Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

2
votes
1answer
898 views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
2
votes
3answers
250 views

Ping Input box on web server vulnerable to piped commands?

Scenario is this. I have logged into a web server as admin through the Login page in browser. it has displayed me with a home page of sorts that has an input box with a button next to it saying "ping"...
2
votes
1answer
106 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
2
votes
1answer
226 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET /calendar/caldetail/id/281/...
2
votes
1answer
593 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
2
votes
0answers
173 views

Verizon wireless router is pinging my web server - is this ok or bad? [closed]

So I'm working from a local cafe, doing some web development, and need to see something in my Apache's access log. And to my surprise, in the log I see, every 30 seconds or so, a request for my root ...
2
votes
2answers
2k views

How do I figure out how malware infected my server, and the subsequent sites on the server?

I recently was in charge of fixing our server at work, and cleaning the sites on it. We were infected with some malware that injected some code into some of our clients websites. Apparently, there was ...
1
vote
3answers
5k views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
1
vote
3answers
822 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
1k views

Running Apache as system service on Windows 2003 R2 64-bit

Trying to make my point, that running Apache with PHP5 module as Windows service is not secure. All I got to prove it - FTP access to some internal website. So what I did - I uploaded file test.php ...
1
vote
2answers
3k views

Find the hack in the Apache2 logs?

The hack was a failure, as they were not able to put the created page as the home page. But we found recently a manipulated page on our website (via the rss). So I looked in the Apache2 logs and ...
1
vote
4answers
253 views

How to detect credit cards harvested from memory?

Had a chat recently with PCI compliance specialist and got to realize there is a way to steal raw data from Apache / Nginx memory e.g. credit cards. It's called "harvesting" and becomes pretty common. ...
1
vote
2answers
1k views

Path traversal exploit

I have an Apache server which seems to be vulnerable to path traversal, because when I test this URL: http://localhost/ati/../test.txt it will be changed to the this: http://localhost/test.txt and ...
1
vote
1answer
201 views

How to avoid Heartbleed like problems in the future?

I asked a question on stackoverflow, but guess this site is better suited for it. Idea is to prevent problems when the next buffer overflow bug comes out. In my understanding the problem with ...
1
vote
1answer
492 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
1
vote
2answers
1k views

Is apache mod_spamhaus still being maintained?

I only found this: http://sourceforge.net/projects/mod-spamhaus/files/?source=navbar and that is from 2008 Is there any newer apache mod that is up-to-date? Someone has experience with it? Maybe ...
1
vote
4answers
47 views

Remove possibility to read system files with PHP from Apache

When I upload a php file (file.php) with following content on Apache server <?php $file = $_GET['file']; include ( $file); ?> I am able to read any file of Apache using the below URLs http://...
1
vote
2answers
103 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or ...
1
vote
1answer
382 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
1
vote
2answers
227 views

How to prevent Cookie-Bombs?

Egor Homakov made a nice writeup (Cookie Bomb or let's break the Internet) on how to crash CDNs and other websites with cookies. Although this is a user/browser-side DOS, I'm wondering how one would ...
1
vote
2answers
962 views

Is Apache serving over HTTP vulnerable to Heartbleed? [duplicate]

I run a server whose only public open port is 80, serving non-encrypted data over HTTP, not HTTPS. Is it affected by Heartbleed?
1
vote
2answers
755 views

False positive Apache version in scanner results on Centos

Recently I need to care a lot of false positive vulnerabilities in scanner results on Apache version. Example of false positive vulnerability: Apache 2.2 < 2.2.16 Multiple Vulnerabilities Our ...
1
vote
1answer
13k views

Speaking Plain HTTP over an SSL enabled Server port [closed]

atm I'm facing a problem with IE and Firefox because they don't redirect my Links correctly. I'm requesting my application via: https://myapp.example.de/context In my webapplication I have links ...
1
vote
2answers
2k views

If Xampp is not secure enough for a production environment what should I use?

