Tuesday, October 16, 2012

Block Proxy Servers from accessing the website

Block proxy servers by HTTP protocols. If you don’t want to purchase software, there is another way. You can insert a script in your website’s root htaccess file. It’s best to copy and paste the code, rather than type it. That way, you can be sure that you won’t make any errors. After you’ve inserted the code, upload it to your server. This method is effective. Insert the following code:
paste the below entries in .htaccess file
====================
RewriteEngine on
RewriteCond %{HTTP:VIA}  !^$ [OR]
RewriteCond %{HTTP:FORWARDED}  !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA}  !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR}  !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION}  !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION}  !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP}  !^$
RewriteRule ^(.*)$ - [F]
====================

Tuesday, October 9, 2012

How to install and use Skipfish

What is skipfish?

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments. 

1.First install these packages
           yum install gcc openssl-devel libidn libidn-devel
2.  cd /usr/local/src
3.  mkdir skipfish
4.  cd skipfish
5.  wget http://skipfish.googlecode.com/files/skipfish-2.07b.tgz
6.  tar -zxf ./skipfish-2.07b.tgz
7.  cd skipfish-2.07b
8.  make 
9.  cp dictionaries/complete.wl skipfish.wl
10. mkdir /tmp/skipfish
11 (Testing Skipfish)  
  ./skipfish -o /tmp/skipfish http://yourdomain.com/ (It gives the below output)