- Anonymous External Attack V 1.0 Dos
- Anonymous External Attack V1 0
- Anonymous External Attack V 1.0
- Anonymous External Attack V 1.0 Download
Nov 16th, 2012
Never
For unauthenticated/anonymous page submits, consider using CAPTCHA technology to prevent spam and automated attacks. Enforce multi-factor authentication in high risk areas where possible. In the case of application authenticating to external systems (like databases, file servers, web services), the credentials should be encrypted at rest with. The application Anonymous External Attack.exe has been detected as a potentially unwanted program by 21 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from downloader.disk.yandex.com.tr and multiple other hosts.
Anonymous External Attack V 1.0 Dos
Not a member of Pastebin yet?Sign Up, it unlocks many cool features!
Anonymous External Attack V1 0
- __| || |______ ______ | | __________________ ____ | |
- __ // | ____ | |/ ___/_ __ __ _/ __ | |
- | || |/ | |_> > |___ | | // __ ___/| |__
- /_ ~~ ________ / __/|___/____ > |__| (____ /___ >____/
- _______ __ _______ __
- ||_//|| || ||=|||_//
- // ||
- _____ __ ___ _//|| ___ ___ ___ __ ____
- ||=||||(( ))|||)/|| / |(( ))| ||
- All information below is intended for use by the people of Gaza in the event that their phones or internet services are shut down.
- #OpIsrael #GazaUnderAttack #Anonymous
- * Post all relevant links and information that will be useful to people in Gaza during the Israeli attack/invasion.
- Arabic translations may be sloppy. Poor grammar. Needs repair.
- Anonymous Operation Israel | ACTION ALERT 1: E-Mail Bomb - http://bit.ly/T1gjHk
- Anonymous Operation Israel | ACTION ALERT 2: Black Fax - http://bit.ly/100sfh8
- OpIsrael Press Releases:
- -- Nov 16th:
- English: http://www.anonpaste.me/anonpaste2/index.php?cddefe41e70b47f1#YslgrtM6sgfngddFbLFJ699F7N9FgLtwuqayxtB4luA=
- Arabic: http://www.anonpaste.me/anonpaste2/index.php?72ccb5f04e029167#DNkDRFT+YcAJWFdpJsXCkcDXJ/JCFDlRcTfPibehw00=
- Hebrew: http://www.anonpaste.me/anonpaste2/index.php?a06e1914b42fc73b#syU4ovC6APtIzE+N0lz4dWlI2Agyf2Fj139mZSRHzhk=
- French: http://www.anonpaste.me/anonpaste2/index.php?717d0da2c2cf3d8d#3bUuK2M3iOpq05YWhlQmeqU1Zmo/NayM5mMOlkPtPEE=
- -- Nov 15th:
- Video: https://www.youtube.com/watch?v=FPAy44X66GU&noredirect=1
- Videos -
- http://www.youtube.com/watch?v=UHzMB4vnqW8
- http://www.youtube.com/watch?v=CoVsMbqnNwg
- http://www.youtube.com/watch?v=lWbHx9cfK6E
- English: http://www.anonpaste.me/anonpaste2/index.php?0c3787b9e504b257#4vuPTzmEXo9+uyq78aSSgvqJgb1nV5DwOZXdau60ajQ=
- Arabic: http://www.anonpaste.me/anonpaste2/index.php?8478405308320e4e#6lQL2gESPNC0XsO0Qhpg+Hb/3dT3OjDE+sDvuvuV1aQ=
- Arabic (enhanced Version) : pic.twitter.com/n95pIURF
- Anonymous Op Israel - Press Release IN FRENCH - http://bit.ly/Wfj7G9
- Enhanced Arabic Version: https://pbs.twimg.com/media/A7wqaWjCcAAhPRc.jpg
- Hebrew: http://www.anonpaste.me/anonpaste2/index.php?f7cdbe6eb7faba62#AKzWPFngB/20CdI3lv1Rxn4e/vKSbGhzS8cA/3zwJF8=
- Anonymous Operation Israel - Gates Of Hell | Video - http://www.youtube.com/watch?v=PKrVYRu0oMY
- Anonymous Operation Israel - Gates Of Hell 2 | Video - http://www.youtube.com/watch?v=O6t9Kr2wWzE