I am not even sure if this is the right place to ask this but here goes: I am thinking of running my own small website from a home server. I have been using Ubuntu 12.04 with xampp as my server ...
1
vote
2answers
65 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
1answer
75 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
1
vote
1answer
574 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
1
vote
2answers
151 views

Can Client Certificates be tied to a Specific Server Certificate?

I have a Root Certificate Authority and and Intermediate Certificate Authority. I have created a certificate for the server. SSL on Apache is working fine. Browser recognizes my Chain of Trust with ...
1
vote
1answer
145 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
1answer
461 views

Edit virtual host file using php [closed]

I have a php application and somethings related to the application need changes to vhost.conf file. Presently i'm making the changes manually. But i would like to automate it using a php script. Is ...
1
vote
1answer
3k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] 80/...
1
vote
2answers
79 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
1
vote
1answer
83 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
1
vote
3answers
166 views

Strongest cipher suite in apache 2.4

I am trying to use only the strongest ciper suite available, from the documentation I tried: SSLCipherSuite HIGH:!aNULL:!MD5 But the browser says that it is obsolete: What is the strongest one ...
1
vote
1answer
108 views

How to Develop Waf as Service [closed]

Recently, I've started a my educational project WAF as service. To develop this project as per my view, following things are required: Web Application Firewall is in-line with the web servers; it ...
1
vote
2answers
673 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
1
vote
2answers
473 views

ModSecurity is behaving funnily in apache2.4 on ubuntu 14.04

I am trying to put modsecurity in apache 2.4.7 a reverse proxy for a tomcat applcation. For a normal request it's throwing lots of logs about allowed methods even though the method used is get. [Wed ...
1
vote
1answer
189 views

securing /var/www with .htaccess

So I have a web directory running on a server and I want only people with the password to be able to get in. Is it possible to secure the web root with .htaccess? Is there any extra steps I need to ...
1
vote
3answers
142 views

Not replacing SSL cert on a rebuilt, formerly rooted Unix Server

If a server was rooted, to the point that we know a Perl script which creates a remote shell was placed on the filesystem remotely, and the server was rebuilt entirely, patching the original Apache ...
1
vote
2answers
3k views

Block http HEAD, TRACE, DELETE OR TRACK requests is a valid security feature? [duplicate]

Block http HEAD requests helps us to solidify the safety rules for a Apache webserver or this restriction would be an exaggerated? What kind of vulnerability can be exploited by HEAD method? Tests: ...
1
vote
2answers
454 views

VPN Client - Addtional Security Layer or a Useless Feature

I have a corporate web portal which is used for staff collaboration including a web-based mail interface connected to MySQL Database, corporate calendar, file storage, customer contacts data with ...
1
vote
1answer
308 views

Separating Apache and MySQL over Tor for security, performance, and reliability

I'm trying to set up a hidden web service over the Tor network, and I was thinking of making a configuration where my Apache server and my database server are located on different networks. I know ...
1
vote
1answer
2k views

“Must have” and “Preferred Cipher” suites terminology

I have received the following advise to set cipher suites to suitably mitigate Beast attack on a newly setup Apache HTTPD server. Preferred ciphers: RC4-SHA, RC4-MD5 Must Have Ciphers: ...
1
vote
1answer
539 views

What are the consequences of turning on Apache AllowEncodedSlashes?

What are the consequences of turning on Apache AllowEncodedSlashes? I want to turn it on and I want to know if this any worse than any of the other kinds of injection attacks that may occur in web ...
1
vote
1answer
29 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL? [on hold]

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
1
vote
1answer
25 views

Modsecurity Encrypted traffic in 3 tier architecture

The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB. I have read that modsecurity doest deal with encrypted traffic ...
1
vote
1answer
34 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
1
vote
1answer
116 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): \x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~...
1
vote
1answer
109 views

Strange entry in Apache's ports.conf

I am not sure if this may indicate a compromised server or if I'm just being paranoid. While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for ...