Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL location on root client site), but literally on different domains.

To get access inside of dashboard login page, user should do request to client site (opened for all people), on specific URL, where after process with some questions/verification his IP gets added to database. On dashboard site running some script, that fetch array of approved IP and rebuild root .htaccess according to template every x minutes. Final .htaccess file looks in next format:

Order Deny,Allow Deny from all Allow from localhost Allow from 127.0.0.1 Allow from... List of approved IPs line by line goes here

I want to do same configuration in one of my app and working on that. Because IP whitelist located in header of root .htaccess file, there is no any chance to load any file/subdirectory/URL from this domain, I will always get 403 error.

As I understand, all MySQL payloads will be dropped by server before even reach application with PHP/MySQL. The question that bothers me, what kind of attacks are still possible on this dashboard, with such .htaccess configuration in root, on latest Apache 2.4? Maybe there any ways to bypass it, with some tricky headers or something like that?

From what I am thinking, possible only:

  • XSS attacks on client site, in case if data not filtered and printed in dashboard.
  • CSRF attacks on dashboard if you know whitelisted users and application structure.
  • Brutforce and scanning of non-web ports like FTP, SSH, SMTP, etc, where requests wont be dropped because of .htaccess whitelist

What else possible attacks should be considered while I am working on security? (Including attacks on client site that somehow linked or speaking with this dashboard)

Thanks

Linux SSD + Unlimited $1 Cpanel Hosting with Free SSL and DDOS Protection!

In a competitive world Hostpoco understands the importance of Running heavy site, large blog, high traffic website hence designed some cheaper and affordable web hosting solutions based on SSD Web Hosting.

Now host your website with our Unlimited $1 SSD Hosting Plans, 30 Days Money Back Guarantee and 24×7 support. We carefully chose high-quality servers, networking, and infrastructure equipment to ensure high reliability.

Our SSD hosting plans are starting from $1/Month and assure you 20x Lightning Fast Hosting with the best performance. Our plans are Cpanel based and come with the best possible below features:
~20x Faster Speed
~Unlimited Bandwidth
~Unlimited Email Accounts
~Unlimited Sub Domains
~FREE Online Sitebuilder
~Unlimited MySql Databases
~FREE Auto SSL
~REE DDOS Protection
~9.99 % Uptime
~30 Days Money Back Guarantee
~24/7 Support
~FREE Backup Restore
~FREE PhpMyAdmin

Linux SSD Hosting Plan:
(No hidden charges)

=================================================
*Startup SSD Start from only $1 /Monthly
*Pro SSD Start from only $2.5 /Monthly
*Premium SSD Start from only $5.5 /Monthly
*Elite SSD Start from only $8.5 /Monthly
=================================================

If you would like more information about our Plan, please visit www.hostpoco.com

In addition, we encourage you to reach out to our team anytime, 24/7, if you have any questions or need help getting started!

Thank you.

How does Chrome’s Renderer Code Integrity Protection Work?

I recently heard of Chrome’s Renderer Code Integrity Protection, which is apparently supposed to prevent unsigned dlls from being loaded into the chrome.exe process, and figured I’d test what would happen if I tampered with one of Chrome’s default dlls. So, I opened chrome.dll in a hex editor, appended some random data to the end of the file, saved it and verified the “Digital Signatures” tab no longer appeared when I looked through the dll’s properties, and opened Chrome. To my surprise, it opened as normal. No crashes, no warnings, nothing. I took a look through the process in Process Explorer and verified the module wasn’t signed (“No signature was present in the subject”).

To see how far I could push this, I did the same with every dll in Chrome’s Application folder, reopened Chrome, checked that every chrome.exe process in process explorer was loading at least one tampered dll, and browsed for a few minutes. Never got a crash, error, or notification that an invalidly-signed dll had been loaded. I verified I was on Chrome version 79 (in which the features was re-enabled after being temporarily disabled in 78), that none of the processes had been launched with the command line option to disable the protection, and that I didn’t somehow have the registry setting that disables the protection set.

From my admittedly limited research on the subject, Renderer Code Integrity protection makes use of a Windows 10 feature to require that all modules loaded by any process opting into the feature are signed (I did my testing on an up to date Windows 10 box). It would seem logical that tampering with one of those modules would prevent it from being loaded, causing the application to either crash or produce some kind of warning that a critical dll had been tampered with. However, I haven’t been able to find out much else about the feature, with most sites just repeating “it prevents anyone from injecting code into Chrome”. Does anyone know the nitty gritty details on how Renderer Code Integrity works and why invalidating the signatures of every dll in Chrome’s application folder does nothing to prevent those dlls from being loaded?

Is there a option to protect a USB stick from being infected other than flash drives with hardware protection?

I would like to protect my flash drives to being infected when I put it in another computers or devices. After some research, I found that I will not be able to reach this level of protection by using only software solutions (correct me if I’m wrong).

However, I don’t have a flash drive with hardware protection and my only way to get one is importing (it will not be cheap). I also found that SD card’s switches against writing is not in a hardware-level, so I kinda have to trust that a potentially infected computer will respect it, which is not a good idea.

So, my question is: is there a trustful way (using USB) to put my files into another computer without my USB stick (flash drive or SD card) being infected?

Can I get a double layer protection if I use both desktop & browser based VPN?