- #OpIsrael Care Package for Gaza (Full v2.0) Mediafire Mirror http://www.mediafire.com/?hpnne29xvx1ceuv
- mirror http://142.4.192.138/Op_Israel_Care_Package_For_Gaza.zip
- Tails: https://tails.boum.org/
- -- English:
- Movement.org: http://www.movements.org/how-to/entry/how-to-prepare-for-an-internet-connection-cut-off/
- Telecomix: http://www.anonpaste.me/anonpaste2/index.php?89452a7861b4af1d#hFCbUSaOGM+ZBIgJPGEOBwxEjxV0lNNnbdPQnx0uQRw=
- Movement.org: http://uploading.com/files/get/b86d38m8/the%2Btech%2Bguide%2Bto%2Bstay%2Bconnected%2Bto%2Bthe%2Binternet.pdf
- Telecomix Pastebin: https://pad.riseup.net/p/FAqaSYWGCZYe
- WIFI Range Extend - http://pastebin.com/Smkcg6TE
- Anonymous Tango Down List: http://piratenpad.de/qQ8nmbLXj3
- #OpIsrael -- The Use of Human Shields by the IDF http://pastebin.com/Y4C3eAnx via @DBCOOPA
- #dox on leader of AIPAC israels american lobby http://www.anonpaste.me/anonpaste2/index.php?21571cc80fbc1293#xFwgdaW31pcKUSwtkH31rkpY2lrNU1wf01qn0HvN7Ls=
- Emergency Global Actions List: https://docs.google.com/document/d/1Iq4XZx9Vj0BDIiWzlHi2mUS0VUOn_t-prgtGGCzatQw/preview?pli=1&sle=true
- Israeli Contact Info:
- List of World-Wide Israeli Embassies via Anonymous: http://pastebin.com/4DM7cfqF
- IRC Channels:
- Telecomix IRC: https://chat.wnh.me/?channels=gaza&uio=d4
- @HarryFear Livestream from Gaza: http://www.ustream.tv/channel/operation-pillar-of-cloud
- RT NEWS: https://rt.com/on-air/gaza-violence-hamas-israel/
- Anonymous Carepackages:
- #OpIsrael Care Package for Gaza (Full v2.0) Mediafire Mirror http://www.mediafire.com/?hpnne29xvx1ceuv
- Updates include 'the tech guide to stay connected to the internet' properly translated in English.
- TinyTor+Vidallia 8MB http://www.mediafire.com/?0rgv1vw1d2rqv5t
- TinyTor 6MB http://www.mediafire.com/?cu6u9h916ny77a1
- Tails: https://tails.boum.org/
- Tweet (Arabic)
- مجموعة ملفات مساعدة #عملية_اسرائيل #غزة_تحت_الهجوم #غزة http://www.mediafire.com/?z8ev035mw482x77
- http://thepiratebay.se/torrent/7829793
- magnet link : magnet:?xt=urn:btih:661490c9820336bf05f568496a27fdffc2820607&dn=tool+pack+for+palestine&tr=udp%3A%2F%2Ftracker.openbittorrent.com%3A80&tr=udp%3A%2F%2Ftracker.publicbt.com%3A80&tr=udp%3A%2F%2Ftracker.istole.it%3A6969&tr=udp%3A%2F%2Ftracker.ccc.de%3A80
- contents:
- bleachbit portable cleans cache data and browsing data and useless logs
- 2.proxifier 3.15 portable used to set rules for routing ALL traffic through a proxyy for tor set to 127.0.0.1 port :9050 in
- 5.thunderbird portable email cliet which is tor freindly
- 6.putty ssh client
- 7.tor browser
- 8. xchat portable
- 9.pidgin portable secure IM client tor and off the record messaging freindly
- 10. torchat
- 11. K-mac portable mac address spoofing client
- 12.PIDGIN OTR
- 13.spybot search and destroy anti spyware portable
- 14. eraser secure file deletion
- 15. open garden use mobile wifi
- 16. proxy finder
- - http://hackerdemia.com/ Allows for mesh network connecting (if Gaza cell service is taken down, they can possibly access Egyptian towers.)
- http://www.androidzoom.com/android_applications/communication/the-serval-mesh_bgstt.html Another mesh program. Requires root.
