Shadow Daemon: Web Application Firewall

Shadow Daemon is a collection of tools to detect, protocol and prevent attacks on web applications. Technically speaking, Shadow Daemon is a web application firewall that intercepts requests and filters out malicious parameters. It is a modular system that separates web application, analysis and interface to increase security, flexibility and expandability.

Shadow Daemon is free software. It is released under the license GPLv2, so its source code can be examined, modified and distributed by everyone.

What differentiates Shadow Daemon?

Ease Of Use

Shadow Daemon is easy to install and can be managed with a clear and structured web interface. The interface lets you examine attacks in great detail. If you just want to protect your site, but otherwise do not care about attacks you can forget about the web interface once Shadow Daemon is installed and configured. The interface also comes with shell scripts that can be used to send weekly reports via e-mail, rotate the logs and the like.

High Coverage

Shadow Daemon strives to be a single solution for all popular web languages. At the moment the following programming languages are supported:

• PHP
• Perl
• Python

Accurate Detection

Shadow Daemon combines white- and blacklisting to accurately detect malicious requests. The blacklist makes use of sophisticated regular expressions to search for known attack patterns in the user input. The whitelist on the other hand searches for irregularities in the user input based on strict rules that define how the input should look like. Together they can detect almost any attack on a web application and still have a very low false-positive rate.
Shadow Daemon is able to detect common attacks like:

• SQL Injections
• XML Injections
• Code Injections
• Command Injections
• Cross-Site Scripting
• Local/Remote File Inclusions
• Backdoor Access
• And more …

Discreet Protection

Unlike many other web application firewalls Shadow Daemon does not completely block malicious requests. Instead it only filters out the dangerous parts of a request and lets it proceed afterwards. This makes attacks impossible, but does not unnecessary frustrate visitors in the case of false-positives.

Secure Architecture

Shadow Daemon is closer to the application than most other web application firewalls. It receives exactly the same input that the web application receives and thus it is almost impossible to bypass the detection by obfuscating the attack. However, the most complex parts of Shadow Daemon are separated from the web application to guarantee a certain standard of security.

Who should use Shadow Daemon?

Shadow Daemon is for people who want to run their own dynamic website without constantly having to worry about attacks and vulnerabilities.
Shadow Daemon is for people who want to know if and how their website is attacked.

Shadow Daemon is for people who do not want to blindly place their trust in non-free software that does its work in secret and costs a fortune.

How do I install Shadow Daemon?

Getting Started contains everything you need to know. Start by reading shadowd. Installing Shadow Daemon is easy and only takes some minutes, really.

Read more here.

Read more

by Malik korrich ~ mercredi 10 juin 2015 0 commentaires

Top 10 Firewall for Mac

Every Macintosh device has built-in firewall. A provision that can be constructed to outlaw information from accessing your Mac. This transmission and receiving of data will only take a few seconds. Every time you ask data from the Internet, such as email message or a web page, your Mac transmits data packs to ask information. Servers obtain the packets, and then transmit other packs back to your Mac. Once your Mac has reconvened the packs, you’ll see a bit like a web page or an email message.

TCPBlock

Download (Beta)

TCPBlock is a lightweight and fast application firewall for OS X 10.5 or later developed by delantis.com. The OS X firewall protects you from connections that come from outside of your computer. But what about the software from your computer that opens new connections to the internet? With this you can prevent selected applications on your computer from opening connections to the network.

NoobProof

Download (Free)

NoobProof has a list of services. Each service can be allowed or blocked. You can also selectively allow or block specified hosts or subnets. You can add or remove services from the list, and you can create new services.
Very easy, just follow the 5 steps how-to in the application help.
You can also tune bandwidth, manage black lists and create self-configuration tools called injectors.
The first time you launch NoobProof the Wizard will help you configuring the Mac OS X firewall.

DoorStop X Firewall

Download (Demo)

Firewalls are not something that Mac users usually have to concern themselves with but as Macs grow in popularity, this will change somewhat. Protects your Mac from outside attack
Critical improvements to OS X's "built-in" firewall
Available standalone or as part of our integrated Security Suite
DoorStop X is designed to work with our Who's There? Firewall Advisor and book "Internet Security for Your Macintosh" as part of the DoorStop X Security Suite.
Open Door Networks has been securing the Mac since 1998 and Mac OS 8. We literally wrote the book on Internet security.

