+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Basic Security Measures (/Thread-Basic-Security-Measures)
Pages:
1
2
Basic Security Measures - Banadmin - 10-24-2013
Make sure you have all these boxes ticked:
- Change the admin directory from default
- Make your admin directory "password protected"
- Make ALL (e-mail, hosting, website, domain etc) passwords unique
- Add 2-step authentication to your mail (use Google Mail)
- Use SMPT (external) mailing if on VPS
- Patch or completely remove avatar URL uploading
RE: Basic Security Measures - Auth - 10-24-2013
Thanks for these, I have done all these I think apart from ones which I do not need.
RE: Basic Security Measures - Dean Winchester - 10-24-2013
Thanks for the tips Blue. Many users will find them useful.
RE: Basic Security Measures - OversouL - 10-24-2013
I don't understand the last part.
RE: Basic Security Measures - Banadmin - 10-25-2013
(10-24-2013, 03:53 PM)OversouL Wrote: I don't understand the last part.
"Hackers" can use this service to grab the origin server IP even if the website is secure by a reverse proxy through URL avatar uploading.
RE: Basic Security Measures - Nefarious - 10-25-2013
*SMTP
You should also only allow certain IP addresses or IP ranges to access important directories.
Your admin password should be at least 30 characters long, with at least six symbols and it should have capital and lowercase letters.. (Write it down on paper, don't keep it on your PC)
Admin accounts should not have emails linked to them, you should remove them via PHPMyAdmin.
Add an extra password for the admin directory.
Put a IP logger in a fake admin directory(not the admincp honeypot) and put the directory name in robots.txt
Make use of MyBBs file verification to check for backdoors.
If you are using Cpanel use Clam AV Scanner at least once a week to look for GET backdoors and shells.
RE: Basic Security Measures - OversouL - 10-25-2013
(10-25-2013, 10:33 AM)Blue Wrote:(10-24-2013, 03:53 PM)OversouL Wrote: I don't understand the last part.
"Hackers" can use this service to grab the origin server IP even if the website is secure by a reverse proxy through URL avatar uploading.
(10-25-2013, 11:55 AM)Kirito Wrote: *SMTP
You should also only allow certain IP addresses or IP ranges to access important directories.
Your admin password should be at least 30 characters long, with at least six symbols and it should have capital and lowercase letters.. (Write it down on paper, don't keep it on your PC)
Admin accounts should not have emails linked to them, you should remove them via PHPMyAdmin.
Add an extra password for the admin directory.
Put a IP logger in a fake admin directory(not the admincp honeypot) and put the directory name in robots.txt
Make use of MyBBs file verification to check for backdoors.
If you are using Cpanel use Clam AV Scanner at least once a week to look for GET backdoors and shells.
Ne knowledge acquired. :devil:
RE: Basic Security Measures - Cosmic - 10-25-2013
Learning to manually mitigate DDoS attacks is the best thing that you'll ever learn. Relying on third party software will let you down.
RE: Basic Security Measures - DavidGuetta - 10-25-2013
Thanks for this admin, will help me!
RE: Basic Security Measures - Nefarious - 10-25-2013
(10-25-2013, 02:54 PM)Muzzy Wrote: Learning to manually mitigate DDoS attacks is the best thing that you'll ever learn. Relying on third party software will let you down.
Most people use shared-hosting, so they wouldn't be able to mitigate attacks if they knew how.