A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

28
votes
4answers
4k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
1
vote
3answers
64 views

Is it good practice to let Node/Go/… act as a frontend webserver?

I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
1
vote
0answers
37 views

Vega Scanner Took Website offline? [closed]

I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
1
vote
1answer
38 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
10
votes
4answers
1k views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
1
vote
1answer
80 views

Best practice for https Private Key Generation

I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
4
votes
3answers
182 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
3
votes
1answer
61 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
0answers
74 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
1
vote
2answers
1k views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
3
votes
1answer
189 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
0
votes
2answers
192 views

Google Analytics: Hacked or Ghost Referers?

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior. I've got a web application ...
-1
votes
3answers
196 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
2
votes
0answers
88 views

Securing elasticsearch behind a reverse proxy

I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on 127.0.0.1 only. I ...
0
votes
3answers
957 views

htaccess - protect php file execution in specific directory

How can I protect php execution in specific upload directory? Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers. So how can I ...
0
votes
1answer
47 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by ...
2
votes
1answer
422 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
1
vote
4answers
240 views

untangle server at work place privacy

When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example: Skype chat messages Personal emails (Gmail, Yahoo)
1
vote
1answer
93 views

How do I know if root account has been compromised?

My server was hacked with some files being overwritten to generate spam links on the index page. All my previous backups contain the same modified files, making the nuking from orbit option a puke. If ...
0
votes
1answer
87 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
0
votes
1answer
54 views

How secure is internal data on the internet with IP authentication?

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
2
votes
2answers
135 views

If I set up a home web server, will computers that use my wi-fi be vulnerable?

I'm interested in setting up a web server on an old laptop L1. My plan is to connect that laptop to an Ethernet port on my router. I also have another laptop L2 accessing the router via wi-fi. L2 ...
1
vote
1answer
71 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
2
votes
3answers
810 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
4
votes
3answers
1k views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
3
votes
2answers
217 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
18
votes
4answers
2k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
0
votes
2answers
56 views

Unpublished server

Is it possible to setup my web server such that only certain sources can access and the public from internet has no access? i am thinking that we could just not publish our web server URL/IP to our ...
10
votes
4answers
14k views

Identify and disable weak cipher suites

i'm asking a question on a subject that is pure chinese to me..sorry in advance A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
2
votes
1answer
44 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
4
votes
2answers
392 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
0
votes
1answer
70 views

Have i been phished? [closed]

I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
1
vote
1answer
62 views

How safe are networking ACLs based on IP-address?

As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request. Therefore, I cannot see how an Access Control List (such as ...
1
vote
2answers
172 views

Security of php code on webserver - obfuscate?

Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft? I think my question boils down to 'Is there a ...
0
votes
2answers
269 views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
1
vote
2answers
121 views

Path traversal exploit

I have an Apache server which seems to be vulnerable to Path traversal, because when I test This url : http://localhost/ati/../test.txt it will be changed to the this: http://localhost/test.txt and ...
17
votes
5answers
3k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
2
votes
1answer
69 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
0
votes
2answers
86 views

Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
2answers
268 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
4
votes
4answers
122 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
15
votes
5answers
571 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
2
votes
1answer
51 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
2
votes
4answers
81 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
1
vote
3answers
170 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
-6
votes
2answers
76 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
3
votes
2answers
191 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
2
votes
2answers
3k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
8
votes
3answers
161 views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
2
votes
1answer
81 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...