Tagged Questions

Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

2
votes
1answer
119 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET ...
0
votes
0answers
56 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
1answer
137 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
0
votes
1answer
98 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
5
votes
3answers
1k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
2
votes
2answers
208 views

Is it important to use a slow hash in htpasswd?

It's my understanding that the purpose of .htpasswd files is to restrict access to some files in the server filesystem. If an attacker gains access to it, he probably has access to everything else ...
3
votes
3answers
285 views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
2
votes
2answers
579 views

Load balancer and two machines - how many SSL certificates do I need?

We have a load balancer facing the Internet. It's balancing load towards two systems behind it in the back-end running apache. How many SSL certificates do I need to buy? - One for the load-balancer ...
0
votes
1answer
2k views

Apache 2.2 mod_ssl configuration Forward Secrecy/BREACH/BEAST/CRIME

I am looking for mod_ssl configuration which protects against common attacks like Breach, Beast and Crime. I already disabled gzip to avoid Crime but I'm unsure about the others. RC4 should only be ...
0
votes
2answers
167 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
1
vote
2answers
836 views

Is Apache serving over HTTP vulnerable to Heartbleed? [duplicate]

I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
1
vote
3answers
691 views

Strange Apache access logs

A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely ...
2
votes
1answer
227 views

Apache, DocumentRoot and path traversal - /manual/ query

A PCI scanner of a client is current showing a potential path traversal exploit. The document root is set to /home/somefolder/somewebfoldername/ YET, visiting ourwebsite.com/manual shows the Apache ...
0
votes
1answer
147 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
1
vote
2answers
864 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
0
votes
1answer
284 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
1answer
3k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
4
votes
4answers
2k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
2
votes
1answer
810 views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
1
vote
1answer
247 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
3
votes
2answers
264 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
0
votes
0answers
21 views

Someone is making this request to the php cgi on by apache2 server, what does it mean do? [duplicate]

These are the query parameters the hacker is trying to POST: ...
0
votes
1answer
58 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
1
vote
2answers
317 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
2
votes
2answers
363 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
1
vote
1answer
472 views

www-data is sending rogue mails through sendmail. How do I find the source?

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account. As of yesterday ~19:00 CET, ...
1
vote
0answers
40 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
4answers
259 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
1
vote
1answer
207 views

Why are OSX users of my TLS-only site being asked to supply a client certificate?

I purchased a Comodo SSL certificate (OV), and set up the Apache vhost config so that all traffic is forwarded to 443. Intermittently some users are being prompted to supply a client certificate; ...
2
votes
1answer
780 views

Is htaccess secure enought to whitelist clients IPs?

I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this: order deny,allow deny from all allow from X.Y.Z.Q These ...
1
vote
0answers
272 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
1answer
190 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
1answer
86 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
2answers
359 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
4
votes
2answers
235 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
2
votes
0answers
135 views

Verizon wireless router is pinging my web server - is this ok or bad? [closed]

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root ...
0
votes
1answer
215 views

How does a website get pass my server firewall and attempt to hotlink to my server resources?

I was stumped when I saw the following lines on my Apache server error log this morning: [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: ...
7
votes
1answer
180 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
5
votes
1answer
563 views

Why these 2 regexp won't work as expected in ModSecurity?

PROBLEMRULE #1; SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'" PROBLEMRULE #2; SecRule REQUEST_URI ...
3
votes
1answer
199 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
0
votes
1answer
264 views

Installed new Wildcard certificates on my server, but still appear as expired on browser [closed]

I have bought new WILDCARD certificates (*.mydomain.com) for my servers. I was able to install successfully on one server. So, I know the files are correct and I was able to verify their validity. ...
8
votes
2answers
10k views

Protect against POST //cgi-bin/php attacks?

I am being attacked with this cgi injection: POST ...
1
vote
1answer
113 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
0
votes
1answer
174 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
1
vote
1answer
6k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
29
votes
4answers
5k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
2
votes
4answers
802 views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
0
votes
1answer
1k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
1
vote
2answers
121 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
1
vote
3answers
10k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...