- there will be networks deployed on the ground using openwrt http://wiki.openwrt.org/inbox/mesh.olsr, this is an app they can use if they want to make their phones part of that network http://www.olsr.org/?q=olsr_on_android
- How To Use Twitter VIA Text Message:
- Get Twitter messages redirected to your phone and send Tweets by text. Make sure to link your mobile phone to your Twitter account and locate the Twitter short code for your country. Then you can send a text message containing your Tweet to that short code and it will be posted to your profile.
- Info: http://support.twitter.com/articles/14589-how-to-add-your-phone-via-sms
- Wataniya: 40404
- If you use one of the phone services listed above, text START to the shortcode to sign into your Twitter account.
- Telecomix Dial Up Numbers:
- Important: The Telecomix dialups are not secure and do not protect from wiretapping of your communications. It is still important to proceed with precaution and encrypt the data.
- Visit this link for dial up numbers:
- Note: Since the number of lines is limited, do not use them if you don't need to!
- - French free isp FDN (about 100 lines): +33172890150 (login/pass: toto/toto)
- - German free Free.de (about 35 lines). +4923184048 (login/pass: telecomix/telecomix)
- - Swedish isp Gotanet (about 30 lines atm, can expand services) : +46708671911 (login/pass: toto/toto)
- - Belgium Edpnet: +32022750640 (login/pass: free.edpnet/ free)
- - Netherlands Edpnet: +31676002000 (login/pass: free.edpnet/ free)
- netherlands +31205350535 and the username/password are xs4all
- Medical Info:
- http://streetmed.wikidot.com/ -- Street Medic resources. Includes Arabic translations.
- Petitions:
- Condition US aid to Israel on compliance with the law not to violate the rights of Palestinians.
- https://petitions.whitehouse.gov/petition/condition-us-aid-israel-compliance-law-not-violate-rights-palestinians/SfkHRSWp?utm_source=wh.gov&utm_medium=shorturl&utm_campaign=shorturl
- Gaza News Links:
- Baby son of BBC worker killed in Gaza strike
- http://www.telegraph.co.uk/news/worldnews/middleeast/israel/9679461/Baby-son-of-BBC-worker-killed-in-Gaza-strike.html
- As Israel Attacks Gaza, Palestinians find an unlikely ally (Anonymous)
- http://tribune.com.pk/story/466092/as-israel-attacks-gaza-palestinians-find-an-unlikely-ally/
- Gaza activist: 'Israel has declared war, act now'
- http://chomsky.info/articles/20121104.htm
- http://tribune.com.pk/story/466092/as-israel-attacks-gaza-palestinians-find-an-unlikely-ally/
- BOYCOTT ISRAEL LIST: http://freepalproject.wordpress.com/boycott-list/
- WHAT US ZIONISM? http://scriptogr.am/palestine/post/what-is-zionism
- Gaza Videos:
- Martyred in Gaza - a documentary
- @Masterpiece_s
- @yazannshewat
- @Samof88 - Arabic/Turkish.
- Active Twitter Accounts:
- @AnonOpsSweden
- @AnonymousZC
- @OpLiberation1
- @Op_Israel
- @PLF2012
- http://bit.ly/T2L4Or
- https://twitter.com/olanan/%D9%85%D8%BA%D8%B1%D9%91%D8%AF%D9%88%D9%86-%D9%85%D9%86-%D8%BA%D8%B2%D8%A9
- http://www.datinet.co.il/index.html
- http://falcon-s.co.il
- http://e-yoman.co.il/var | http://operator.co.il/var | http://p-tzofit.co.il/var | http://e-tzofit.co.il/var | http://www.tzofit.co.il/var
- http://mor-space.co.il/he
- http://littner.co.il / http://iconcept.co.il / http://danybarshay.co.il / http://filtuna.co.il
- http://advocate-israel.com
- http://hilulla.co.il / http://gan-pazit.co.il / http://almagorswishes.org.il
- http://www.dolevltd.co.il/fuk_isreal.asp / http://shaked.co.il/fuk_isreal.asp / http://openspace1.co.il/fuk_isreal.asp / http://www.g-2.co.il/fuk_isreal.asp