Let’s say, if I use both NordVPN’s own software (random VPN location) and its Google Chrome VPN extension (random VPN location), does this add an extra layer of protection/encryption – means hiding internet activity from ISP and/or from your network plus an encryption- ?

Or connecting to the VPN server via NordVPN software plus Epic browser’s VPN, what kind of protection is that?

Is it double layer or just connecting to different ports?

Linux SSD + Unlimited $1 Cpanel Hosting with Free SSL and DDOS Protection!

In a competitive world Hostpoco understands the importance of Running heavy site, large blog, high traffic website hence designed some cheaper and affordable web hosting solutions based on SSD Web Hosting.

Now host your website with our Unlimited $1 SSD Hosting Plans, 30 Days Money Back Guarantee and 24×7 support. We carefully chose high-quality servers, networking, and infrastructure equipment to ensure high reliability.

Our SSD hosting plans are starting from $1/Month and assure you 20x Lightning Fast Hosting with the best performance. Our plans are Cpanel based and come with the best possible below features:
~20x Faster Speed
~Unlimited Bandwidth
~Unlimited Email Accounts
~Unlimited Sub Domains
~FREE Online Sitebuilder
~Unlimited MySql Databases
~FREE Auto SSL
~REE DDOS Protection
~9.99 % Uptime
~30 Days Money Back Guarantee
~24/7 Support
~FREE Backup Restore
~FREE PhpMyAdmin

Linux SSD Hosting Plan:
(No hidden charges)

=================================================
*Startup SSD Start from only $1 /Monthly
*Pro SSD Start from only $2.5 /Monthly
*Premium SSD Start from only $5.5 /Monthly
*Elite SSD Start from only $8.5 /Monthly
=================================================

If you would like more information about our Plan, please visit www.hostpoco.com

In addition, we encourage you to reach out to our team anytime, 24/7, if you have any questions or need help getting started!

Thank you.

Bot protection, http-2 link header and google tracking

I opened a link hxxps://ts[.]la/carey16046, which was in a youtube comment, than I got redirected to a tesla[.]com root page and saw the message:

Access Denied: You don't have permission to access "http://www.tesla.com/" on this server. 

and got 403 code. Updating page/cleaning cookies didn’t work. In response headers (full) I spotted this:

link: <https://www.googletagmanager.com>;rel="preconnect",<https://www.google-analytics.com>;rel="preconnect",<https://track.securedvisit.com>;rel="preconnect" 

Than I went googletagmanager[.]com and it goes:

400: Your client has issued a malformed or illegal request. That’s all we know. 

I was okay with it, but in the title tag was: Error 400 (Bad Request)!!1 With the one in the end. Is it a joke? Last time I was on tesla’s site was week ago and it worked properly. I’m sure that there weren’t any suspicious activity coming from my ip address whatsoever, although I am currently in Russia.

What is link header? I’m using firefox with privacy settings on, might it be an issue?

.NET application protection technique against cracking

I’m trying to protect my software against cracking. Protection against cracking is crucial before listing the product on market.

Info about the software:

  • Built using .NET C# (Framework 4.5.2)
  • WinForms
  • 32 bit

I have made a several protection layers:

  • Obfuscation, Renaming, anti-debugging
  • Encrypted communications between software and API server (RSA) public key hard-coded
  • The client will generate a temporary AES keys and encrypt it with server public key then sends it to server, The server will decrypt the data with his RSA Private key and respond with a new AES keys encrypted with the ones provided by the client at first request. Then any communication from client to server will be signed by server RSA pub key and encrypted by AES Keys provided by the server.

  • Verify libraries integrity by requesting libraries checksum from API and compare it.

And the most important part is, the application will once request “custom data” from API server and store it in memory, to be used by internal software functions. When a function in the application called it will use the “custom data” as input, so there’s no way for the software to operate correctly without having the “custom data”

The API server provides the “custom data” after verifying software activation code and machine unique ID.

The question is:

  • With all of these layers, can the software cracked?
  • Can the custom data layer bypassed?
  • If a cracker bypassed the protection layers until the “custom data” part, it’s possible to clone the software with the “custom data” meaning the software can operate without need to request the custom data from the API?

What i mean by custom data is making the software hybrid, always needs data from API to function

I am counting on the “custom data” protection layer.

Please let me hear your recommendations. thanks a lot

Does the Protection from Evil and Good spell protect against the Staff of the Forgotten One from Tomb of Annihilation?

Under the item description of the Staff of the Forgotten One in the ToA Hardcover, we see that a spirit inside the staff might try to possess the wielder:

The Protection from Evil and Good spell can protect against some kinds of possession:

Until the spell ends, one willing creature you touch is protected against certain types of creatures: aberrations, celestials, elementals, fey, fiends, and undead. […] The target also can’t be charmed, frightened, or possessed by them. […]

If I were under the effect of Protection from Evil and Good, am I immune from getting possessed by the ghost of the staff?

Anyone want DMCA Free/Offshore Servers &DDOS Protection?

We offer a wide selection of offshore dedicated servers, ranging from budget offshore servers, to enterprise class offshore servers. Located with a TIER III datacenter that is ISO 27001 & 9001 certified, dedicated server clients will benefit from total privacy, security and durable power./ 365x7x12 support.

https://www.vpb.com/grouproom.php?gid=1164&fuid=269

Skype ID:live:.cid.143257f04d8bf604

Telegram:@rosalie269

QQ:2167758686