Quick, Easy & Essential Cyber Security Tips - Pro-Bono

This is important!

  • Use generic error pages - For instance, silently redirect 404, 403 errors to your home page
  • Disable ALL error reporting on your system

Directory Listing enables an attacker access to restricted data: E.g backup, conf files forgotten in the web-root

  • In your .htaccess file, add this line: Options -Indexes
  • Else, having an index.html page in the directory prevents listing as well

    • Disable SSH root login
    • Limit failed SSH authentication attempts. E.g to 3
    • Use a different SSH port other than 22
    • Disable FTP; it's authentication is in clear-text (Use SFTP above)
    • Disable Telnet
    • Whitelist allowed ports: Typically: HTTP/S, SMTP, SSH

    • Never trust any client generated input - Always sanitize it

    Check out our [Online System Vulnerability Scanner] New!

    HTTP requests smuggling Web cache poisoning Business logic Web cache deception Access control CRLF CSRF XSS SQLi Command injection RCE Authentication & session management Security misconfiguation Insecure deserialization Sensitive data exposure XXE Usage of vulnerable components/ software Requests misrouting HTTP methods Open redirects LFI Directory listing