NetMine ProteMac

Download (Trail Version)

NetMine is worked out to control all the Internet and network activity. This firewall software monitors incoming and outgoing network and Internet traffic, providing protection against unwanted access to and from your computer providing powerful protection against malicious viruses, worms, bots and root kits. NetMine by ProteMac is a firewall for your Mac computer running OS X. It monitors and controls all the Internet and network activity of your computer.

NetBarrier X5

Download (Free)

Intego’s NetBarrier X5 security suite offers several tools to protect your Mac from vandals and criminals. Its centerpiece is the NetBarrier firewall, but the package can also block cookies while your surf the Web, scrub personal data afterwards, and block Trojan horses. While NetBarrier X5’s features are generally good, the $50 program has enough peculiarities that some users will be better off with the firewall tools that come with OS X for free.

Little Snitch 3

Download(Trail Version)

Despite fewer malware threats to Mac systems, there is still a need for data protection. With Little Snitch for Mac, users can prevent personal information from being sent out, although its limited features may not be worth the program's price. Little Snitch for Mac can be tried out for free for 30 days. After that, $29.95 buys the full version with no restrictions. While it does include a native installer, loading the program proved tricky and required a restart in order for it to work. An extensive and complicated end-user agreement also needed to be accepted.

WaterRoof 3

Download

WaterRoof is a ipfw firewall management frontend with bandwidth tuning, NAT setup, port redirection, dynamic rules tracking, live connections blocks, predefined rule sets, wizard, logs, graphic report and statistics and other features. Uses Mac OS X built-in IPFW firewall. No kernel modules, no extensions, no pain. WaterRoof is free and open-source

IceFloor

Download

hanynet.com proudly presents a totally new version of IceFloor, the first PF firewall frontend for OS X. IceFloor 2 is group based, like the old ServerAdmin firewall tool. Control filtering, bandwidth, logs, connections and custom PF configurations. IceFloor 2 is group based. Create groups and assign addresses, services and parameters to pass or block connections. Start with IceFloor Wizard to create a basic PF configuration in a few mouse clicks.

Firewall Builder

Download(Free)

Firewall Builder consists of a GUI and set of policy compilers for various firewall platforms. It helps users maintain a database of objects and allows policy editing using simple drag-and-drop operations. The GUI and policy compilers are completely independent, which provides for a consistent abstract model and the same GUI for different firewall platforms. It currently supports iptables, ipfilter, ipfw, OpenBSD pf, Cisco PIX and FWSM, and Cisco routers access lists.

Flying Buttress

Download

The Mac's UNIX underpinnings, Intel core, and fast speed have prompted many PC folks to change over to Apple’s flagship product. Before we dive deeper into Flying Buttress, let's examine the firewall it helps manage. Included with every version of Mac OS X, ipfw is a well-regarded, command-based firewall that originated from FreeBSD. It can be configured as either a network- or host-based firewall.

Read more

by Malik korrich ~ mardi 21 janvier 2014 0 commentaires

Top 7 Firewalls for Windows

The best firewall for Windows will protect against incoming threats and be able to block outgoing threats from malware that has successfully infiltrated your system. A good firewall will know when it is under attack because it will constantly scan the computer's ports to detect threats. A firewall applies rules to the packets it sees in order to enforce polices. It knows when to allow or reject traffic. When it detects illegal traffic, it applies filters so that only traffic that it defines as legal makes it through.

Comodo Firewall Pro (Freeware)

Your first line of defense in protecting yourself online. Comodo Firewall Pro introduces the next evolution in computer security: Default Deny Protection (DDP™). What is DDP? Most security programs maintain a list of known malware, and use that list to decide which applications and files shouldn't access a PC. A multi-layered security application that will constantly monitor and defend your PC from Internet attacks.

ZoneAlarm Free Firewall (Freeware)

2-Way Firewall (Inbound & Outbound) stops Internet attacks at the front door and even catches thieves on their way out. Our 2-way firewall proactively protects against inbound and outbound attacks while making you invisible to hackers. It operates automatically, due to its powerful DefenseNet cloud service, so users are not interrupted with unnecessary alerts.

