A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

4
votes
3answers
80 views

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server? Whether it it be through htaccess setups, posting login ...
4
votes
4answers
104 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
1
vote
2answers
68 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
0
votes
1answer
54 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
0
votes
2answers
268 views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
0
votes
2answers
67 views

Is it possible to sabotage google bots? [closed]

Consider the following theoretical webserver: On any request, produce an html response that consists of 2 links, which are each randomly chosen strings followed by ".html". When the google bot ...
5
votes
3answers
1k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
0
votes
0answers
23 views

Why is it not advisable to have the database and web server on the same machine? [duplicate]

I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..). My hypothesis is that the cost of ...
23
votes
3answers
10k views

“Optimal” Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...
0
votes
1answer
186 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
0
votes
1answer
112 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
3answers
71 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
1answer
122 views

Is authentication through proxy sites safer?

usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
2
votes
2answers
221 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
4
votes
1answer
83 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
1
vote
2answers
309 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
1answer
79 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
0
votes
1answer
196 views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
1
vote
0answers
36 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
2
votes
1answer
433 views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
2
votes
1answer
134 views

What features boost security for a home edge router?

I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
1
vote
1answer
88 views

What is LFI vulnerability

LFI: Local file inclusion. After going through many tutorials I have two things I can/t figure out: checking the vulnerability: I don't understand what makes a website vulnerable or not. For ...
1
vote
1answer
203 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
4
votes
1answer
775 views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
2
votes
2answers
698 views

What is the ultimate goal of hacking a webserver? [closed]

Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
4
votes
2answers
5k views

Identify and disable weak cipher suites

i'm asking a question on a subject that is pure chinese to me..sorry in advance A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
1
vote
3answers
342 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
0
votes
1answer
57 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
1
vote
1answer
82 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
20
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
4
votes
1answer
171 views

Increased HEAD traffic to my website

In the last few weeks I have been getting an increased HEAD traffic to my website of the form HEAD / HTTP/1.0" 200 0 "-" "-" This just returns the details of my web server, right? The IPs are from ...
3
votes
2answers
394 views

Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?

Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
2
votes
1answer
551 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
7
votes
1answer
171 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
1
vote
2answers
402 views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
1
vote
1answer
120 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
-1
votes
1answer
110 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
0
votes
3answers
423 views

Can my customer's ISP trace who visited my business website?

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
0
votes
1answer
1k views

What methods are there of protecting a VPS from DDOS attacks? [duplicate]

I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
2
votes
1answer
3k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
1
vote
2answers
207 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
1
vote
1answer
475 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
3answers
151 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
2
votes
2answers
452 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
0
votes
1answer
255 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
0
votes
1answer
106 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
24
votes
3answers
4k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
5
votes
1answer
7k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
0
votes
1answer
64 views

How reliable is virtual hosting?

Web servers such as Apache and nginx support virtual hosting. To the users of websites on a shared server, they will not know that another websites exists on the same server. I have been wondering for ...
-1
votes
1answer
168 views

Location of server affects the speed of page loading? [closed]

i live in a country but i make a website for another country's users. The web hosting company has server in both of the countries. So where should i buy? Does it affects where the server is depending ...