Questions about the security of Apache open source software, especially Apache HTTP Server
2
votes
1answer
33 views
Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA
I would like to ask if it is possible to use different CA for the client certificate and the web certificate?
For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
-3
votes
0answers
47 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
5
votes
3answers
178 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
3
votes
4answers
161 views
Generic defense againt SQL injection
This is a little bit of a rant, but there's a real question at the end.
I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
0
votes
0answers
39 views
Are too many logfiles in the apachelog slowing down the server? [migrated]
At my webserver, I have separate logfiles for all my over 250 domains.
Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
4
votes
3answers
276 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
3
votes
2answers
88 views
Securing Java web services called by web site in DMZ using web services for communication
Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
12
votes
2answers
487 views
PHP attack string in access logs
So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I ...
2
votes
5answers
1k views
Testing for HTTP TRACE method
How can I test for HTTP TRACE on my web-server?
I need to train a Tester how to verify that the HTTP TRACE method is disabled.
Ideally I need a script to paste into Firebug to initiate a https ...
0
votes
2answers
88 views
How to protect files (cron files) frome being executed by everyone?
I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server.
We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache.
Thanks!
8
votes
5answers
519 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
4
votes
2answers
102 views
Security implications of storing email attachments on Centos Server
There is an application I am working on which requires processing the incoming mails to cs@company.com.
The company.com mail accounts are being run via Google Apps for Business.
So I fetch the ...
1
vote
2answers
125 views
Is apache mod_spamhaus still being maintained?
I only found this:
http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar
and that is from 2008
Is there any newer apache mod that is up-to-date?
Someone has experience with it? Maybe ...
1
vote
2answers
78 views
mod_spamhaus whitelist example to allow a range of ips
How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?
I have the whitelistfile in
/etc/spamhaus.wl
0
votes
2answers
151 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
0
votes
0answers
67 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
1
vote
3answers
127 views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
2
votes
1answer
107 views
unix malicious scripts/ksh execution
I'm wondering whether my architecture poses a security risk.
Details:
The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions.
I have a ...
-1
votes
1answer
136 views
How do i prevent url manipulations including /proc and /etc with fail2ban?
I get many attacks on my apache server that include URL-manipulations like
http://url_on_my_eserver/?username=/etc/passwd
how can i block these attacks?
5
votes
1answer
158 views
Using sudo to secure git deployment via web script
I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.
Briefly, how it works it:
I commit to Bitbucket
Bitbucket POSTs to a ...
3
votes
4answers
276 views
Safari downloaded my php source once. Should I worry?
I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!!
This hosting site has never done that before - .php scripts have always executed.
I can't duplicate ...
0
votes
2answers
222 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
0answers
54 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
-1
votes
1answer
181 views
How to exploit a local file inclusion vulnerability in a Solaris server [closed]
I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
4
votes
1answer
397 views
172.16.33.197, 127.0.0.1 IP addresses in visitor logs
I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
6
votes
1answer
591 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
0
votes
2answers
401 views
Running Apache as system service on Windows 2003 R2 64-bit
Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website.
So what I did - I uploaded file test.php ...
4
votes
3answers
291 views
Is a forced rewrite from http to https secure? What does SSLRequireSSL add?
I've read contradicting advice about forcing https connections in the following way:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
To me it seems ...
3
votes
2answers
145 views
Shared hosting mail server, Thunderbird and encryption
In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
1
vote
1answer
397 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
-4
votes
1answer
314 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
3
votes
2answers
361 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
0
votes
1answer
265 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
6
votes
2answers
122 views
HTTP daemon and Webroot permissions
We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user.
I have ...
1
vote
1answer
158 views
Exclude file names from mod_security patterns
I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.
For example, one problem ...
0
votes
0answers
236 views
which scanner can detect scripts with malicious javascript on the server? [closed]
We've noticed several security warnings from antivirus software when visiting one of our customer's pages.
Besides other steps to improve security, we now want to scan the server's directories for ...
-1
votes
2answers
608 views
How to filter POST requests before they reach PHP on Apache?
I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
1
vote
2answers
553 views
If Xampp is not secure enough for a production environment what should I use?
I am not even sure if this is the right place to ask this but here goes:
I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
8
votes
2answers
553 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
13
votes
3answers
4k views
Is there a way to mitigate BEAST without disabling AES completely?
It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like
...
2
votes
2answers
172 views
How to properly secure OO PHP CMS?
I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
4
votes
1answer
166 views
Securely Store Credentials for Web Application Services in Apache
We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
5
votes
2answers
6k views
How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?
Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;)
I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
0
votes
1answer
76 views
How bad of a practice is it to mount tomcat's manager to Apache2?
If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.
E.g.,:
JkMount /manager/html* ajp13_worker
I'm doing this because my company has ...
4
votes
1answer
178 views
Are we under hacker control?
We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites.
You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
1
vote
1answer
208 views
Checking if Mod_Rewrite is Enabled Remotely
When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
0
votes
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
