Tagged Questions
5
votes
3answers
178 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
-1
votes
0answers
11 views
Sophos access a webserver from the web [migrated]
I have an web server(IIS) behind an SOPHOS UTM 9
I have setup the Web Application Firewall feature
It is a completely fresh install. No other settings have been eddied.
When I Try to access the ...
2
votes
3answers
231 views
Is it possible to list folder from my web server if i have an empty index.html in the root folder?
I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.
I want to be able to share link with people i know, by creating a folder that look like ...
7
votes
2answers
85 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
1
vote
3answers
229 views
Using Netcat to detect the webserver type
In order to know which server a site is running I can use netcat.
Through the following command I can gather information about the type of server installed.
netcat -vv www.example.com 80
But if ...
1
vote
2answers
427 views
Is it harmful to allow http requests with very long querystrings in IIS?
I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
3
votes
3answers
344 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
6
votes
1answer
383 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
14
votes
1answer
946 views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