- http://zerosecurity.org/security/securityacadmy-com-hacked-defaced-for-opisrael/
- http://rt.com/news/gaza-israel-strike-anonymous-787/
- http://www.dailydot.com/news/anonymous-opisrael-gaza-internet-access/
- http://www.globalpost.com/dispatch/news/regions/middle-east/israel-and-palestine/121115/anonymous-hacker-group-vows-support-pa
- http://tribune.com.pk/story/466092/as-israel-attacks-gaza-palestinians-find-an-unlikely-ally/
- http://freakoutnation.com/2012/11/15/anonymous-is-on-it-israel-threatens-to-cut-gaza-off-from-the-internet-telecommunications/
- http://www.forbes.com/sites/andygreenberg/2012/11/15/anonymous-hackers-deface-israeli-sites-in-retaliation-for-gaza-attacks/
- http://betabeat.com/2012/11/anonymous-launches-opisrael-in-response-to-israels-live-tweeted-attack-on-gaza-strip/
- http://bits.blogs.nytimes.com/2012/11/15/anonymous-attacks-israeli-web-sites/
- http://www.huffingtonpost.com/2012/11/15/anonymous-israel-gaza_n_2139325.html
- http://www.salon.com/2012/11/15/anonymous_retaliates_to_israels_gaza_internet_threat/
- http://www.examiner.com/article/anonymous-operation-israel-gaza-under-attack
- http://www.foxbusiness.com/technology/2012/11/15/anonymous-hackers-target-israel-after-gaza-airstrike/
- http://www.scmagazine.com/anonymous-targets-israeli-sites-offers-gazans-internet-help/article/268550/
- http://www.eweek.com/security/israeli-hamas-conflict-attracts-anonymous/
- http://english.alarabiya.net/articles/2012/11/16/250005.html
- http://www.bbc.co.uk/news/technology-20356757
- http://suicidegirlsblog.com/blog/anonymous-defends-freedom-of-internet-during-israeli-pillar-of-cloud-assault-on-gaza/
- http://www.infosecurity-magazine.com/view/29381/hacktivist-group-anonymous-rallies-to-gazas-side-with-opisrael-offensive/?utm_source=twitterfeed&utm_medium=twitter
- http://www.examiner.com/article/anonymous-hacktivists-take-down-israeli-websites
- http://www.digitaljournal.com/article/337011
- http://www.voanews.com/content/hacker_anonymous_attack_israeli_websites/1547095.html
- http://www.theregister.co.uk/2012/11/16/anonymous_attacks_israel/
- http://www.nbcnews.com/technology/technolog/anonymous-targets-israeli-websites-response-gaza-conflict-1C7106339
- http://www.firstpost.com/world/anonymous-enters-israel-hamas-cyber-war-takes-down-40-israeli-sites-525839.html
- http://venturebeat.com/2012/11/15/anonymous-idf/
- http://www.ciol.com/ciol/news/121940/anonymous-threatens-israel-online-attacks
- http://www.ibtimes.com/anonymous-attacks-israeli-websites-over-gaza-884372
- http://daily.bhaskar.com/article/WOR-TOP-anonymous-protests-gaza-strikes-defaces-40-israeli-websites-4043949-NOR.html
- http://www.ekklesia.co.uk/node/17393
- http://www.tabletmag.com/scroll/116974/hacktivists-wage-war-against-israel
- http://www.zdnet.com/anonymous-takes-on-israeli-websites-wipes-jerusalem-bank-7000007537/
- http://www.cyberwarnews.info/2012/11/17/anonymous-all-out-assault-for-opisrael-leaves-sites-hacked-defaced-and-leaked/#.UKbOorpR4qE.twitter
- http://www.washingtonpost.com/blogs/worldviews/wp/2012/11/14/is-hamas-winning-the-twitter-war/?Post+generic=%3Ftid%3Dsm_twitter_washingtonpost
- http://globalvoicesonline.org/2012/11/15/bombs-are-falling-like-rain-in-gaza/
- Personal Messages:
- غزہ کے عظیم، دلیر اور عزیز دوستو، پاکستان کا بچہ بچہ اپ سے پیار کرتا ہے- - A message from #AnonymousPakistan
- You might need this: http://www.instructables.com/id/How-To-Build-A-Bicycle-Generator/step1/PowerPoint-Presentation/ via @VizFoSho
- Please contact me on Twitter or through one of the IRC networks to update this document.
