A system whose primary function is to deliver web pages on request to clients.
3
votes
7answers
2k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
1
vote
2answers
174 views
HTTPS Certificate mismatch alert before redirection
Let's analyze the following situation:
A server is hosting 10 websites: site1.com - site10.com.
Only one of these websites uses SSL -site1.com.
If you try to access site2 - site10 over https the ...
2
votes
1answer
85 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
5
votes
1answer
208 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
0
votes
0answers
70 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
0
votes
2answers
193 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
11
votes
7answers
514 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
10
votes
4answers
670 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
2answers
89 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
2
votes
2answers
234 views
How can I trace Hacking attempt
First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
6
votes
5answers
883 views
Malware code added when site viewed externally
Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
1
vote
2answers
106 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
0
votes
2answers
2k views
Questionable request to /user/soapCaller.bs
My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error.
...
-5
votes
2answers
700 views
How can I spoof my IP address using the PHP curl function? [closed]
I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
3
votes
2answers
241 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
1
vote
3answers
268 views
Using Netcat to detect the webserver type
In order to know which server a site is running I can use netcat.
Through the following command I can gather information about the type of server installed.
netcat -vv www.example.com 80
But if ...
0
votes
3answers
126 views
How to retrieve a site whose server is running Linux
I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system.
Actually, I'd like to be able to test the following command:
nmap -O ...
3
votes
1answer
200 views
What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
Obvious things:
Disable root login (rather, don't enable it)
Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
IP Tables firewall whitelisting ...
5
votes
2answers
98 views
Is it actually feasible or useful to use a high number of proxy servers?
In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
0
votes
2answers
232 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
1answer
949 views
Ban MAC address from website? [duplicate]
Possible Duplicate:
Can I block based on Mac Address?
I have a situation where I need to ban a MAC address from accessing my webserver. (Windows Web Server 2008 R2). Is this possible?
P.S. ...
2
votes
1answer
237 views
cookie issue with same domain same path but different port
I have two web app running on same host on same path but on different port
http://somedomain.com/
and
https://somedomain.com/
now when I visit first app it serves the cookie say with name abc, and ...
6
votes
5answers
454 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
2answers
211 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
11
votes
2answers
325 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
14
votes
5answers
357 views
What is the best option for setting up a several sites supporting SSL on the same IP?
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
9
votes
2answers
191 views
What is the best way to verify the SSL configuration of my web server?
How do I ensure I have my SSL configuration setup securely?
1
vote
4answers
2k views
blocking direct access to files via url input while still allowing a script on server to access files
I am trying to accomplish the following and have been unsuccessful. I would appreciate any insight. Scenario: http://www.mydomain.com/filename.html is a webpage. On this webpage I am running a ...
1
vote
2answers
152 views
Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server
We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server.
Here we have to work with facebook Payment API.
We need to secure enough our ...
8
votes
2answers
627 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
4
votes
2answers
532 views
Test website for SSL 2.0
I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?
The website is still in development so not visible outside our ...
-6
votes
3answers
557 views
Why do people in CERN use mainly Python for their web pages? Does it have something to do with security of this language? [closed]
https://wwwold.e18.physik.tu-muenchen.de/mailman/listinfo/cern-excursion-2012
It's powered by python.
Does it mean that the smartest people in CERN thnik that Python is more secure than e.g. PHP or ...
5
votes
3answers
463 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
61
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
2
votes
2answers
213 views
A security checklist for choosing an internet hosting service provider for a virtual private server?
I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of ...
-2
votes
1answer
76 views
can vps be made as secure as having two dedicated server computers? [closed]
Which is a better option security wise :
1) cheaper option - vps (Iam assuming that if one particular virtual server is hacked,then still other virtual servers on that comp will be ...
0
votes
0answers
1k views
Open Source (Software Firewall + Unified Threat Management - UTM) for an Linux Dedicated Server Hosting [closed]
I am newbie in managing Linux Dedicated server. I am looking for Best Open source Unified Threat Management solution with Firewall Support and it should need to be managing through an web GUI ...
0
votes
1answer
301 views
Phishing attack stuck with jsp loginAction.do page? [closed]
I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
0
votes
1answer
112 views
Is it dangerous to serve executable cgi files in public folder?
In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
1
vote
2answers
491 views
Is it harmful to allow http requests with very long querystrings in IIS?
I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
4
votes
1answer
2k views
How to convert IBM Domino SSL keys (private key) to the OpenSSL format?
I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL?
Basically I need to upload this key to ...
3
votes
2answers
669 views
Code Injection detection on Web Servers
Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
3
votes
2answers
342 views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
7
votes
4answers
2k views
Protecting against DOS attacks
Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
3
votes
2answers
220 views
Security concerns about my webapp
I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
378 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
256 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
