Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
1answer
18 views

Modsecurity Encrypted traffic in 3 tier architecture

The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB. I have read that modsecurity doest deal with encrypted traffic ...
-3
votes
0answers
16 views

Kali linux 2.0) Setoolkit Port Change Question [on hold]

dear I want 1 Question , How use the 8080 port in Setoolkit, Copy Clone and harvaest my apache server open 8080 port Because ISP block 80 port. so, The first 0.0.0.0:80 -> 0.0.0.0:80/index.html -> ...
1
vote
0answers
64 views

Executing arbitrary code with cat command when reading access.log

I made this file based on a combination of hexadecimal that can breakcat and the terminal showing the file with cat, and the reset command does not work anymore: Download Cat Killer Version 1 To ...
0
votes
0answers
40 views

Apache Web Server ETag Header Information Disclosure Weakness

How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
1
vote
1answer
30 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
1
vote
2answers
77 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
0
votes
1answer
80 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
9
votes
1answer
137 views

Very long HEAD request in server logs: What is the intention?

I'm getting logs like (using Apache server): 119.131.152.148 - - [20/Apr/2016:18:17:47 +0900] "HEAD ...
3
votes
1answer
13 views

Is this HSTS header set correctly in LAMP?

I have a LAMP server and my SSL certificate provider recommended me to set HSTS header as follows. I am wondering about two things. Header always set Strict-Transport-Security "max-age=63072000; ...
1
vote
0answers
67 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
3
votes
0answers
93 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
2
votes
1answer
39 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): ...
3
votes
1answer
76 views

Hosting multiple websites securely

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate ...
2
votes
1answer
113 views

Is this way of client-side SSL secure enough, to keep hackers away from my web app?

I'm wonderying if the following steps are enough to protect my cloud service, in a meaning that non-authorized users can not play with my web app? In other words, is it possible to bypass this kind ...
1
vote
2answers
92 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or ...
4
votes
2answers
422 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
3
votes
2answers
127 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
17
votes
1answer
2k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
3
votes
0answers
77 views

What is the best way to lock down web service access permissions?

After everything what I did in order to protect my server, i have uploaded webshell (WSO 2.1 Web Shell) , to see how far can hacker go and gues what, I was shocked, because I was able to read very ...
1
vote
0answers
96 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
66
votes
3answers
7k views

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
0
votes
1answer
366 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
3
votes
1answer
84 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
5
votes
1answer
62 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
2
votes
2answers
143 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
6
votes
3answers
123 views

Crawler massively changing user-agent

This morning I noticed a single IP-address was kinda crawling my website, though it was querying the same page many times in a few minutes. Then I noticed that it was doing that with different ...
1
vote
2answers
64 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
1answer
77 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
1
vote
3answers
153 views

Strongest cipher suite in apache 2.4

I am trying to use only the strongest ciper suite available, from the documentation I tried: SSLCipherSuite HIGH:!aNULL:!MD5 But the browser says that it is obsolete: What is the strongest one ...
4
votes
4answers
104 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
1
vote
1answer
73 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
2
votes
1answer
173 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
5
votes
1answer
794 views

Is it safe to email the contents of your .htaccess?

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file? I'm a novice in this ...
-3
votes
2answers
204 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
4
votes
1answer
32 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
-3
votes
2answers
92 views

Is it possible to stop an SSL Certificate from being portable between servers? [closed]

From what I read it seems that the certificate isn't a big deal since it's already public, and downloaded by every browser, however if someone gets hold of your key file, then you have an issue.
3
votes
1answer
158 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
1answer
80 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
-3
votes
1answer
39 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
1answer
115 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
4
votes
1answer
67 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...
0
votes
1answer
385 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly think ...
4
votes
2answers
369 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
1
vote
1answer
97 views

Strange entry in Apache's ports.conf

I am not sure if this may indicate a compromised server or if I'm just being paranoid. While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for ...
1
vote
1answer
507 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
0
votes
1answer
1k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
2
votes
2answers
594 views

Disable directory browsing using Apache htaccess file

TL;DR What are the risks and downsides associated with allowing Options -Indexes to work in arbitrary .htaccess files on a shared Apache web host? Context Apache web server configuration Linux ...
4
votes
0answers
3k views

Apache vs Jetty with regard to Security [closed]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
0
votes
0answers
215 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...