Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

15
votes
2answers
2k views

What was the aim of this HTTP request

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
4
votes
1answer
357 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and I am unfamiliar with the security and server side of my project. Recently, my site was ...
2
votes
1answer
87 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
0
votes
1answer
177 views

How to implement token based api for rest api in java?

I am working on a project, and I came here in this moment, where I now need authorization thing. I am using Apache Shiro for my web interface, but as long as mobile web-apps are concerned, I hardly ...
2
votes
1answer
491 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
0
votes
1answer
142 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
4
votes
1answer
43 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
3
votes
1answer
67 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET ...
3
votes
1answer
147 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
0
votes
0answers
14 views

SSLVerifyClient on Apache [migrated]

Please excuse any dumb statements regarding this. I am very new to Apache and to HP-UX. I am a SQL Server DBA somehow thrown into this project. I am working to try and implement SSL with Client ...
2
votes
2answers
67 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
4
votes
0answers
202 views

CRL check for TLS client certificate on Linux?

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
0
votes
0answers
48 views

Apache SSL proxy or Jetty with SSL via keystore to app?

Our team is debating two deployment methods for a RESTful web application. Run the app under http with an embedded Jetty server, but fronted by Apache - Apache would handle the SSL/TLS. Install our ...
6
votes
3answers
90 views

Crawler massively changing user-agent

This morning I noticed a single IP-address was kinda crawling my website, though it was querying the same page many times in a few minutes. Then I noticed that it was doing that with different ...
8
votes
4answers
7k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
1
vote
2answers
59 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
1answer
41 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
1
vote
3answers
92 views

Strongest cipher suite in apache 2.4

I am trying to use only the strongest ciper suite available, from the documentation I tried: SSLCipherSuite HIGH:!aNULL:!MD5 But the browser says that it is obsolete: What is the strongest one ...
2
votes
1answer
1k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
7
votes
3answers
2k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
4
votes
4answers
98 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
-3
votes
2answers
122 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
1
vote
1answer
60 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
11
votes
6answers
13k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
2
votes
1answer
90 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
5
votes
1answer
781 views

Is it safe to email the contents of your .htaccess?

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file? I'm a novice in this ...
4
votes
1answer
31 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
-3
votes
2answers
76 views

Is it possible to stop an SSL Certificate from being portable between servers? [closed]

From what I read it seems that the certificate isn't a big deal since it's already public, and downloaded by every browser, however if someone gets hold of your key file, then you have an issue.
1
vote
1answer
63 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
1
vote
1answer
102 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): ...
-3
votes
1answer
20 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
2
votes
0answers
35 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
4
votes
1answer
57 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...
20
votes
8answers
3k views

Should a site have SSL if it doesn't have a login form?

We have a site at work that is used for the following: Our homepage, which is just some info and contact info. Job applications are also handled on our site. There is no place where you can login ...
20
votes
2answers
4k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
4
votes
2answers
268 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
1
vote
1answer
67 views

Strange entry in Apache's ports.conf

I am not sure if this may indicate a compromised server or if I'm just being paranoid. While fiddling around with Apache and Webmin on a new Ubuntu 14.04 virtual server (as well as DNS records for ...
1
vote
1answer
266 views

SNI (server name indication) with SSL

Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?
0
votes
1answer
921 views

PHP mallware attack [duplicate]

I'm desprate because my site has been attacked by some malware that adds code below on every php files. I tried to edit and chmod the infected file but its coming back. Scanning with ClamAV found ...
8
votes
3answers
1k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
3
votes
2answers
184 views

Disable directory browsing using Apache htaccess file

TL;DR What are the risks and downsides associated with allowing Options -Indexes to work in arbitrary .htaccess files on a shared Apache web host? Context Apache web server configuration Linux ...
3
votes
0answers
993 views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
0
votes
0answers
133 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
9
votes
3answers
3k views

Does the recommended course of action for preventing Logjam on Tomcat servers really eliminate all risks of weak DH keys?

Can anyone verify this fix secures against the Logjam vulnerability for Apache Tomcat? I'm sceptical about it's effectiveness, since it doesn't mention how to implement the user defined 2048 bit DH ...
3
votes
3answers
394 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
0
votes
1answer
164 views

How do configure Apache to resolve 'Missing Cross-Frame Scripting Defence' by app scan [closed]

There is an apache server hosting some website written in PHP and is accessible thru internet. How do configure the apache to resolve 'Missing Cross-Frame Scripting Defence' and can 'Missing ...
2
votes
2answers
6k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
1
vote
3answers
133 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
6
votes
3answers
23k views

How to force all connections to my Apache server to use TLSv1.1 or TLSv1.2?

I tested on Ubuntu 12.04 (apache 2.2.22-1ubuntu1.4 and openssl 1.0.1-4ubuntu5.10) and Ubuntu 13.04 (apache 2.2.22-6ubuntu5.1 and openssl 1.0.1c-4ubuntu8.1). here explain how to do so, but I have the ...
2
votes
0answers
105 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...