

201. Content Security Policy CSP Reference & Examples 2018-02-07

     tags: internet/browser, privacy, security, web, xss

     [ permalink ]

     • https://en.wikipedia.org/wiki/Content_Security_Policy
     • https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
     • https://www.owasp.org/index.php/Content_Security_Policy
     • https://developers.google.com/web/fundamentals/security/csp/
202. Data Privacy Day 2018: Live Free of Facebook and Google Tracking 2018-02-07

     tags: data, privacy, search, security

     [ permalink ]

     • https://spreadprivacy.com/how-to-remove-google/
     • https://duckduckgo.com/app
203. Exploiting modern microarchitectures: Meltdown, Spectre, and other attacks 2018-02-05

     tags: hack, hardware, hardware/cpu, meltdown, memory, security, spectre

     [ permalink ]

     • https://fosdem.org/2018/interviews/jon-masters/
     • https://fosdem.org/2018/schedule/event/closing_keynote/
204. entropy - How secure are "pattern" passwords? - Information Security Stack Exchange 2018-01-28

     tags: entropy, privacy, security, security/password

     [ permalink ]

     • https://github.com/davean/typing-effort
205. Don't publicly expose .git, or how we downloaded your website's sourcecode - An analysis of Alexa's 1M 2018-01-20

     tags: apache, network/http, network/http-server/nginx, security, source-code-management, source-code-management/git, web

     [ permalink ]

     • https://stackoverflow.com/questions/2530372/how-do-i-disable-directory-browsing
     • https://httpd.apache.org/docs/current/mod/mod_rewrite.html

     via https://git.github.io/rev_news/2017/06/14/edition-28/

206. Privacy Tools - Encryption Against Global Mass Surveillance 2018-01-12

     tags: cryptography/encryption, internet/browser, privacy, security, web

     [ permalink ]
207. How to Setup FileBeat with Basic Auth for LogStash Output? - Filebeat - Discuss the Elastic Stack 2018-01-12

     tags: cryptography/certificate, cryptography/certificate-authority, network/transport-layer-security, observability/elastic, observability/elastic/beats, observability/elastic/logstash, security, security/authentication

     [ permalink ]

     • https://github.com/logstash-plugins/logstash-input-beats/issues/8
     • https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html
     • https://www.elastic.co/guide/en/beats/filebeat/master/config-filebeat-logstash.html
     • https://www.elastic.co/guide/en/beats/filebeat/current/configuring-ssl-logstash.html
     • https://www.gilesorr.com/blog/elkbeats-beats-secure.html
     • https://discuss.elastic.co/t/beats-logstash-security-use-of-security-token-to-authenticate-clients/104981/4
     • https://stackoverflow.com/questions/40341664/how-to-configure-logstash-and-filebeat-ssl-communication
208. Shodan 2018-01-09

     tags: device, hack, internet-of-things, network, privacy, security

     [ permalink ]

     • https://news.ycombinator.com/item?id=5512477

     • https://thehackernews.com/search/label/shodan

     • https://www.forbes.com/sites/kashmirhill/2013/09/05/the-crazy-things-a-savvy-shodan-searcher-can-find-exposed-on-the-internet/#7d00f4f23c7e

     • https://www.wired.com/2013/05/googles-control-system-hacked/

     • https://www.forbes.com/sites/andygreenberg/2011/11/09/researchers-spot-blue-coat-web-control-gear-in-another-bad-regime-burma/#6a615a3e329c

     • https://www.forbes.com/sites/kashmirhill/2013/08/13/how-a-creep-hacked-a-baby-monitor-to-say-lewd-things-to-a-2-year-old/#3ce17adcaad6

     • https://raidforums.com/Thread-Using-Shodan-for-Fun-and-Profit

209. Trinity uses nmap in The Matrix Reloaded 2018-01-08

     tags: hack, matrix, movie, network/nmap, network/ssh, security

     [ permalink ]

     • https://nmap.org/movies/
     • https://nmap.org/movies/matrix/
     • https://www.quora.com/Is-the-use-of-the-NMAP-command-shown-in-The-Matrix-Reloaded-movie-valid
     • https://www.securityfocus.com/news/4831
210. Who was responsible for leaking the Meltdown/Spectre story beforehand, and thus breaking the co-ordinated patched release planned for 9th-Jan between various vendors? 2018-01-08

     tags: hack, hardware, hardware/cpu, intel, linux, memory, security

     [ permalink ]

