A system whose primary function is to deliver web pages on request to clients.
4
votes
5answers
325 views
Is it dangerous to allow user to view a file directory via web browser?
I have a URL which displays all of the pdf files at a given dir by visiting the following site location :
http://www.mysite.com/allpdffiles/
Does this present any security vulnerabilities?
1
vote
4answers
187 views
Should i use SSL for local access?
I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip).
Should i use SSL for the communications between the sites and the service, or would that ...
18
votes
6answers
2k views
Why do DDoS attacks cost a fortune to stop?
I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions:
Is this because they try to keep the servers accessible to real site ...
1
vote
3answers
290 views
Is this approach of securing cookie secure?
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt)
Steps:
User logs in
Save user IP + randomstring in ...
1
vote
1answer
409 views
How to fix the audit failure in our web server
We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network.
Can anybody help me how to isolate and prevent this from happening?
An ...
16
votes
7answers
604 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
-1
votes
1answer
155 views
Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?
Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
3
votes
4answers
879 views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
113 views
Does site need SSL to resend info to a site that does use SSL?
Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
1
vote
4answers
1k views
Prevent Users from Downloading Javascript, Images
A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox.
So this made me think, can I implement a similar thing for my website as well?
...
8
votes
3answers
294 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
4
votes
2answers
455 views
Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?
Is it worth separating www-data and apache service from each other, in jails?
I currently have this setup:
Freebsd 9
1x Public ip (jails are in private ip's, nat'ed)
2 separate domains, managed by ...
3
votes
2answers
167 views
Securing a script to prevent database from being exposed
We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
2
votes
2answers
351 views
Advantages of separating Web server from Database
What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
3
votes
2answers
222 views
Would our company system be more secure using a VPN?
I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
0
votes
1answer
276 views
Securing firewalls for XAMPP on Mac OS X
I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer:
...
2
votes
1answer
914 views
Something causing Sonicwall to throw Smurf Amplification Attack Warning?
I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...
6
votes
2answers
595 views
How does IP tracking work?
Excuse the naive question (I'm more of a dev than a web-sec person)
In the past I've had webservers hacked and usually i've traced it to some random machines which seem to have been compromised (i ...
13
votes
3answers
852 views
How to keep a shared web hosting server secure?
What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user?
Edit: I am mainly thinking of securing the server from the users themselves and between ...
2
votes
2answers
321 views
I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?
The VPS is running CentOS and I have full access.
I only looked around using the cPanel installation and already disabled anonymous FTP access.
What other security risks are there with a default VPS ...
9
votes
4answers
778 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
1
vote
1answer
277 views
Where do I find more information about a given hacking attempt requests to my website?
Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this:
Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
-1
votes
2answers
1k views
How could the hacker tamper with the 'configuration.php' file in my Joomla web server?
I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so?
Note that the file has 777 permission. Also, ...
11
votes
5answers
2k views
Index page has been compromised, suspicious files are showing up
My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
1
vote
3answers
326 views
Danger of Path Traversal Attacks
I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him.
However, I want to understand what more can be done if ...
3
votes
2answers
205 views
Killing IP connections who “spam” with requests
How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
4
votes
3answers
1k views
When is it appropriate to SSL Encrypt Database connections?
Let's say I have a web server I setup, and then a database server.
However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right?
The only time to use ...
2
votes
2answers
652 views
How to check if a website is sending out a virus?
I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.
3 out of 6 people in the office have gotten ...
1
vote
4answers
201 views
Integrity monitoring for a LAMP server
So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial ...
19
votes
4answers
7k views
Why is passing the session id as url parameter insecure?
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
7
votes
3answers
4k views
Which webserver is more secure, Apache, nginx or lighttpd?
We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
2
votes
1answer
157 views
VPS Safety in the Cloud
Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
7
votes
3answers
339 views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
8
votes
4answers
2k views
IIS logs show someone is trying to hack my site, what should I do?
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: ...
1
vote
1answer
677 views
IIS password protected website
I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
3
votes
3answers
154 views
What security standards should be implemented in a simple web application
I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
4
votes
5answers
1k views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
2
votes
1answer
290 views
What attacks use enabled Apache's PATH_INFO?
In Tangled Web Michal Zalewski says:
If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature.
He gave only one example of this vulnerability. There ...
2
votes
3answers
207 views
Would people object my website just because I use Google Analytics, +1, or FB Connect?
Are there people who will refuse to use a website just because that site sends browser information to Google Analytics?
Could the +1 button be a red flag?
Should I expect that there would be ...
15
votes
3answers
609 views
What are the risks of using a CDN to speed up my website? How do I avoid them?
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
3
votes
2answers
442 views
Compromised server redirecting only requests from Google
I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away:
# host ...
5
votes
5answers
445 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
4
votes
3answers
345 views
Is there a good reason to turn off phpinfo()?
New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
8
votes
3answers
1k views
Installing Development Tools on Production Server? Security Risk?
I am using an Amazon Linux EC2 instance as a web server. My web app uses ImageMagick. Because the Amazon Linux (CentOS) repository doesn't include an up-to-date version of ImageMagick, I am compiling ...
8
votes
1answer
224 views
Is Chinese great firewall white or black list based? [closed]
Is a new website blocked by default in China ?
I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed).
However a friend of a ...
3
votes
2answers
242 views
Security for home server, wiki
I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
0
votes
0answers
31 views
Access Populated server [closed]
I don't know if this is the write forum to post this on... If it's not sorry to bother you!
I'm going to need to get into a server which can accept ~x users; however, ~2*x users will be trying to ...
0
votes
0answers
143 views
How to license my web application for schools? [closed]
I have a web application which I am interested in start selling it for schools, but, until now, I didn't find a proper solution for licensing it for schools.
Can some one please guide me for a ...
1
vote
2answers
134 views
What due diligence is required for HTTPModules that run within IIS?
I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it.
Since there has already been an exploit with a similar component produced by Microsoft, what ...
