Questions about the security of Apache open source software, especially Apache HTTP Server
2
votes
1answer
114 views
unix malicious scripts/ksh execution
I'm wondering whether my architecture poses a security risk.
Details:
The whole website is not ROOT owned but still, the APACHE user used instead has some pretty advanced permissions.
I have a ...
2
votes
1answer
294 views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
1
vote
2answers
2k views
Find the hack in the Apache2 logs?
The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss).
So I looked in the Apache2 logs and ...
1
vote
3answers
142 views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
3k views
Best Approach for removing XSS Vulnerability
I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
1
vote
2answers
160 views
Is apache mod_spamhaus still being maintained?
I only found this:
http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar
and that is from 2008
Is there any newer apache mod that is up-to-date?
Someone has experience with it? Maybe ...
1
vote
2answers
602 views
If Xampp is not secure enough for a production environment what should I use?
I am not even sure if this is the right place to ask this but here goes:
I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
1
vote
2answers
90 views
mod_spamhaus whitelist example to allow a range of ips
How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?
I have the whitelistfile in
/etc/spamhaus.wl
1
vote
1answer
431 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
1
vote
1answer
169 views
Exclude file names from mod_security patterns
I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.
For example, one problem ...
1
vote
1answer
216 views
Checking if Mod_Rewrite is Enabled Remotely
When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
1
vote
2answers
752 views
How do I figure out how malware infected my server, and the subsequent sites on the server?
I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
1
vote
0answers
186 views
How Do I Secure Apache Web Server [duplicate]
Possible Duplicate:
Apache Server Hardening
I'm going to make a web server on Apache 2.
What are the security issue I will be looking at? And how do I secure it?
I have been reading news ...
0
votes
2answers
233 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
2answers
441 views
Running Apache as system service on Windows 2003 R2 64-bit
Trying to make my point, that running Apache with PHP5 module as Windows service is not secure.
All I got to prove it - FTP access to some internal website.
So what I did - I uploaded file test.php ...
0
votes
2answers
103 views
How to protect files (cron files) frome being executed by everyone?
I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server.
We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache.
Thanks!
0
votes
2answers
163 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
0
votes
2answers
681 views
How to filter POST requests before they reach PHP on Apache?
I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
1answer
78 views
How bad of a practice is it to mount tomcat's manager to Apache2?
If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2.
E.g.,:
JkMount /manager/html* ajp13_worker
I'm doing this because my company has ...
0
votes
1answer
349 views
Mod_security rules-updater.pl fails to pull new release
Mod_security has a rules updater distributed with their release packages on sourceforge:
http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/
Usually, you can run the script ...
0
votes
0answers
70 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
0
votes
0answers
55 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
0
votes
1answer
281 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
0
votes
0answers
250 views
which scanner can detect scripts with malicious javascript on the server? [closed]
We've noticed several security warnings from antivirus software when visiting one of our customer's pages.
Besides other steps to improve security, we now want to scan the server's directories for ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
-1
votes
1answer
153 views
How do i prevent url manipulations including /proc and /etc with fail2ban?
I get many attacks on my apache server that include URL-manipulations like
http://url_on_my_eserver/?username=/etc/passwd
how can i block these attacks?
-1
votes
1answer
200 views
How to exploit a local file inclusion vulnerability in a Solaris server [closed]
I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
-2
votes
0answers
48 views
Safe application hosting using LAMP [closed]
I have a Ubuntu Server with PHP, MySql/Postgres configured on it. I have a Symfony2 application, which looks something like this:
Symfony/
app/ (php app files)
src/ (php app files)
vendor/ ...
-2
votes
0answers
28 views
Security - php file permissions on shared hosting [duplicate]
What file permissions should i set for a php website's files and folders running on a shared hosting plan on an apache server?
When I run <?php echo exec('whoami'); ?> it gives me a ...
-4
votes
1answer
331 views
Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]
For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html
I am trying this with insecure web application of OWASP. I made ...