ESET Smart Security 6

ESET Smart Security 6 is a lightweight and capable internet security suite with a good range of features. ESET Smart Security protects you and your laptop. Connect securely on social networks, browse the Internet or just play online. New anti-malware advanced technology protects you against threats that used to avoid detection—as well as browser and application exploits.

TinyWall 2.1

TinyWall includes a combination of features that sets it apart from both commercial and freeware firewalls. TinyWall is a free software to harden and control the advanced firewall built into modern Windows systems. TinyWall does not annoy you with popups at all, yet it is still extremely easy to add exceptions to your firewall rules,  actively blocks hundreds of Trojans, viruses and worms and does not require you to know about ports, protocols and application details.

Ashampoo FireWall FREE

If you don’t have a degree in computer science, using a firewall program can be quite frustrating. In addition to all the confusing jargon, current firewalls are getting to be very big programs. Sometimes you have the feeling that you’re installing an entire office suite instead of a basic network tool. You probably know that you need a firewall program to use the Internet safely.

Agnitum Outpost Firewall Pro

Outpost Firewall Pro provides the first line of defense against malicious software by proactively controlling how programs behave and interact on a PC and preventing security breaches. Two-way firewall for secure network connections. Proactive Protection module to block unknown and zero-day threats, SmartDecision technology for fast decision-making in security issues and web control with fast web content filtering to protect your PC from web-borne threats. Self-protection technology to maintain continuity of protection.

Sunbelt Personal Firewall

The Sunbelt Personal Firewall helps control how computers share information with other computers through the Internet or a local network. It also protects computers from external or internal attacks from other computers. The Personal Firewall is especially useful for laptop computers since they are easier to compromise because of built-in wireless access.

Read more

by Malik korrich ~ jeudi 16 janvier 2014 0 commentaires

Web Application Firewall Detection – Kali Linux Tutorial

WAF or Web application firewall is a security tool that protects a website from various type of attacks which included but not limited to: SQL-injection, XSS, Local file inclusion and others. Web based IPS (intrusion prevention system) has also been designed to protect a web server but these is a difference between WAF and IPS; web application firewall provides protection from web-based attack while IPS protect a web server from network based attack.

The responsibility of a penetration tester is to protect the web server from both directional attacks, so IPS and WAF are both have their own importance for a pen tester. In order to conduct a successful vulnerability assessment on a website, you need to find the security tools that are protecting it.

WAFW00F is the tool to find a web application firewall that is protecting a web server. WAFW00f is a python script which is written by Sandro Gauci && Wendel G. Henrique. A penetration tester can get name of the installed firewall so that exploitation will be started, it was earlier available on backtrack 5 but since backtrack is no longer an active project; so we can use this tool on Kali Linux.

Application → Kali Linux → Information Gathering → IDS/IPS Identification → wafw00f

        _   __  _   ____ _   __  _    _   ____
       ///7/ /.' \ / __////7/ /,' \ ,' \ / __/
      | V V // o // _/ | V V // 0 // 0 // _/ 
      |_n_,'/_n_//_/   |_n_,' \_,' \_,'/_/   
                                <  
                                 ...'
                                
    WAFW00F - Web Application Firewall Detection Tool
   
    By Sandro Gauci && Wendel G. Henrique

Usage: wafw00f url1 [url2 [url3 ... ]]
example: wafw00f http://www.victim.org/

Options:
  -h, --help            show this help message and exit
  -v, --verbose         enable verbosity - multiple -v options increase
                        verbosity
  -a, --findall         Find all WAFs, do not stop testing on the first one
  -r, --disableredirect
                        Do not follow redirections given by 3xx responses
  -t TEST, --test=TEST  Test for one specific WAF
  -l, --list            List all WAFs that we are able to detect
  --xmlrpc              Switch on the XML-RPC interface instead of CUI
  --xmlrpcport=XMLRPCPORT
                        Specify an alternative port to listen on, default 8001
  -V, --version         Print out the version

Everything has its limitation, wafw00f has also some limitation. It can only detect the firewalls which are listed in the script database, so it is recommended that you should update your tool. In the following example you can see that the firewall name was not fetched by wafw00f.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ mercredi 4 décembre 2013 0 commentaires

How a Firewall Protects You From the Inside Out

Why I need a firewall? This is a most common question beside Anti-virus you must have a firewall but why? Firewall protect your computer from different types of hacking attack because Firewall is a wall just like your home door, if your door unlock than everyone can easily get into your home so use a wall to protect your computer. Below is the wonderful inforgraphic that explain you about the firewalls, What is firewall? How firewall works? Firewall configuration and tips for online security. 