- Also, if you can translate Arabic or Hebrew from English and want to help #OpIsrael
- hit us up - @DBCOOPA @AnonSikko @VizFoSho @PLF2012
- CURRENT INTERNET AND TELECOMM CONNECTIVITY IN GAZA
- Broadband: DOWN
- PBX Lines DOWN
- Mobile: UP
- Ham Radio: Unknown
- Satellite: Unkown
- Electricity: DOWN, Current electricity by Generators
- Anonymous Op Israel | Gaza Care Package v. 2.0 - http://bit.ly/RH7RxS
- CONFIGURING AND USING DIAL-UP (WINDOWS)
- Configuring Dial-Up Connections
- Click Start, click Control Panel, and then click Network and Internet Connections.
- Click Create a connection to the network at your office.
- In the Location Information dialog box, enter the appropriate information. Click OK, and then click OK to close thePhone and Modem Options dialog box and start the New Connection wizard.
- In the New Connection Wizard, click Dial-up connection, and then click Next.
- Type a name for the network to which you are connecting (such as 'My Office Network'), and then click Next.
- Type the phone number for the network to which you are connecting, including, if necessary, the area code and '1' prefix.
- Specify whether you want this connection to be available for anyone's use, meaning for any user on this computer, or for your use only, meaning only for the user who is now logged on.
- Specify whether you want a shortcut to the connection on your desktop.
- Using Dial-Up Connections
- Click Start, click Connect To, and the click the connection that you want to use.
- In the Password box, type your password.
- To save the user name and password so that you will not have to type them in the future, select the Save this user name and password for the following users check box.
- If you want only the current user to have access to the saved user name and password, select the Me only check box.
- If you want all users to have access to the user name and password, select the Anyone who uses this computercheck box.
- CONFIGURING AND USING DIAL-UP (MAC)
- Configure Mac OS X
- From the View menu, choose Network.
- Choose 'Internal Modem' from the Show pop-up menu (or the 'Configure' pop-up menu prior to Mac OS X v10.1).
- If your computer does not have a built-in modem, select your external modem.
- Mac OS X v10.5 or later: From the Configuration pop-up menu, choose Add Configuration.
- Enter your information into the relevant fields. Your username goes in the Account Name field, for example. If you want to copy this connection information to other user accounts on this computer, select 'Save password'.
- You should now be able to connect. If you need to configure DNS servers or other advanced settings, continue to the next step.
- Mac OS X v10.5 or later: Click the Advanced button, then click the DNS tab.
- Mac OS X v10.4 or earlier: Click the TCP/IP tab. Choose either PPP or Manually from the Configure pop-up menu, as instructed by your Internet service provider. If configuring manually, type the IP address in the matching field.
- Type the DNS server addresses in their field if necessary (click the '+' button first in Mac OS X v10.5 or later).
- Click Apply (or Apply Now for Mac OS X v10.4 or earlier).
- Connect and verify
- Mac OS X v10.5 or later: Open Network preferences (in System Preferences).
- Mac OS X v10.4.x or earlier: Open Internet Connect (from the Applications folder).
- Be sure the Configuration pop-up menu is set to your modem.
- Once you're connected, open a Web browser or other Internet application to make sure your connection works.
- Tip: You can have Mac OS X automatically connect to the Internet whenever you open an Internet application.
