Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

0
votes
1answer
48 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
1
vote
2answers
119 views

Protecting code injection via chattr on php files?

Recently, a website I hosted (wordpress I think) for a friend got hacked and all php pages had added code at the bottom in the form of "echo base64_encode(...);". Thus there were unwanted ads on very ...
5
votes
3answers
531 views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
0
votes
4answers
274 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
4
votes
0answers
49 views

Apache Webserver behind Firewall is a Victim of Proxy Abuse and Cannot Use fail2ban to solve it

We have a new client with a webserver that's getting too much proxy abuse. The access_log is filled with these kind of lines: 64.187.XXX.XXX - - [12/May/2015:10:32:10 -0300] "GET ...
0
votes
3answers
99 views

Disadvantages of disabling RC4 in SSL/TLS [closed]

Other than requiring more server resources, are there any disadvantages of disabling RC4 from being using by an Apache webserver? My primary concern is preventing access from older browsers.
1
vote
1answer
21 views

SSL connection between MySQL, Apache and the User's device

I set up SSL connection on my apache web server and I just would like to find out is it enough to secure my connection between the MySQL server, the apache web server and the user's device. Because I ...
3
votes
2answers
148 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
1
vote
0answers
22 views

How to correctly secure Reverse Proxy communication with actual server in LAN [migrated]

I have Nginx acting as gateway and reverse proxy for requests based on host name. However, the communication with the actual server in lan isn't secured. Does the connection remain encrypted with ...
1
vote
0answers
51 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?
0
votes
0answers
15 views

Brand new domain and server using URL Rewrite flagged by Google for Phishing [migrated]

I set up a VM with 1and1.com and registered a domain. I'm running an app (Jira) that runs on its own Tomcat instance but I have set up URL Rewriting based on this article so that IIS can handle the ...
0
votes
1answer
58 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
9
votes
3answers
843 views

Is Apache vulnerable to CVE-2015-1781?

Is Apache vulnerable to CVE-2015-1781 (buffer overflow in the gethostbyname_r() family of functions)? How can I quickly check if a system of mine is secure?
0
votes
0answers
26 views

Apache.exe trojan attack on xp server, wiped it with a linux install am i safe? [duplicate]

Hello I ran a apache web server on a windows xp pc on my home network. My antivirus picked up an attack, but didn't prevent it. It seems I had a Trojan attack on my apache.exe that got through. I know ...
0
votes
1answer
44 views

.htaccess protected folder except IP

I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file : Order deny,allow deny from all allow from 127.0.0.1 The IP is the IP of the webpage, ...
1
vote
0answers
80 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
2
votes
2answers
169 views

Website security checklist?

I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can, Can anyone provide me with some kind of a check-list of ...
3
votes
1answer
262 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and am unfamiliar with the security and server side of my project. Recently, my site was ...
3
votes
2answers
173 views

What is this strange GET request (GET /A0A32579-2767) DoSed my apache?

I have apache behind nginx on my webserver. Today my apache stops answering to requests. Investigations shows this situation: Number of apache processes grows more that 500 but MaxChildren=256 in ...
2
votes
1answer
120 views

Apache Partial HTTP Request Denial of Service Vulnerability

One of our client scan our site and share following qualys vulnerability. "Apache Partial HTTP Request Denial of Service Vulnerability - Zero Day " We are using "Ubuntu 12.04.5 LTS" with ...
0
votes
0answers
28 views

Hostname based Access Controls from clients with shared IPs

I have been pondering this question for some time now: Can you really use hostnames as access controls, especially when clients might be behind proxies or routers performing NAT (or any other shared ...
85
votes
15answers
19k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
13
votes
3answers
2k views

FTP hacked, planted file [closed]

Can anyone help me to understand what this does? Someone has planted a file with this piece of code on my server.It is shortened because it cannot fit the question, but just to have some idea what ...
2
votes
1answer
662 views

Worrying httpd access logs [duplicate]

so after setting up a new server with just ssh (public key only) and a webserver which just serves one index.html I left for the weekend. Logging in on Monday I see this type of thing in my httpd ...
1
vote
1answer
77 views

Slow Loris Incomplete GET Request

A slow loris attack is an attack of incomplete GET requests to most famously an Apache server because the server does not timeout the connection made after extremely long periods of time, from my ...
2
votes
2answers
591 views

Is it possible to exploit a file upload with whitelist and filename hashing?