Click on the image for clear view: 

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ vendredi 2 décembre 2011 0 commentaires

Web Application Firewalls - OWASP

Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself - and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems.


OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. 
 
One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. 
 
The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF. Special attention has been paid - wherever possible - to the display of work estimates - including in comparison to possible alternatives such as modifications to the source code. 
 
In addition to the importance of the web application regarding turnover or image - the term access to a web application used in this document can be a good criterion in the decision-making process relating to the use of WAFs. Specifically, the access to a web application, measures the extent to which the required changes to the application source code are actually carried out in-house, on time,or can be carried out by third parties. As illustrated by the graph below, a web application to which there is no access, can only be protected sensibly by a WAF (additional benefit of the WAF),.Even with an application in full access, a WAF can be used as a central service point for various services such as secure session management, which can be implemented for all applications equally, and as a suitable means for proactive safety measures such as URL encryption.

Download

English

Deutsch

or read more here.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ mercredi 2 novembre 2011 0 commentaires

Radware Web Application Firewall-AppWall

Web application(s) are not secure any more, new web vulnerability and the way of attack discover everyday. By doing a penetration testing with different tools does not means that your web application secure, there are different vulnerability may find on the web application. For a manual security you need a fast team to update the operating system and application software's.

There are different firewalls or IDS/IPS available to secure a web application.
Radware’s AppWall is a Web Application Firewall (WAF) appliance that secures Web applications and enables PCI compliance by mitigating web application security threats and vulnerabilities. It prevents data theft and manipulation of sensitive corporate and customer information.


It provides full protection against the web application level attack like.

• Full coverage out-of-the-box of OWASP top-10 threats ─including injections, cross site scripting (XSS), cross site request forgery (CSRF), broken authentication and session management and security mis-configuration .
• Data leak prevention – identifying and blocking sensitive information transmission such as credit card numbers (CCN) and social security numbers (SSN).
• Zero-day attacks prevention – AppWall positive security profiles limiting the user input only to the level required by the application to properly function, thus blocking also zero day attacks. The positive security profiles are a proven protection against zero-day attacks.
• Protocol validation – AppWall enables HTTP standards compliance to prevent evasion techniques and protocol exploits.
• XML and Web services protection - AppWall offers a rich set of XML and web services security protections, including XML validity check web services method restrictions, XML structure validation to enforce legitimate SOAP messages and XML payloads.
• Web application vulnerabilities – signature protection offer the most accurate detection and blocking technology of web application vulnerability exploits. AppWall negative security profiles offers comprehensive attack protection.

Click here to learn more.

Note: If you want to learn more about Linux (Backtrack 5) and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ vendredi 15 juillet 2011 0 commentaires

Top 5 Firewalls For Windows

Using a smart antivirus is not only a way to secure your computer in the jungle of web, there are many ways to bypass antivirus solution, well if you are used to connect your computer to the local coffee shop without any safety it means your data is on risk. However antivirus is a good choice but you need to install a firewall beside antivirus for maximum security.


There are different firewalls available on the Internet for different operating system (Linux,Windows and MAC etc), for this article we consider windows so below is the list of best firewall for windows that are provides protection from hacking attack.

Zonealarm Firewall

Zonealarm provides a effective solution to secure your computer, zonealarm firewall available on free of cost and it has a pro version also, it provides protection from hackers and spyware and it compatible with windows like windows XP, windows Vista and Windows 7. It can proactively protects against inbound and outbound attacks while making you invisible to hackers.