RAW Paste Data
Anonymous External Attack V 1.0
Findings (MAC III - Administrative Sensitive)
Anonymous External Attack V 1.0 Download
| Finding ID | Severity | Title | Description |
|---|---|---|---|
| V-13621 | High | All web server documentation, sample code, example applications, and tutorials will be removed from a production web server. | Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally ... |
| V-2258 | High | The web client account access to the content and scripts directories will be limited to read and execute. | Excessive permissions for the anonymous web user account are one of the most common faults contributing to the compromise of a web server. If this user is able to upload and execute files on the ... |
| V-13686 | High | Remote authors or content providers will only use secure encrypted logons and connections to upload files to the Document Root directory. | Logging in to a web server via a telnet session or using HTTP or FTP in order to upload documents to the web site is a risk if proper encryption is not utilized to protect the data being ... |
| V-6537 | High | Anonymous access accounts are restricted. | Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect ... |
| V-2227 | High | Symbolic links will not be used in the web content directory tree. | A symbolic link allows a file or a directory to be referenced using a symbolic name raising a potential hazard if symbolic linkage is made to a sensitive area.When web scripts are executed and ... |
| V-2249 | High | Web server administration will be performed over a secure path or at the console. | Logging in to a web server via a telnet session or using HTTP or FTP to perform updates and maintenance is a major risk. In all such cases, userids and passwords are passed in the plain text. A ... |
| V-2247 | High | Only administrators are allowed access to the directory tree, the shell, or other operating system functions and utilities. | As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. ... |
| V-2246 | High | Web server software will always be vendor-supported versions. | Many vulnerabilities are associated with older versions of web server software. As hot fixes and patches are issued, these solutions are included in the next version of the server software. ... |
| V-13620 | Medium | A private web server’s list of CAs in a trust hierarchy will lead to the DoD PKI Root CA, to a DoD-approved external certificate authority (ECA), or to a DoD-approved external partner. | A PKI certificate is a digital identifier that establishes the identity of an individual or a platform. A server that has a certificate provides users with third-party confirmation of ... |
| V-2235 | Medium | The service account ID used to run the web site will have its password changed at least annually. | Normally, a service account is established for the web service to run under rather than permitting it to run as system or root. The passwords on such accounts must be changed at least annually. It ... |
| V-2236 | Medium | Installation of compilers on production web server is prohibited. | The presence of a compiler on a production server facilitates the malicious user’s task of creating custom versions of programs and installing Trojan Horses or viruses. For example, the attacker’s ... |
| V-2259 | Medium | Web server system files will conform to minimum file permission requirements. | This check verifies that the key web server system configuration files are owned by the SA or the web administrator controlled account. These same files that control the configuration of the web ... |
| V-2256 | Medium | The access control files are owned by a privileged web server account. | This check verifies that the key web server system configuration files are owned by the SA or by the web administrator controlled account. These same files which control the configuration of the ... |
| V-2254 | Medium | Only web sites that have been fully reviewed and tested will exist on a production web server. | In the case of a production web server, areas for content development and testing will not exist, as this type of content is only permissible on a development web site. The process of developing ... |
| V-2252 | Medium | Only auditors, SAs or web administrators may access web server log files. | A major tool in exploring the web site use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and ... |
| V-2250 | Medium | Logs of web server access and errors will be established and maintained | A major tool in exploring the web site use, attempted use, unusual conditions, and problems are reported in the access and error logs. In the event of a security incident, these logs can provide ... |
| V-6577 | Medium | A web server will be segregated from other services. | To ensure a secure and functional web server, a detailed installation and configuration plan should be developed and followed. This will eliminate mistakes that arise as a result of ad hoc ... |
| V-13687 | Medium | Remote authors or content providers will have all files scanned for viruses and malicious code before uploading files to the Document Root directory. | Remote web authors should not be able to upload files to the Document Root directory structure without virus checking and checking for malicious or mobile code. A remote web user, whose agency has ... |
| V-13688 | Medium | Log file data must contain required data elements. | The use of log files is a critical component of the operation of the Information Systems (IS) used within the DoD, and they can provide invaluable assistance with regard to damage assessment, ... |
| V-6531 | Medium | A web server that utilizes PKI as an authentication mechanism must utilize subscriber certificates issued from a DoD-authorized Certificate Authority. | A DoD private web server, existing within and available across the NIPRNet, must utilize PKI as an authentication mechanism for web users. Information systems residing behind web servers requiring ... |
| V-13689 | Medium | Access to the web server log files will be restricted to administrators, web administrators, and auditors. | A major tool in exploring the web site use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and ... |
| V-3333 | Medium | The web document (home) directory will be in a separate partition from the web server’s system files. | Web content is accessible to the anonymous web user. For such an account to have access to system files of any type is a major security risk that is entirely avoidable. To obtain such access is ... |