I have a small web application. Because it is necessary to upload some files I check the file extensions with a whitelist (tgz, jpg, png, pdf, zip, rar, txt, gif, py, c, rb). In addition to that, I ...
1
vote
2answers
133 views

ModSecurity is behaving funnily in apache2.4 on ubuntu 14.04

I am trying to put modsecurity in apache 2.4.7 a reverse proxy for a tomcat applcation. For a normal request it's throwing lots of logs about allowed methods even though the method used is get. [Wed ...
7
votes
1answer
9k views

How to disable cipher RC4 in ubuntu 12.04

I have been doing Network Scan for our box and Ncircle reported SSL Server support RC4 ciphers for SSLv3. Based on that I did a search and I plan to add to /etc/apache/conf.d/security the following: ...
13
votes
6answers
37k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
1
vote
1answer
92 views

How to know an Apache web server mod_cgi module is enabled?

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
1
vote
1answer
69 views

What are the traces of a mysql attack on a server when the attacker has full permissions?

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
5
votes
2answers
5k views

Chrome does not show green bar with EV SSL but firefox and IE does

I just installed a EV SSL certificate on my server. It has been done correctly and is working, the issue is that Chrome does not show the company name in the green address bar, just shows the green ...
0
votes
0answers
155 views

Does GHOST (CVE-2015-0235) affect tomcat 7 with Java Secure Sockets Extension SSL?

If your system has certain versions (2.2 - 2.17) of glibc then it has the GHOST vulnerability. However, an attacker who does not otherwise have access to your system cannot take advantage of that ...
0
votes
3answers
985 views

Prevent a server side script from a direct URL access

There is a server side script written in php(say backend_file.php) or coldfusion(say backend_file.cfm). Lets say, i am using Apache and I have a sample web folder (on my Localhost) like: ...
2
votes
1answer
156 views

HTTP Host Header redirect traffic

Recently, I've seen periodic floods of traffic to my web servers with various Host headers that do not belong to us. The traffic appears to come primarily from China and a decent number seem to think ...
6
votes
2answers
399 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
2
votes
2answers
4k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
3
votes
1answer
315 views

Odd requests from Apache logs

I've been monitoring some weird activity in the access logs for my site and I've noticed a couple of weird attempts against the server. I'm wondering if anyone has seen these before. It's an Apache ...
1
vote
2answers
126 views

Path traversal exploit

I have an Apache server which seems to be vulnerable to Path traversal, because when I test This url : http://localhost/ati/../test.txt it will be changed to the this: http://localhost/test.txt and ...
0
votes
1answer
24 views

apache rewriterule htaccess security

If I configure an .htaccess like this : RewriteEngine On RewriteRule ^([^/]*)$ /view.php?key=$1 [L] Which transforms original URL http://www.test.com/view.php?key=123 rewritten URL ...
2
votes
1answer
111 views

Upload a file into directory with public write access

I know it is not right to set a permission for the folder as 777, but if it is done so will it be possible to upload a file into that directory without ftp access ? Here is what I mean Lets say the ...
0
votes
2answers
90 views

Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
0answers
57 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: ...
5
votes
2answers
448 views

Identifying an ongoing exploit?

Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but ...
0
votes
1answer
610 views

is HttpOnly and Secure cookie enough to prevent CSRF in rest api?

I created one RESTful API using spring. I am transmitting a secret key as HttpOnly & Secure cookie with login response. After login every rest request will check with that cookie and update it ...
2
votes
1answer
152 views

Strange logs in apache from bing/facebook

I am used to finding some random probing from script bots in my apache log files, but today I found some strange entries: 65.55.24.247 - - [25/Apr/2014:01:52:36 +0000] "GET ...
2
votes
2answers
11k views

Best Approach for removing XSS Vulnerability

I have been developing a Webobjects application, and I found that my application is vulnerable to XSS through URL, but not when malicious input like <script>alert("hi")</script> is input ...
35
votes
4answers
9k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
40
votes
4answers
32k views

How do I secure Apache against the Bash Shellshock vulnerability?

I have an Apache webserver running, and with the recent news of the Shellsock exploit against bash I was wondering if my webserver is vulnerable. I don't think it is, but I want to make sure I'm not ...
2
votes
3answers
15k views

How force that all connections to my Apache use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...