A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

3
votes
3answers
63 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
1
vote
1answer
26 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
0
votes
2answers
121 views

What website accepts only TLS 1.2 so I can verify client capability?

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it? Background: I have an old VB....
0
votes
0answers
44 views

What is the best way to store clients' data [closed]

What is the best way to protect clients' data? Ex: If we store data locally, we can dedicate a system where clients data is stored and create users to access particular folders, we can encrypt the ...
2
votes
3answers
100 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
3
votes
2answers
52 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
0
votes
2answers
48 views

Security scan with or without IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
0
votes
0answers
31 views

Apachelog with requests from University of California and RIPE

I have a VPS with a dedicated IP running. The only purporse of this machine is to serve a Wordpress website and to learn more about networking. I have been playing around with the machine. I got to ...
0
votes
1answer
58 views

How come domain resolves to another IP?

I tried to ping http://crashsafari.com in my CMD: Right there, it resolves http://crashsafari.com to 54.231.48.170 which is http://s3-website-us-east-1.amazonaws.com. But, http://crashsafari.com ...
3
votes
2answers
100 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
5
votes
2answers
195 views

How can someone upload a PHP file to a server without an upload form?

I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the ...
8
votes
0answers
3k views

How to know if it's actually a 404 page? [migrated]

What I learned from Foregenix: The HTTP 404 Not Found Error means that the webpage you were trying to reach could not be found on the server. It is a Client-side Error which means that either the ...
30
votes
1answer
3k views

Server attack with \x01

I notice from my server logs that there have been a number of requests like [01/Jun/2016:07:47:58 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\...
26
votes
3answers
5k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
1
vote
1answer
28 views

Finding the cipher suites supported by a web server [closed]

So I need to find the cipher suites supported by a website. Now I can use this NMap script however this problem is research oriented so I need to write a code in order to collect the data ...
3
votes
3answers
51 views

How secure are webservers from linux repos?

how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date. If they ...
0
votes
0answers
44 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
0
votes
0answers
44 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
0
votes
1answer
45 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
0
votes
2answers
94 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
0
votes
0answers
49 views

Targeting a specific machine and known setup with Armitage / Metasploit?

Most introductions to armitage / metasploit start with searching for potential targets. But if you want to pen test your own setup then it probably makes more sense to target the specific machine and ...
0
votes
2answers
97 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
1
vote
2answers
79 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
9
votes
2answers
129 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
1answer
80 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
1
vote
1answer
46 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
2
votes
3answers
80 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
3
votes
1answer
71 views

Is this information leakage dangerous?

After scanning my website with a automated tool I get this Is this dangerous, is it a vulnerability or not? If yes what can an attacker do, how to fix it?
1
vote
0answers
21 views

Information and Settings Collected from a PC Connected to a Web Server

1- What are the information and settings collected from my pc when I connect to a website server? 2- When I connect through a VPN, Could the website server detect a mismatch between my new location ...
5
votes
2answers
70 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
2
votes
0answers
45 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
0
votes
1answer
55 views

Simulate a lot of different IP's hitting a website

This may sound like launching a DDOS, but I am testing out GEO-IP location on my applications. I need to gather some data, to check how my graphs look when there is a lot of data. Are there any tools ...
8
votes
1answer
240 views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
0
votes
2answers
59 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
4
votes
1answer
87 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
3
votes
1answer
84 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
5
votes
2answers
125 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
3
votes
2answers
138 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
1answer
48 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
3
votes
1answer
217 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
45
votes
8answers
6k views

Hack-resistant hosting solution for non-profit?

(While the answers and comments at How do I deal with a compromised server? are useful, my question is more about prevention of hacking when I do not have total (or much) control over the server. I ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
5
votes
1answer
70 views

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? What issues may arise from this? Is there any benefit in doing ...
1
vote
3answers
130 views

Are there any problems with using CAMELLIA, IDEA and SEED based cipher suites on a web server in 2016?

I have recently seen CAMELLIA, SEED and IDEA cipher suites in use for HTTPS on a web server and am unsure what to suggest to the owner. The keys in use are all over 128 bits in length and standard ...
4
votes
4answers
178 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
0
votes
0answers
47 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
3
votes
1answer
221 views

Why is Norton Safe Web flagging my site as dangerous when it reports on PHP files/urls that don't exist?

I'm in a bit of a quandary over Norton Safe Web's rating of my company's website. My question is: is it possible for someone to fool Norton Safe Web into thinking that our website has PHP files which ...
0
votes
1answer
50 views

Connecting to a compromised server

There have been a number of threads lately about hacked websites where attackers are gaining control of the servers these sites are being hosted on. As such, these servers should be treated as ...