A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

1
vote
1answer
78 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
4
votes
1answer
70 views

Does visiting the localhost with my Tor browser reduce my security?

I happen to have Tor open right now, and want to do a quick modification to my website. Does visiting localhost with Tor reduce the security of that session?
3
votes
1answer
128 views

How can a server be hacked apart from port 80 or SSH?

Currently I have a compromised server (Ubuntu) that is running all services in Docker containers, but I found today a malicious program that was generating a DDOS attack. I checked all services in ...
3
votes
3answers
93 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
1
vote
1answer
27 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
1
vote
2answers
199 views

What website accepts only TLS 1.2 so I can verify client capability?

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it? Background: I have an old VB....
2
votes
3answers
103 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
4
votes
2answers
59 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
0
votes
2answers
60 views

Security scan with or without IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
0
votes
0answers
36 views

Apachelog with requests from University of California and RIPE

I have a VPS with a dedicated IP running. The only purporse of this machine is to serve a Wordpress website and to learn more about networking. I have been playing around with the machine. I got to ...
0
votes
1answer
59 views

How come domain resolves to another IP?

I tried to ping http://crashsafari.com in my CMD: Right there, it resolves http://crashsafari.com to 54.231.48.170 which is http://s3-website-us-east-1.amazonaws.com. But, http://crashsafari.com ...
3
votes
2answers
162 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
5
votes
2answers
235 views

How can someone upload a PHP file to a server without an upload form?

I was entrusted with an existed website for which I should do some changes on the design part, but when I was about to access it, i've seen that it has been compromised. When I was searching for the ...
30
votes
1answer
3k views

Server attack with \x01

I notice from my server logs that there have been a number of requests like [01/Jun/2016:07:47:58 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\...
26
votes
3answers
5k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
1
vote
1answer
28 views

Finding the cipher suites supported by a web server [closed]

So I need to find the cipher suites supported by a website. Now I can use this NMap script however this problem is research oriented so I need to write a code in order to collect the data ...
3
votes
3answers
51 views

How secure are webservers from linux repos?

how secure are Webserver like Apache2 or Nginx on a current linux, e.g. Debian, when downloaded from a repo of this distro? Of course, they have to configured correct and must be up to date. If they ...
0
votes
0answers
46 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
0
votes
0answers
47 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
0
votes
1answer
48 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
0
votes
2answers
103 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
0
votes
0answers
51 views

Targeting a specific machine and known setup with Armitage / Metasploit?

Most introductions to armitage / metasploit start with searching for potential targets. But if you want to pen test your own setup then it probably makes more sense to target the specific machine and ...
0
votes
2answers
102 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
1
vote
2answers
82 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
9
votes
2answers
134 views

Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?

A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
0
votes
1answer
80 views

Passwords processed on server side? [duplicate]

So while I was working on my personal project something struk me. When somebody creates an account on any web service/social media they provide their desired username and password,this is then ...
1
vote
1answer
49 views

Securely opening an insecure webserver to a single phone

I have a webserver running inside my private network and not exposed to the internet. I'd like to securely talk to this webserver from my mobile phone over the internet. However, this webserver has ...
2
votes
3answers
105 views

Does a reverse proxy pass keep the backend server anonymous?

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2: upstream 123 { server 2.2.2.2; } server { listen 80 default_server; ...
3
votes
1answer
71 views

Is this information leakage dangerous?

After scanning my website with a automated tool I get this Is this dangerous, is it a vulnerability or not? If yes what can an attacker do, how to fix it?
1
vote
0answers
22 views

Information and Settings Collected from a PC Connected to a Web Server

1- What are the information and settings collected from my pc when I connect to a website server? 2- When I connect through a VPN, Could the website server detect a mismatch between my new location ...
5
votes
2answers
74 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
2
votes
0answers
60 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
0
votes
1answer
67 views

Simulate a lot of different IP's hitting a website

This may sound like launching a DDOS, but I am testing out GEO-IP location on my applications. I need to gather some data, to check how my graphs look when there is a lot of data. Are there any tools ...
8
votes
1answer
263 views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
0
votes
2answers
64 views

Is there a server/website specific malware scanner? [closed]

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools, and when it finds some malicious code on my servers(shared/dedicated), the ranking of those site drops. What I am ...
4
votes
1answer
96 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
3
votes
1answer
89 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
5
votes
2answers
139 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
3
votes
2answers
154 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
3
votes
1answer
49 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
3
votes
1answer
266 views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
46
votes
9answers
6k views

Hack-resistant hosting solution for non-profit?

(While the answers and comments at How do I deal with a compromised server? are useful, my question is more about prevention of hacking when I do not have total (or much) control over the server. I ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
5
votes
1answer
74 views

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? What issues may arise from this? Is there any benefit in doing ...
1
vote
3answers
151 views

Are there any problems with using CAMELLIA, IDEA and SEED based cipher suites on a web server in 2016?

I have recently seen CAMELLIA, SEED and IDEA cipher suites in use for HTTPS on a web server and am unsure what to suggest to the owner. The keys in use are all over 128 bits in length and standard ...
4
votes
4answers
188 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
0
votes
0answers
51 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
3
votes
1answer
246 views

Why is Norton Safe Web flagging my site as dangerous when it reports on PHP files/urls that don't exist?

I'm in a bit of a quandary over Norton Safe Web's rating of my company's website. My question is: is it possible for someone to fool Norton Safe Web into thinking that our website has PHP files which ...