Proof of History ( POH ) is a sequence of computation that when checked can provide a way to verify passage of time between two events in a cryptographic way by using hash.
In this example we are going to use MD5 but that can also be sha256 or any other hash mechanism. the idea would be to have 2 functions one that generate the next hash in line and another one that can validate the hash provided is the correct hash.
a=($(echo -n "$t-$1" | md5sum ))
a=($(echo -n "$1-$2" | md5sum ))
The function gen-proof-of-history , get only one parameter and and that is the hash of the previous. the output of this function is the hash construct out of the previous hash and the timestamp.
The function check-proof-of-history, get 2 parameters : the first is the timestamp and the second is the prior hash. the output is the next hash that the previous gen had provided.
We all know browsers are notifiing clients of none secure connection, they also alert when there is mix content of secure and none secure objects on the same page. we will list here the simplest yet most efective way to fix that issue with and without modifying the pages.
Server side settings :
On the server side you should set to respond with the header that will tell the browser to send all requests over secure connection eg. TLS
Web page setting :
You can also set the same header to get called from within the HTML page itself by placing a META tag at the header of the pages
<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
On this small script you can get list of all TLS versions and ciphers availble connecting a remore destination . the chalange on that script is that sometimes the number of supported ciphers is great and that consumes time. the main tool used here is openssl along with parallel . I also added timeout and custom port that can be set during the run
The script is build around two loops, one that loop the TLS version , and one that loop the TLS ciphers on each verison. the main command is generating a file that later will be called using parallel command . feel free to copy and modify
TLS_V="tls1 tls1_1 tls1_2 tls1_3"
for V in $TLS_V
TLS_CIPHEPS=`openssl ciphers -$V | tr ':' ' '`
[ $V = "tls1_3" ] && CIPHER_COMAND="ciphersuites"
for CIPHER in $TLS_CIPHEPS
echo "echo | timeout $TIMEOUT openssl s_client -$V -$CIPHER_COMAND $CIPHER -connect $TARGET:$TARGET_PORT &>/dev/null && echo \"$V $CIPHER\" >>$LOG" >>$RUN_F
parallel --gnu -k -j 100 <$RUN_F
cat $LOG | sort
rm -f $RUN_F $LOG
“Good things last long”, my mama use to say.
and just like that netcat is no exception
Using netcat for security testing is fun simple, and you do not need to
install applications you know nothing about .
here are some fun examples from tests I use :
Simple HTTP GET
echo -e "GET / HTTP/1.0\r\nHost:www.example.com\r\n\r\n" | nc 127.0.0.1 80
Simple HTTP flood
echo -e "GET / HTTP/1.0\r\nHost:www.example.com\r\n\r\n" | nc 127.0.0.1 80 &
Simple UDP flood
cat /dev/urandom | nc -u 127.0.0.1 53
Simple SYN flood
nc -z 127.0.0.1 80