Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

2
votes
0answers
139 views

Verizon wireless router is pinging my web server - is this ok or bad? [closed]

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root ...
2
votes
2answers
1k views

How do I figure out how malware infected my server, and the subsequent sites on the server?

I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
1
vote
3answers
518 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
3k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
1
vote
4answers
204 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
1
vote
1answer
60 views

Running an Open Server (contents are visible)

I'm considering the possibility of running an Open Server, as I would call it, that is, a server where as much of its contents are publicly visible as possible. I would like to give read access to ...
1
vote
1answer
141 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
1
vote
1answer
266 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
1
vote
2answers
659 views

Is apache mod_spamhaus still being maintained?

I only found this: http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar and that is from 2008 Is there any newer apache mod that is up-to-date? Someone has experience with it? Maybe ...
1
vote
1answer
80 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
1
vote
2answers
841 views

Is Apache serving over HTTP vulnerable to Heartbleed? [duplicate]

I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
1
vote
2answers
392 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
1
vote
1answer
6k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
1
vote
2answers
2k views

If Xampp is not secure enough for a production environment what should I use?

I am not even sure if this is the right place to ask this but here goes: I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
1
vote
1answer
116 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
1answer
233 views

Edit virtual host file using php [closed]

I have a php application and somethings related to the application need changes to vhost.conf file. Presently i'm making the changes manually. But i would like to automate it using a php script. Is ...
1
vote
3answers
117 views

Not replacing SSL cert on a rebuilt, formerly rooted Unix Server

If a server was rooted, to the point that we know a Perl script which creates a remote shell was placed on the filesystem remotely, and the server was rebuilt entirely, patching the original Apache ...
1
vote
2answers
1k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
1
vote
2answers
326 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
1
vote
1answer
196 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
1answer
2k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
1
vote
2answers
409 views

Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? [duplicate]

Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated? What kind of vulnerability can be exploited by HEAD method? Tests: ...
1
vote
1answer
168 views

Is this slowloris attack or not?

IP is hidden in apache log for privacy, except last octet. /billing is our application start page. But it doesn't make sense that it sends POST requests, and get 500 response. Or maybe this is ...
1
vote
1answer
215 views

Why are OSX users of my TLS-only site being asked to supply a client certificate?

I purchased a Comodo SSL certificate (OV), and set up the Apache vhost config so that all traffic is forwarded to 443. Intermittently some users are being prompted to supply a client certificate; ...
1
vote
2answers
121 views

Force https, complex implementation

I have a website running on a dedicated server (single IP) on apache. Multiple domains are pointed to the website . For ex: sub.abc.com, sub.bcdaf.com I have now purchased a single SSL certificate ...
1
vote
1answer
315 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
1
vote
1answer
351 views

Checking if Mod_Rewrite is Enabled Remotely

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
1
vote
0answers
20 views

Kerberos based infrastructure with artifactory repo for our java artifcts with Apache reverse proxy and mod auth kerb. how can I access with gradle? [closed]

We recently migrated our company to a kerberos-based infrastructure. I successfully set up an Artifactory repo for our java artifacts, with Apache reverse proxy and mod_auth_kerb. How can I access ...
1
vote
1answer
2k views

removing SSLv3 does not seem to fix POODLE problem [duplicate]

I have removed SSLv3 from my Apache 2.2.15 ssl.conf file with the line SSLProtocol All -SSLv2 -SSLv3 I have restarted httpd but POODLE tests still show vulnerability exists with POODLE. What else ...
1
vote
1answer
105 views

Securely send password to script as parameter

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively. ...
1
vote
1answer
316 views

Strange bug in ModSecurity with the rule 950901

I have a classic ModSecurity configuration (apt-get...) SecRuleEngine Off SecPcreMatchLimit 1000 SecPcreMatchLimitRecursion 1000 SecAction "phase:1,t:none,nolog,pass, \ ...
1
vote
0answers
40 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
0answers
296 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
1
vote
1answer
91 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
0answers
198 views

How Do I Secure Apache Web Server [duplicate]

Possible Duplicate: Apache Server Hardening I'm going to make a web server on Apache 2. What are the security issue I will be looking at? And how do I secure it? I have been reading news ...
0
votes
2answers
889 views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
2answers
945 views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
0
votes
2answers
95 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
0
votes
1answer
285 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
0
votes
3answers
3k views

How to filter POST requests before they reach PHP on Apache?

I have done URL filtering with .htaccess (using learning and generator), however I am still concerned that any POST request can be submitted to the PHP even there is only one POST form on the website, ...
0
votes
2answers
189 views

Clarifying MITM attacks and Digital Certificate requirement

We are running a Portal application for our client with Payment Gateway integrated. Payment gateway uses SSL as it is suppose to be . The concern for me is that our Portal application does not use ...
0
votes
1answer
108 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
0
votes
3answers
473 views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
0
votes
1answer
309 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
0
votes
1answer
184 views

Lots of bot hits, referer seems to be the variable

I've recently (over the last 15 minutes) had quite a few hits from the same IP, it's in a country on our blacklist so they just up up on our "Access Denied" page, but I was just interested in what ...
0
votes
1answer
1k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
0
votes
3answers
853 views

How to find vulnerable sites on a web server

A client of mine has a managed VPS with dozens of websites on it, maybe even hundreds. Now his server keeps getting infected on a regular basis. The webhost / server admins keep digging in the dark. ...
0
votes
2answers
310 views

How to protect files (cron files) frome being executed by everyone?

I wonder what read / write permissions should I set on my cron files (php files) so they can be executed only by our server. We're using CentOS 5.9 - 64bit and cPanel / WHM + Apache. Thanks!
0
votes
2answers
335 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
0
votes
1answer
52 views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...