Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

2
votes
1answer
105 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
2
votes
1answer
591 views

Nessus scanner and Red Hat backport security updates

I have asked this question: False positive Apache version in scanner results on Centos I need additional clarification: Do you know if it is possible to configure Nessus to adopt Red Hat backport ...
4
votes
0answers
229 views

CRL check for TLS client certificate on Linux?

I run a HTTPS web service. Clients authenticate using a TLS Client Certificate. How do I configure a standard Linux web server (preferably Apache) to validate client certificates against their CRLs? ...
3
votes
0answers
97 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
3
votes
0answers
86 views

What is the best way to lock down web service access permissions?

After everything what I did in order to protect my server, i have uploaded webshell (WSO 2.1 Web Shell) , to see how far can hacker go and gues what, I was shocked, because I was able to read very ...
3
votes
0answers
143 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
0answers
220 views

Has HTTP bogus request type “COOK” been used in any known website attacks?

An apache web server access weblog shows a request type "COOK" where POST or GET are normally found. Is such a request part of any known web-based site attacks?
3
votes
0answers
572 views

Current State of BREACH (GZIP SSL Attack)?

It has been one year since BREACH made our way into our hearts, and there does not seem to be any articles or posts or patches since then, is my Google-fu weakening? Has BREACH been mitigated or ...
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
1
vote
0answers
66 views

Executing arbitrary code with cat command when reading access.log

I made this file based on a combination of hexadecimal that can breakcat and the terminal showing the file with cat, and the reset command does not work anymore: Download Cat Killer Version 1 To ...
1
vote
0answers
70 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
1
vote
0answers
101 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
1
vote
0answers
124 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
1
vote
0answers
98 views

Can't get my SSL CA to work with Apache

So I have an SSL enabled website running on Apache2. https://eamorr.com (I get a warning in my browser, as expected) I have a config file for this website at: /etc/apache2/sites-available/eamorr....
1
vote
0answers
239 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
1
vote
0answers
50 views

Mysql Virtual IP and timeout

What are the risk that I encounter when increasing the timeout of a vip between a web server (apache) and mysql cluster (two servers). Actually it is set to 5 minutes. If time_out was 1hour, knowing ...
1
vote
0answers
98 views

trackback spotted in multple http errors

[Sun May 11 12:24:46 2014] [error] [client private ip] [X_FORWARDED_FOR 27.159.207.165] Path not found: /contact_us_public.php/trackback/, referer: http://www.mydomain.net/contact_us_public.php Does ...
1
vote
0answers
50 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
0answers
30 views

Apachelog with requests from University of California and RIPE

I have a VPS with a dedicated IP running. The only purporse of this machine is to serve a Wordpress website and to learn more about networking. I have been playing around with the machine. I got to ...
0
votes
0answers
101 views

Apache Web Server ETag Header Information Disclosure Weakness

How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
0
votes
0answers
221 views

Injecting meterpreter/reverse_tcp into apache2 with msfvenom results in seg fault of apache2

I've been trying to use msfvenom with the linux/x86/meterpreter/reverse_tcp payload and an apache2 binary. My intent is to create a tainted version of apache2 to establish a persistent backdoor on the ...
0
votes
0answers
56 views

Apache SSL proxy or Jetty with SSL via keystore to app?

Our team is debating two deployment methods for a RESTful web application. Run the app under http with an embedded Jetty server, but fronted by Apache - Apache would handle the SSL/TLS. Install our ...
0
votes
0answers
142 views

Correct permissions for /runtime and /assets folders

Could you suggest how to properly configure the right directories in CentOS 6.6? On a server running a framework Yii, which works with the runtime directories and assets. For these directories I need ...
-1
votes
0answers
23 views

Client-initiated renegotiation on Apache httpd.conf

During testing we have found that one of our servers has this vulnerability and can any one of you let me know how to fix this issue. We use Apache 2.X version. Is there any variable which can be set ...
-2
votes
0answers
23 views

How to recognize if Apache HTTPD certificate uses a passphrase?

I need to recognize if Apache HTTPD certificate uses a passphrase during executing of some script. It is not the case when I have the SSLPassPhraseDialog directive in the HTTPD configuration (http://...