     • https://cyber.wtf/2017/07/28/negative-result-reading-kernel-memory-from-user-mode/
     • https://cyber.wtf/2018/01/05/behind-the-scene-of-a-bug-collision/
     • https://lwn.net/Articles/738975/
     • https://lwn.net/Articles/741878/
     • https://lwn.net/Articles/741882/
     • https://twitter.com/misc0110/status/948706387491786752
     • https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/
211. Meltdown and Spectre 2018-01-04

     tags: amd, arm, attack, google, hack, hardware, hardware/cpu, intel, memory, research, security

     [ permalink ]

     • https://security.googleblog.com/2018/01/todays-cpu-vulnerability-what-you-need.html
     • https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
     • https://www.reddit.com/r/linux/comments/7nybl1/meltdown_and_spectre/
     • https://www.reddit.com/r/linux/comments/7nzsih/intel_was_aware_of_the_chip_vulnerability_when/
     • https://www.reddit.com/r/linux/comments/7nyaku/todays_cpu_vulnerability_what_you_need_to_know/

     Exploits:

     • https://github.com/IAIK/meltdown
212. RFID cat door using Arduino -Use Arduino for Projects 2018-01-03

     tags: cat, door, embedded/arduino, rfid, security/authentication

     [ permalink ]

     • https://playground.arduino.cc/Main/DIYRFIDReader
     • http://www.instructables.com/id/RFID-pet-feeder/
     • https://electronics.stackexchange.com/questions/24481/134-2-khz-rfid-reader-for-arduino
213. scipag/vulscan: Advanced vulnerability scanning with Nmap NSE 2017-11-29

     tags: network, network/nmap, scanner, security, service

     [ permalink ]
214. Portus - Authorization service and user interface for the next generation Docker Registry 2017-11-06

     tags: image, linux/container, linux/container/docker, programming/ruby, repository, security/authentication, web

     [ permalink ]

     • https://github.com/SUSE/Portus
215. A Mailserver on Ubuntu 16.04: Postfix, Dovecot, MySQL – Ex Ratione 2017-11-05

     tags: antivirus, email, email/dovecot, email/postfix, linux, security, spamassassin

     [ permalink ]
216. WebGoat/WebGoat: A deliberately insecure Web Application 2017-11-03

     tags: hack, leak, owasp, programming/java, security, web

     [ permalink ]
217. WireGuard: fast, modern, secure VPN tunnel 2017-11-02

     tags: mobile/android, network, network/vpn, network/vpn/wireguard, privacy, security

     [ permalink ]

     • https://git.zx2c4.com/WireGuard
     • https://github.com/WireGuard/WireGuard (mirror)
     • https://www.reddit.com/r/linux/comments/6owk5x/formal_verification_of_the_wireguard_protocol/
     • https://www.reddit.com/r/haskell/comments/6nv1n2/wireguard_vpn_just_got_formally_verified_with/
     • https://www.xda-developers.com/wireguard-vpn-project-support-android-roms/
     • https://mirror.as35701.net/video.fosdem.org/2017/Janson/wireguard.mp4
     • https://archive.fosdem.org/2017/schedule/event/wireguard/
     • https://eprint.iacr.org/2018/080
     • https://wiki.archlinux.org/index.php/WireGuard
     • https://bbs.archlinux.org/viewtopic.php?id=231469
218. Playing HTTP Tricks with Nginx | Elastic 2017-10-09

     tags: network/http, network/http-server/nginx, observability/elastic, observability/elastic/elasticsearch, observability/elastic/kibana, security, security/authentication

     [ permalink ]

     The X-Pack plugin comes with a subscription plan and a 30-day trial license:

     • https://www.elastic.co/subscriptions
     • https://www.elastic.co/guide/en/x-pack/current/license-expiration.html
     • https://discuss.elastic.co/t/after-x-pack-license-expiration/78072/7

     Once the license has expired, a number of features become unavailable, among which is user management (authentication, authorization).

219. Generate Mozilla Security Recommended Web Server Configuration Files 2017-10-09

     tags: apache, cipher, network/http, network/http-server/nginx, network/transport-layer-security, security, server

     [ permalink ]

     • https://github.com/mozilla/server-side-tls
     • https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
     • https://security.stackexchange.com/questions/51680/optimal-web-server-ssl-cipher-suite-configuration
     • https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
220. Free Open Source Password Manager | bitwarden 2017-10-02

     tags: security/password, web

     [ permalink ]