| V-2270 | Medium | Anonymous FTP user access to interactive scripts is prohibited. | The directories containing the CGI scripts, such as PERL, must not be accessible to anonymous users via FTP. This applies to all directories that contain scripts that can dynamically produce web ... |
| V-2228 | Medium | All interactive programs will be placed in a designated directory with appropriate permissions. | CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable programs used by the operating system of the host ... |
| V-2271 | Medium | Monitoring software will include CGI or equivalent programs in the set of files which it checks. | By their very nature, CGI type files permit the anonymous web user to interact with data and perhaps store data on the web server. In many cases, CGI scripts exercise system-level control over the ... |
| V-2272 | Medium | PERL scripts will use the TAINT option. | PERL (Practical Extraction and Report Language) is an interpreted language optimized for scanning arbitrary text files, extracting information from those text files, and printing reports based on ... |
| V-2264 | Medium | Wscript.exe and Cscript.exe are accessible by users other than the SA and the web administrator. | Windows Scripting Host (WSH) is installed under either a Typical or Custom installation option of a Microsoft Network Server. This technology permits the execution of powerful script files from ... |
| V-2263 | Medium | A private web server will have a valid DoD server certificate. | This check verifies that DoD is a hosted web site's CA. The certificate is actually a DoD-issued server certificate used by the organization being reviewed. This is used to verify the authenticity ... |
| V-2262 | Medium | A private web server will utilize TLS v 1.0 or greater. | Transport Layer Security (TLS) encryption is a required security setting for a privateweb server. This check precludes the possibility that a valid certificate has been obtained, but TLS has not ... |
| V-2225 | Medium | MIME types for csh or sh shell programs will be disabled. | Users should not be allowed to access the shell programs. Shell programs might execute shell escapes and could then perform unauthorized activities that could damage the security posture of the ... |
| V-13672 | Medium | The private web server will use an approved DoD certificate validation process. | Without the use of a certificate validation process, the site is vulnerable to accepting certificates that have expired or have been revoked. This would allow unauthorized individuals access to ... |
| V-2229 | Medium | Interactive scripts used on a web server will have proper access controls. | CGI is a ‘programming standard’ for interfacing external applications with information servers, such as HTTP or web servers. CGI, represented by all upper case letters, should not be confused with ... |
| V-2248 | Medium | Access to web administration tools is restricted to the web manager and the web manager’s designees. | The key web service administrative and configuration tools must only be accessible by the web server staff. As these services control the functioning of the web server, access to these tools is ... |
| V-13619 | Medium | The web server, although started by superuser or privileged account, will run using a non-privileged account. | Running the web server with excessive privileges presents an increased risk to the web server. In the event the web server’s services are compromised, the context by which the web server is ... |
| V-13613 | Medium | The site software used with the web server does not have all applicable security patches applied and documented. | The IAVM process does not address all patches that have been identified for the host operating system or, in this case, the web server software environment. Many vendors have subscription services ... |
| V-2240 | Medium | The number of allowed simultaneous requests will be limited for web sites. | Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a web site, facilitating a denial of service attack. Mitigating this kind of attack will include ... |
| V-2243 | Medium | A private web server will be located on a separate controlled access subnet. | Private web servers, which host sites that serve controlled access data, must be protected from outside threats in addition to insider threats. Insider threat may be accidental or intentional but, ... |
| V-15334 | Low | Web sites will utilize ports, protocols, and services according to PPSM guidelines. | Failure to comply with DoD ports, protocols, and services (PPS) requirements can resultin compromise of enclave boundary protections and/or functionality of the AIS.The IAM will ensure web ... |
| V-2230 | Low | Backup interactive scripts on the production web server are prohibited. | Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as ... |
| V-2257 | Low | Administrative users and groups that have access rights to the web server are documented. | There are typically several individuals and groups that are involved in running a production web site. In most cases, we can identify several types of users on a web server. These are the System ... |
| V-2251 | Low | All utility programs, not necessary for operations, will be removed or disabled. | Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is also a danger at the application ... |
| V-6724 | Low | Web server and/or operating system information will be protected. | The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and ... |
| V-2265 | Low | Java software installed on the production web server will be limited to class files and the JAVA virtual machine. | From the source code in a .java or a .jpp file, the Java compiler produces a binary file with an extension of .class. The .java or .jpp file would, therefore, reveal sensitive information ... |
| V-6373 | Low | The required DoD banner page will be displayed to authenticated users accessing a DoD private web site. | A consent banner will be in place to make prospective entrants aware that the web site they are about to enter is a DoD web site and their activity is subject to monitoring. |
| V-2260 | Low | A private web server will not respond to requests from public search engines. | Search engines are constantly at work on the Internet. Search engines are augmented by agents, often referred to as spiders or bots, which endeavor to capture and catalog web site content. In ... |
| V-2245 | Low | Each readable web document directory will contain either default, home, index, or equivalent file. | The goal is to completely control the web users experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an ... |