Book Image

Security with Go

By : John Daniel Leon
Book Image

Security with Go

By: John Daniel Leon

Overview of this book

Go is becoming more and more popular as a language for security experts. Its wide use in server and cloud environments, its speed and ease of use, and its evident capabilities for data analysis, have made it a prime choice for developers who need to think about security. Security with Go is the first Golang security book, and it is useful for both blue team and red team applications. With this book, you will learn how to write secure software, monitor your systems, secure your data, attack systems, and extract information. Defensive topics include cryptography, forensics, packet capturing, and building secure web applications. Offensive topics include brute force, port scanning, packet injection, web scraping, social engineering, and post exploitation techniques.
Table of Contents (15 chapters)

Brute forcing SSH

Secure Shell or SSH supports a few authentication mechanisms. If a server only supports public key authentication, a brute force attempt is near futile. This example will only look at password authentication with SSH.

To protect against attacks like these, implement rate-limiting or a tool such as fail2ban that locks out accounts for a short duration when a number of failed login attempts are detected. Also disable the root remote login. Some people like to put SSH on a non-standard port, but end up putting it on high number non-restricted ports such as 2222, which is not a good idea. If you use a high number non privileged port such as 2222, another low privilege user could hijack the port and start running their own service in its place if it ever went down. Put your SSH daemon on a port lower than 1024 if you want to change it from the default.

This attack...