Questions about the security of Apache open source software, especially Apache HTTP Server
1
vote
3answers
133 views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
2k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
1
vote
2answers
560 views
If Xampp is not secure enough for a production environment what should I use?
I am not even sure if this is the right place to ask this but here goes:
I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
1
vote
2answers
131 views
Is apache mod_spamhaus still being maintained?
I only found this:
http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar
and that is from 2008
Is there any newer apache mod that is up-to-date?
Someone has experience with it? Maybe ...
1
vote
2answers
81 views
mod_spamhaus whitelist example to allow a range of ips
How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?
I have the whitelistfile in
/etc/spamhaus.wl
1
vote
1answer
399 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
1
vote
1answer
158 views
Exclude file names from mod_security patterns
I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.
For example, one problem ...
1
vote
1answer
209 views
Checking if Mod_Rewrite is Enabled Remotely
When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
1
vote
2answers
720 views
How do I figure out how malware infected my server, and the subsequent sites on the server?
I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
1
vote
0answers
184 views
How Do I Secure Apache Web Server [duplicate]
Possible Duplicate:
Apache Server Hardening
I'm going to make a web server on Apache 2.
What are the security issue I will be looking at? And how do I secure it?
I have been reading news ...
0
votes
2answers
223 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
2answers
411 views
Running Apache as system service on Windows 2003 R2 64-bit
Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website.
So what I did - I uploaded file test.php ...
0
votes
2answers
90 views
How to protect files (cron files) frome being executed by everyone?
I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server.
We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache.
Thanks!
0
votes
2answers
151 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
0
votes
2answers
616 views
How to filter POST requests before they reach PHP on Apache?
I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
1answer
78 views
How bad of a practice is it to mount tomcat's manager to Apache2?
If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.
E.g.,:
JkMount /manager/html* ajp13_worker
I'm doing this because my company has ...
0
votes
1answer
333 views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
0
votes
0answers
39 views
Are too many logfiles in the apachelog slowing down the server? [migrated]
At my webserver, I have separate logfiles for all my over 250 domains.
Is this showing the server down? Would it be faster to have only one logfile that contains all access-logs?
0
votes
0answers
68 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
0
votes
0answers
54 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
0
votes
1answer
267 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
0
votes
0answers
237 views
which scanner can detect scripts with malicious javascript on the server? [closed]
We've noticed several security warnings from antivirus software when visiting one of our customer's pages.
Besides other steps to improve security, we now want to scan the server's directories for ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
-1
votes
1answer
181 views
How to exploit a local file inclusion vulnerability in a Solaris server [closed]
I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
-1
votes
1answer
143 views
How do i prevent url manipulations including /proc and /etc with fail2ban?
I get many attacks on my apache server that include URL-manipulations like
http://url_on_my_eserver/?username=/etc/passwd
how can i block these attacks?
-3
votes
0answers
47 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
1answer
315 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
