Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

16
votes
2answers
2k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
-1
votes
1answer
422 views

How to exploit a local file inclusion vulnerability in a Solaris server [closed]

I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
4
votes
1answer
838 views

172.16.33.197, 127.0.0.1 IP addresses in visitor logs

I have a website running Apache and PHP. I see that there are visitors with IP addresses 172.16.33.197 and 127.0.0.1. These addresses do not belong to our network. I get the visitor IP addresses with ...
4
votes
3answers
1k views

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

I've read contradicting advice about forcing https connections in the following way: RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} To me it seems ...
0
votes
2answers
945 views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
1
vote
1answer
2k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
-4
votes
1answer
1k views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...
7
votes
4answers
3k views

Protecting against DOS attacks

Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
3
votes
2answers
1k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
1
vote
1answer
315 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
0
votes
1answer
485 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
6
votes
2answers
202 views

HTTP daemon and Webroot permissions

We have a contracted web developer that uses deployment scripts to update and deploy web sites. In order for them to work they require write access to the whole webroot through the httpd user. I have ...
1
vote
2answers
2k views

If Xampp is not secure enough for a production environment what should I use?

I am not even sure if this is the right place to ask this but here goes: I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
5
votes
1answer
338 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
2
votes
2answers
322 views

How to properly secure OO PHP CMS?

I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, ...
8
votes
2answers
12k views

How to mitigate SSL/TLS Protocol Initialization Vector Implementation Information Disclosure Vulnerability?

Disclaimer: I'm not a sysadmin, please try to give your answers in developer friendly language ;) I'm test scanning a fresh VPS image with Nessus and I'm getting plugin 58751. I tried figuring out ...
5
votes
1answer
907 views

What on earth is this log entry in Apache?

error.log - Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8g mod_fastcgi/2.4.6 mod_fcgid/2.3.4 [Mon Oct 10 22:35:18 2011] [error] [client 91.212.226.95] (36)File name too long: access to ...
0
votes
1answer
115 views

How bad of a practice is it to mount tomcat's manager to Apache2?

If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2. E.g.,: JkMount /manager/html* ajp13_worker I'm doing this because my company has ...
10
votes
4answers
1k views

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
1
vote
1answer
351 views

Checking if Mod_Rewrite is Enabled Remotely

When pentesting it is useful to know when apache mod_rewrite is enabled. But when one comes across a web server that does not utilize PHP it is difficult to tell if mod_rewrite is enabled considering ...
2
votes
2answers
614 views

Allow apache to write to users' .ssh dir's

I know the title is just baiting the "your setup is insecure", but allow me to explain. I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web ...
2
votes
2answers
628 views

Writing files in a sub folder of the web folder (apache security)

I need to save session data for a dynamic web page script by writing to file. I have two questions: Are there any security preferences as to whether to save the data UNDER the web folder, or OUTSIDE ...
0
votes
1answer
599 views

Mod_security rules-updater.pl fails to pull new release

Mod_security has a rules updater distributed with their release packages on sourceforge: http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Usually, you can run the script ...
2
votes
1answer
660 views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
2
votes
2answers
1k views

How do I figure out how malware infected my server, and the subsequent sites on the server?

I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
4
votes
1answer
792 views

Does installing Apache on my local machine create new security risks?

I am developing a small LAMP online app, and so far I have been doing all the development online. I am considering installing Apache/PHP/MySQL on my Ubuntu machine to be able to develop locally as ...
4
votes
2answers
3k views

How to get site's 'real' URL (before being rewritten)

If a site uses .htaccess file to rewrite the URL for e.g. better SEO. Is it possible to find out what is the "real" URL?
1
vote
0answers
198 views

How Do I Secure Apache Web Server [duplicate]

Possible Duplicate: Apache Server Hardening I'm going to make a web server on Apache 2. What are the security issue I will be looking at? And how do I secure it? I have been reading news ...
2
votes
1answer
226 views

Does this htaccess snippet provide sufficient security?

I've downloaded a part of .htaccess to prevent from using base64_encode or <script> or _REQUEST within URL. Is this secure enough to help me out for partial security, or is it just a waste of ...
5
votes
1answer
1k views

Blacklist IP addresses based on number of 404s in Apache

I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses. Is there ...
5
votes
4answers
1k views

Server wide javascript injection

UPDATE: The server was rooted, php.ini was replaced that cause the injection to appear. Still haven't figured out which directive is injecting the javascript. I'm troubleshooting a hacked website ...
9
votes
2answers
6k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
9
votes
4answers
874 views

Combat Apache Killer

Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer. This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
9
votes
2answers
1k views

Securing my web-server / website [closed]

Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
2
votes
1answer
887 views

Mod Security for apache2 blocks curl!

I'm trying to get my users lat and lng from their address using google's geocoding api but when mod security is enabled it prevents it and the script timesout. How can I add an exception by ip or ...
7
votes
5answers
1k views

Master thesis topic - mod_security

I've been playing with mod_security for some time and I'd like somehow to use it in my master thesis. I don't know exactly how this work could be more interesting than describing what mod_security ...