Comodo Firewall

 
Comodo firewall is a smart firewall solution that protect your computer from spyware and malware, you can download it free of cost and you can purchase it pro version. Comodo firewall comes with an anti-malware tool, you have to select it during installation process. It is available for windows platform including 32bit and 64bit architecture.

Rising Firewall

 
I dont know why but rising solution is one of my favourite in both antivirus and firewall solution, it has an ability to monitor inbound and outbound traffic, it provides Zero-Day Computer Security Protection with Rising Cloud Security Rising Cloud Security 3.0. it is a best tool for system vulnerability scanning, defence from arpspoofing and network data protection.

Online Armor Firewall 

Online armor firewall is a power tool that protects your computer from internal and external threat, it has a multiple functionality like it Offers DNS-spoofing and keylogger protection, Monitors a single host for suspicious activity and it provides a effective soltuion against keylogging and phishing attack.

F-Secure Internet Security

 

F-Secure Internet security provides a multiple solution for computer and network protection, Protects your computer against viruses, worms, rootkits and zero-day attacks, it does not use pop windows to warn you against a threat it just block the threat to being enter into your computer. It can protects you from spamming, identity theft and phishing attacks.

 

Beside each and everything do not forget to turn on your router built in firewall for maximum protection if you want to know more about wireless security than click here.

Note: If you want to learn more about Linux and Windows based Penetration testing, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ vendredi 17 juin 2011 0 commentaires

Introduction To Firewalls: 2

On a previous tutorial you have learnt some basis about firewalls, and on previous tutorial we have categorized firewalls into two types by their construction, now in this tutorial we are going to share some advance knowledge and we will categorize firewalls by their application.

 






How Firewalls Work

To understand the working of  firewalls is not enough difficult as many people think. The working of firewall is depend on some steps.

• When you start communicating to other computers or device over the Internet, your computers follow the TCP 3-way handshaking process, in general your computer send a request to the network for the sake of communication.

• If you have a firewall on your computer, then first firewall check that request and compare it with different types of rules and regulation of the firewall.
• Firewall also checking the source of networking and web-hosting and than firewall makes decision either file to be transfer or deny.
• The rules and regulation of the firewall set by the administrator of the computer or a network.
• Firewall also work on the authentication process for the safe communication, if some thing is missing in the authentication it will block the whole communication.

Firewalls can be divided by their configuration techniques or application.

Network-Level Firewalls or Packet filtering

Network layer firewalls, also called packet filters. It generally make their decisions based on the source address, destination address and ports in individual IP packets. A simple router is the traditional network layer firewall.

Application-layer Firewalls

Application-level firewalls looking more deeply into the application that communicate to the internet, it restrict the rules for the application like TCP,FTP,Telnet or UDP etc.
Application-level filtering may include protection against spam and viruses as well, and be able to block undesirable Web sites based on content rather than just their IP address.

Note: If you enjoyed this post, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ jeudi 9 décembre 2010 0 commentaires

Introduction To Firewalls

You have heard so many times “use firewalls to protect your computer”, in this article we are going to talk about firewalls. You may even already have a firewall management program in place. But what exactly is firewall security.

The word firewall means to a wall, which was constructed to halt the spread of a fire. In computing firewall refers to the network device which blocks certain kind of traffic by limiting the number of ports.

 Either firewall is a software based or a combination of hardware and software that are used for protecting purpose.

There are two different types of firewalls available:

1. Hardware Firewall:

A hardware based firewall is a physical device that place between your computer and the internet, it acts as a gateway to all the computer inside the network.

An example of a hardware based firewall is a broadband router. The main advantage of using hardware based firewall is that you need not to install or configure  any software because the firewall is external to the computer.

The main disadvantage is that, if your computer is mobility like your notebook than you cant use hardware based firewall.

2. Software Firewall:

A software firewall perform all the task like a hardware firewall, however software based firewalls  must be installed as a program on your computer. You can install and configure software firewall by using a dick or you can download from internet.

Software firewall has to installed on each host on the network while a hardware firewall used on the gateway of network.

Software firewalls are used for your laptop or for a single computer.

Note: If you enjoyed this post, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.

Read more

by Malik korrich ~ dimanche 5 décembre 2010 0 commentaires