A system whose primary function is to deliver web pages on request to clients.
7
votes
2answers
89 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
2
votes
2answers
234 views
How can I trace Hacking attempt
First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
1
vote
2answers
106 views
How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)
I have a newer private key I have to import into an older server.
How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
-5
votes
2answers
706 views
How can I spoof my IP address using the PHP curl function? [closed]
I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
1
vote
3answers
270 views
Using Netcat to detect the webserver type
In order to know which server a site is running I can use netcat.
Through the following command I can gather information about the type of server installed.
netcat -vv www.example.com 80
But if ...
3
votes
2answers
242 views
Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password
I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects.
I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
1
vote
1answer
93 views
Mitigation Strategies for Response Spliting Attack
I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
0
votes
3answers
126 views
How to retrieve a site whose server is running Linux
I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system.
Actually, I'd like to be able to test the following command:
nmap -O ...
0
votes
2answers
193 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
3
votes
1answer
200 views
What are some steps to take for securing a Linux server that aren't in this list of obvious ones?
Obvious things:
Disable root login (rather, don't enable it)
Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.)
IP Tables firewall whitelisting ...
5
votes
2answers
98 views
Is it actually feasible or useful to use a high number of proxy servers?
In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
0
votes
2answers
232 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
1
vote
1answer
100 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
2
votes
1answer
238 views
cookie issue with same domain same path but different port
I have two web app running on same host on same path but on different port
http://somedomain.com/
and
https://somedomain.com/
now when I visit first app it serves the cookie say with name abc, and ...
1
vote
2answers
152 views
Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server
We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server.
Here we have to work with facebook Payment API.
We need to secure enough our ...
3
votes
3answers
186 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
-6
votes
3answers
557 views
Why do people in CERN use mainly Python for their web pages? Does it have something to do with security of this language? [closed]
https://wwwold.e18.physik.tu-muenchen.de/mailman/listinfo/cern-excursion-2012
It's powered by python.
Does it mean that the smartest people in CERN thnik that Python is more secure than e.g. PHP or ...
2
votes
2answers
213 views
A security checklist for choosing an internet hosting service provider for a virtual private server?
I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of ...
4
votes
2answers
532 views
Test website for SSL 2.0
I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?
The website is still in development so not visible outside our ...
-2
votes
1answer
76 views
can vps be made as secure as having two dedicated server computers? [closed]
Which is a better option security wise :
1) cheaper option - vps (Iam assuming that if one particular virtual server is hacked,then still other virtual servers on that comp will be ...
0
votes
0answers
1k views
Open Source (Software Firewall + Unified Threat Management - UTM) for an Linux Dedicated Server Hosting [closed]
I am newbie in managing Linux Dedicated server. I am looking for Best Open source Unified Threat Management solution with Firewall Support and it should need to be managing through an web GUI ...
0
votes
1answer
301 views
Phishing attack stuck with jsp loginAction.do page? [closed]
I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
0
votes
1answer
112 views
Is it dangerous to serve executable cgi files in public folder?
In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
1
vote
2answers
494 views
Is it harmful to allow http requests with very long querystrings in IIS?
I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
6
votes
5answers
455 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
2answers
212 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
3
votes
2answers
342 views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
3
votes
2answers
220 views
Security concerns about my webapp
I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
379 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
257 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
4
votes
2answers
141 views
Most secure response for a server to return to a user scanning for exploits
I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.
Currently these requests all return 404 because ...
2
votes
1answer
100 views
How to ensure web application remains secured after intrusion of server
My application employs asymmetric encryption / decryption, the process of how this work is detailed below:
Encryption - Server A
Data is encrypted using the public key of server B
Data is signed ...
3
votes
3answers
360 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
5
votes
1answer
1k views
Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?
I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
1
vote
3answers
2k views
Building a secure server with CentOs [duplicate]
Possible Duplicate:
Hardening Linux Server
I recently started to manage my own server with a cloud-based server. Recently I got hacked somehow and the server was used for phising. On the ...
0
votes
2answers
138 views
What are the go-to books on server security? [closed]
To learn how to keep things secured, and to do a good job at it, what books should one check out?
4
votes
1answer
335 views
Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server
We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a ...
0
votes
1answer
281 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
1
vote
2answers
110 views
What was done to gain a list of home directory accounts?
Today some sites were defaced in our WHM/cpanel VPS.
I understand that the common cause of this is outdated scripts/plugins/etc.
However as I was checking the file manager of one of the accounts I saw ...
0
votes
1answer
268 views
Data Retention Laws for ISPs in North America
I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
1
vote
4answers
191 views
Should i use SSL for local access?
I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip).
Should i use SSL for the communications between the sites and the service, or would that ...
4
votes
5answers
364 views
Is it dangerous to allow user to view a file directory via web browser?
I have a URL which displays all of the pdf files at a given dir by visiting the following site location :
http://www.mysite.com/allpdffiles/
Does this present any security vulnerabilities?
8
votes
2answers
627 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
1
vote
1answer
420 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
1
vote
3answers
307 views
Is this approach of securing cookie secure?
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt)
Steps:
User logs in
Save user IP + randomstring in ...
2
votes
4answers
566 views
Spider Attack from several search engines at once
Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it.
While I have no reason to think any one person did this, it ...
-1
votes
1answer
157 views
Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?
Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
3
votes
4answers
962 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
8
votes
3answers
296 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
4
votes
2answers
484 views
Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?
Is it worth separating www-data and apache service from each other, in jails?
I currently have this setup:
Freebsd 9
1x Public ip (jails are in private ip's, nat'ed)
2 separate domains, managed by ...
