A system whose primary function is to deliver web pages on request to clients.
0
votes
2answers
221 views
Weird IP addresses showing up on my server
I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
1
vote
1answer
97 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
2
votes
1answer
201 views
cookie issue with same domain same path but different port
I have two web app running on same host on same path but on different port
http://somedomain.com/
and
https://somedomain.com/
now when I visit first app it serves the cookie say with name abc, and ...
1
vote
2answers
143 views
Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server
We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server.
Here we have to work with facebook Payment API.
We need to secure enough our ...
3
votes
3answers
183 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
-6
votes
3answers
526 views
Why do people in CERN use mainly Python for their web pages? Does it have something to do with security of this language? [closed]
https://wwwold.e18.physik.tu-muenchen.de/mailman/listinfo/cern-excursion-2012
It's powered by python.
Does it mean that the smartest people in CERN thnik that Python is more secure than e.g. PHP or ...
2
votes
2answers
207 views
A security checklist for choosing an internet hosting service provider for a virtual private server?
I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of ...
4
votes
2answers
456 views
Test website for SSL 2.0
I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?
The website is still in development so not visible outside our ...
-2
votes
1answer
76 views
can vps be made as secure as having two dedicated server computers? [closed]
Which is a better option security wise :
1) cheaper option - vps (Iam assuming that if one particular virtual server is hacked,then still other virtual servers on that comp will be ...
0
votes
0answers
1k views
Open Source (Software Firewall + Unified Threat Management - UTM) for an Linux Dedicated Server Hosting [closed]
I am newbie in managing Linux Dedicated server. I am looking for Best Open source Unified Threat Management solution with Firewall Support and it should need to be managing through an web GUI ...
0
votes
1answer
283 views
Phishing attack stuck with jsp loginAction.do page? [closed]
I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
0
votes
1answer
105 views
Is it dangerous to serve executable cgi files in public folder?
In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
1
vote
2answers
418 views
Is it harmful to allow http requests with very long querystrings in IIS?
I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
6
votes
5answers
427 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
2answers
199 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
3
votes
2answers
308 views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
3
votes
2answers
209 views
Security concerns about my webapp
I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
360 views
How to counter or fix banner grabbing vulnerability
During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
239 views
Hide web.xml file from public view
I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config.
I don't how to restrict. I tried with ...
4
votes
2answers
139 views
Most secure response for a server to return to a user scanning for exploits
I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.
Currently these requests all return 404 because ...
2
votes
1answer
100 views
How to ensure web application remains secured after intrusion of server
My application employs asymmetric encryption / decryption, the process of how this work is detailed below:
Encryption - Server A
Data is encrypted using the public key of server B
Data is signed ...
3
votes
3answers
340 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
4
votes
1answer
984 views
Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?
I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
1
vote
3answers
1k views
Building a secure server with CentOs [duplicate]
Possible Duplicate:
Hardening Linux Server
I recently started to manage my own server with a cloud-based server. Recently I got hacked somehow and the server was used for phising. On the ...
0
votes
2answers
128 views
What are the go-to books on server security? [closed]
To learn how to keep things secured, and to do a good job at it, what books should one check out?
4
votes
1answer
333 views
Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server
We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a ...
0
votes
1answer
265 views
What security concerns exist in running a glassfish app directly on port 443
I have installed Apache http server in front of glassfish based on recommendations i had in this question.
I have been told that i will run into performance problems along with security issues. I was ...
1
vote
2answers
110 views
What was done to gain a list of home directory accounts?
Today some sites were defaced in our WHM/cpanel VPS.
I understand that the common cause of this is outdated scripts/plugins/etc.
However as I was checking the file manager of one of the accounts I saw ...
0
votes
1answer
238 views
Data Retention Laws for ISPs in North America
I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
1
vote
4answers
187 views
Should i use SSL for local access?
I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip).
Should i use SSL for the communications between the sites and the service, or would that ...
4
votes
5answers
324 views
Is it dangerous to allow user to view a file directory via web browser?
I have a URL which displays all of the pdf files at a given dir by visiting the following site location :
http://www.mysite.com/allpdffiles/
Does this present any security vulnerabilities?
8
votes
2answers
551 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
1
vote
1answer
409 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
1
vote
3answers
290 views
Is this approach of securing cookie secure?
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt)
Steps:
User logs in
Save user IP + randomstring in ...
2
votes
4answers
511 views
Spider Attack from several search engines at once
Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it.
While I have no reason to think any one person did this, it ...
-1
votes
1answer
155 views
Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?
Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
3
votes
4answers
876 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
8
votes
3answers
294 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
4
votes
2answers
452 views
Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?
Is it worth separating www-data and apache service from each other, in jails?
I currently have this setup:
Freebsd 9
1x Public ip (jails are in private ip's, nat'ed)
2 separate domains, managed by ...
3
votes
2answers
167 views
Securing a script to prevent database from being exposed
We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
2
votes
2answers
350 views
Advantages of separating Web server from Database
What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
3
votes
2answers
220 views
Would our company system be more secure using a VPN?
I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
11
votes
7answers
503 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
0
votes
1answer
275 views
Securing firewalls for XAMPP on Mac OS X
I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer:
...
2
votes
2answers
319 views
I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?
The VPS is running CentOS and I have full access.
I only looked around using the cPanel installation and already disabled anonymous FTP access.
What other security risks are there with a default VPS ...
6
votes
2answers
593 views
How does IP tracking work?
Excuse the naive question (I'm more of a dev than a web-sec person)
In the past I've had webservers hacked and usually i've traced it to some random machines which seem to have been compromised (i ...
1
vote
1answer
276 views
Where do I find more information about a given hacking attempt requests to my website?
Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
0
votes
2answers
2k views
Questionable request to /user/soapCaller.bs
My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error.
...
1
vote
3answers
326 views
Danger of Path Traversal Attacks
I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him.
However, I want to understand what more can be done if ...
6
votes
5answers
773 views
Malware code added when site viewed externally
Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
