Tagged Questions
1
vote
2answers
96 views
secure certain data on my webserver
I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
3
votes
3answers
624 views
Is it possible to execute a php script in an image file? [duplicate]
I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.
I opened all the images that he uploaded to my server with ...
-5
votes
2answers
231 views
PHP injection on 777 file [closed]
Some one has modified a PHP file, which had permissions set to 777, on my VPS server.
How can someone do that without administrative access to the server?
What information I can give you?
I know ...
-1
votes
1answer
62 views
setting up website for logged in users, anyone, and files no one should see (via the web) [closed]
I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
3
votes
2answers
214 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
0
votes
2answers
179 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
4
votes
1answer
333 views
Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server
We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a ...
4
votes
3answers
345 views
Is there a good reason to turn off phpinfo()?
New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
1
vote
1answer
577 views
How can log poisoning be successful with a Local File Inclusion attack?
I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
2
votes
1answer
111 views
Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads?
As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
3
votes
7answers
1k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
7
votes
2answers
998 views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
