A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

1
vote
0answers
43 views

Does standard configuration in Tomcat pose any security risk?

I have a simple test website on Tomcat running on RaspberryPi. Pi is behind a router. Port forwarding is on and I can access the website from the Internet. What are the security risks of standard out ...
48
votes
2answers
7k views

What should end-users do about Heartbleed?

What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed. What should end-users of websites be doing? Do they need to ...
0
votes
1answer
68 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
111 views

How can this web server be compromised?

A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html. An interesting characteristic of ...
0
votes
0answers
81 views

Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos

Hello I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server. I wanna do this using Netsh advfirewall, In Linux I use IPTables: iptables -I INPUT -p tcp --dport ...
1
vote
1answer
106 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
-6
votes
1answer
134 views

How to avoid DDoS Attack [closed]

I buy my train ticket from our railway local web site. When ticket open for sale on web site then web site original traffic remain 50 (Just an example). Our railway web site is attacked by DDoS for ...
35
votes
4answers
9k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
5
votes
4answers
1k views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
1
vote
1answer
151 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
2
votes
1answer
106 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
1
vote
4answers
97 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
0
votes
0answers
40 views

Question regarding SSL / TLS / Certificates in general [duplicate]

for the last two days I played around a bit with nginx's SSL configuration. A question came up: I created asymmetric key using $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:4096 -keyout ...
0
votes
0answers
20 views

Is it a security risk to give read/write permissions to /Library/WebServer/Documents to my main account?

The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account ...
3
votes
2answers
141 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
0
votes
4answers
347 views

Masking IP address and port number for Web application [closed]

I have a Web application running on port 89 ( non-standard port) of a Windows 2012 R2 machine. The login page for this application needs to be accessible through a link on my website - let's call it ...
0
votes
2answers
177 views

Infected Drupal 6 website page with a php shell

I have a server with Drupal 6 which was hacked and now by accessing the main page i can see the php shell. The problem is that i could not find the shell. The site files are not infected because i ...
27
votes
2answers
3k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
1
vote
2answers
96 views

Segregating Offline Server and Internet Connection in one pc

What I want to do: Setup a PC with two routers. One router is directly connected to the internet, the other is connected to an offline workspace server. My client will be connected to both via a ...
4
votes
3answers
491 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
1
vote
1answer
247 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
0
votes
1answer
133 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
-1
votes
1answer
90 views
6
votes
4answers
1k views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
0
votes
3answers
146 views

Shellshocking Webservers, does anyone know of an attack-vector other than Headers?

i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be User-Agent Cookies Referer Custom-Headers does anyone know if ...
0
votes
1answer
586 views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS ...
19
votes
3answers
2k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
0
votes
2answers
416 views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
26
votes
3answers
2k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
2
votes
5answers
1k views

htaccess hacked

I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of attack? Update: I have no code/site live, only a coming ...
1
vote
2answers
502 views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
6
votes
2answers
1k views

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
0
votes
1answer
46 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
2
votes
1answer
94 views

securing /var/www with .htaccess

So I have a web directory running on a server and I want only people with the password to be able to get in. Is it possible to secure the web root with .htaccess? Is there any extra steps I need to ...
0
votes
1answer
348 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
2
votes
2answers
122 views

Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?

Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. ...
0
votes
2answers
219 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
1
vote
1answer
176 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
0
votes
1answer
382 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
0answers
159 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
2answers
131 views

How risky is having sensitive files on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
0
votes
1answer
79 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
0
votes
2answers
140 views

Attack surface for a site that hosts only static content HTML and images?

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
0
votes
1answer
68 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
7
votes
2answers
1k views

IIS IP Address Restriction - can I rely on it online?

I've been told that I might have more luck posting here than on Stack Exchange, so here goes: I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
1
vote
2answers
3k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
11
votes
5answers
10k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
2
votes
2answers
2k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
7
votes
4answers
297 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
0
votes
0answers
148 views

How to stop auto-created files to happen?

I'm new to "Information Security" so I hope I'm in the right place. I'm experimenting a very disapointing problem on my hosting server: some files are automaticaly created and I don't know how. The ...