A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

0
votes
1answer
80 views

Does the server administrator see what sites I visit

I have seen a lot of answers but here is the peculiarity of mine. In the office we all have a login to the WiFi, First with that login, if I use Tor will my visited sites still be logged by the ...
0
votes
1answer
157 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
2
votes
0answers
45 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
4
votes
1answer
62 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
29
votes
5answers
5k views

How do attackers find the IP addresses of recently deployed servers?

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
3
votes
3answers
202 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
0
votes
1answer
53 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
4
votes
3answers
3k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
4
votes
0answers
21 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
7
votes
3answers
1k views

Finding hidden page on webserver [duplicate]

I have a web server with 2 page: index.html and secret.php. The content of index.html is: <html><body><h1>It works!</h1></body></html> You can see the ...
3
votes
1answer
155 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
3answers
142 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
4
votes
0answers
98 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
1
vote
2answers
44 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
1
vote
1answer
75 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
2
votes
1answer
91 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
6
votes
3answers
720 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
11
votes
3answers
1k views

What security measures should be taken when running a Linux web server out of our office?

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
1
vote
4answers
553 views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
2
votes
2answers
46 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
2
votes
1answer
257 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
2
votes
2answers
615 views

Odd url showing up in my pubsub stream, should I be concerned?

Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
6
votes
2answers
158 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
3
votes
1answer
33 views

How to go about password hashing when constrained to low work factor

I'm developing a social website as a side-project and seeing if it actually goes anywhere. I'm using bcrypt right now to store passwords and unfortunately I'm only able to get my webserver to do a ...
2
votes
2answers
97 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
13
votes
3answers
2k views

Is “mini-httpd” a secure web server?

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd? Being a lesser known web server means that it's less likely ...
0
votes
0answers
25 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
4
votes
0answers
2k views

Apache vs Jetty with regard to Security [on hold]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
1
vote
2answers
50 views

ssh/scp from server to server — set permissions (no root)

I have access as a regular user (not as root) to two servers. Server A is accessible via ssh with a username and password, Server B can only be accessed using a keycard and pin. I need to set up a ...
5
votes
3answers
330 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
19
votes
1answer
3k views

The “.htaccess” file can be downloaded. Why? How to fix?

Maybe a noob question. I've tried searching but maybe my search terms were too specific. I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply ...
0
votes
1answer
86 views

The security of an unique URL parameter [duplicate]

Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like ...
3
votes
2answers
98 views

Custom http server security concerns

I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server ...
8
votes
1answer
238 views

How do I prevent users from modifying resources they do not own?

I am writing a server where I have an entity StoreOwner that "owns" or has a @OneToMany relationship to a Store entity (one store owner has 1 to N stores). Each Store has Offer and Item, each also ...
0
votes
2answers
958 views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
1answer
2k views

Weird request to NodeJS Webserver

So logging all the requests I get things like this: Mon Sep 07 2015 21:30:04 GMT+0200 (CEST) Received request for http://testp4.pospr.waw.pl/testproxy.php also for ...
1
vote
3answers
234 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
0
votes
2answers
195 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new ...
1
vote
2answers
90 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
3answers
173 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
1
vote
3answers
118 views

How to protect from DoS on get method?

Suppose I have a website and I want to make sure that a hacker isn't making my server down by utilising a DDOS attack on my website. I thought of getting IP address and revoking the access, but it ...
2
votes
2answers
79 views

Is it possible to safely watch a specific folder with virus scan on Windows Server?

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this. ...
1
vote
2answers
400 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
0
votes
1answer
212 views

Thousands of 404s from various search engines

Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed. I found a similar, but less detailed, ...
2
votes
3answers
333 views

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

I am working on a web application that would include some custom development and got a bit concerned about code theft. So the question I wanted to ask is whether it is - generally speaking - possible ...
1
vote
3answers
236 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
6
votes
1answer
562 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
3
votes
1answer
93 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...