Tagged Questions

Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
3answers
475 views

Strange Apache access logs

A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely ...
2
votes
1answer
201 views

Apache, DocumentRoot and path traversal - /manual/ query

A PCI scanner of a client is current showing a potential path traversal exploit. The document root is set to /home/somefolder/somewebfoldername/ YET, visiting ourwebsite.com/manual shows the Apache ...
0
votes
1answer
125 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
1
vote
2answers
735 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
0
votes
1answer
260 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
1answer
3k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
4
votes
4answers
2k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
2
votes
1answer
728 views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
1
vote
1answer
236 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
3
votes
2answers
243 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
0
votes
0answers
21 views

Someone is making this request to the php cgi on by apache2 server, what does it mean do? [duplicate]

These are the query parameters the hacker is trying to POST: ...
0
votes
1answer
58 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
1
vote
2answers
305 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
2
votes
2answers
302 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
1
vote
1answer
423 views

www-data is sending rogue mails through sendmail. How do I find the source?

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account. As of yesterday ~19:00 CET, ...
1
vote
0answers
38 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
4answers
250 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
1
vote
1answer
200 views

Why are OSX users of my TLS-only site being asked to supply a client certificate?

I purchased a Comodo SSL certificate (OV), and set up the Apache vhost config so that all traffic is forwarded to 443. Intermittently some users are being prompted to supply a client certificate; ...
1
vote
1answer
714 views

Is htaccess secure enought to whitelist clients IPs?

I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this: order deny,allow deny from all allow from X.Y.Z.Q These ...
1
vote
0answers
251 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
1answer
184 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
1answer
84 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
2answers
332 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
4
votes
2answers
228 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
2
votes
0answers
132 views

Verizon wireless router is pinging my web server - is this ok or bad? [closed]

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root ...
0
votes
1answer
212 views

How does a website get pass my server firewall and attempt to hotlink to my server resources?

I was stumped when I saw the following lines on my Apache server error log this morning: [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: ...
7
votes
1answer
175 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
5
votes
1answer
496 views

Why these 2 regexp won't work as expected in ModSecurity?

PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'" PROBLEMRULE #2; SecRule REQUEST_URI ...
3
votes
1answer
195 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
0
votes
1answer
243 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
8
votes
2answers
9k views

Protect against POST //cgi-bin/php attacks?

I am being attacked with this cgi injection: POST ...
1
vote
1answer
111 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
0
votes
1answer
172 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
1
vote
1answer
5k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
26
votes
3answers
5k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
2
votes
4answers
731 views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
0
votes
1answer
1k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
1
vote
2answers
119 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
1
vote
3answers
9k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
1
vote
1answer
216 views

Edit virtual host file using php [closed]

I have a php application and somethings related to the application need changes to vhost.conf file. Presently i'm making the changes manually. But i would like to automate it using a php script. Is ...
0
votes
1answer
147 views

Abusing write permission on Apache logs dir to escalete privileges

I have just come across this sentence on apache log files documentation: Anyone who can write to the directory where Apache is writing a log file can almost certainly gain access to the uid that ...
0
votes
3answers
827 views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
-1
votes
1answer
3k views

Incorrect file permissions for LAMP [closed]

I have installed Apache 2.4.6 on my server and have the following virtual host config: <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName foobar1.com DocumentRoot ...
2
votes
2answers
1k views

url from another domain in my access log

Most of the time when I am looking for 404 errors in my access.log, I see attempts to access something like /phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was ...
0
votes
2answers
192 views

My Apache log is kind of freaking me out [closed]

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, ...
0
votes
1answer
715 views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
0
votes
3answers
1k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
1answer
238 views

What are the consequences of turning on Apache AllowEncodedSlashes?

What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web ...
-2
votes
2answers
116 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
18
votes
8answers
2k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...