A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

3
votes
1answer
33 views

How to go about password hashing when constrained to low work factor

I'm developing a social website as a side-project and seeing if it actually goes anywhere. I'm using bcrypt right now to store passwords and unfortunately I'm only able to get my webserver to do a ...
2
votes
2answers
97 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
0
votes
0answers
24 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
14
votes
4answers
14k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
4
votes
0answers
2k views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
5
votes
3answers
327 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
1
vote
2answers
50 views

ssh/scp from server to server — set permissions (no root)

I have access as a regular user (not as root) to two servers. Server A is accessible via ssh with a username and password, Server B can only be accessed using a keycard and pin. I need to set up a ...
19
votes
1answer
3k views

The “.htaccess” file can be downloaded. Why? How to fix?

Maybe a noob question. I've tried searching but maybe my search terms were too specific. I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply ...
0
votes
1answer
86 views

The security of an unique URL parameter [duplicate]

Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like ...
8
votes
1answer
236 views

How do I prevent users from modifying resources they do not own?

I am writing a server where I have an entity StoreOwner that "owns" or has a @OneToMany relationship to a Store entity (one store owner has 1 to N stores). Each Store has Offer and Item, each also ...
1
vote
2answers
88 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
3
votes
2answers
98 views

Custom http server security concerns

I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server ...
14
votes
2answers
7k views

How should I store SSL keys on the server?

I have a Node.JS HTTPS webserver instantiated as follows: var privateKey = fs.readFileSync('./../ssl/localhost.key').toString(); var certificate = ...
0
votes
2answers
942 views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
2answers
195 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new ...
0
votes
1answer
2k views

Weird request to NodeJS Webserver

So logging all the requests I get things like this: Mon Sep 07 2015 21:30:04 GMT+0200 (CEST) Received request for http://testp4.pospr.waw.pl/testproxy.php also for ...
1
vote
3answers
232 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
3answers
172 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
1
vote
3answers
118 views

How to protect from DoS on get method?

Suppose I have a website and I want to make sure that a hacker isn't making my server down by utilising a DDOS attack on my website. I thought of getting IP address and revoking the access, but it ...
2
votes
2answers
79 views

Is it possible to safely watch a specific folder with virus scan on Windows Server?

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this. ...
1
vote
2answers
394 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
0
votes
1answer
212 views

Thousands of 404s from various search engines

Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed. I found a similar, but less detailed, ...
8
votes
3answers
12k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
1
vote
3answers
235 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
2
votes
1answer
4k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
6
votes
1answer
562 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
3
votes
1answer
93 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...
5
votes
2answers
109 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
93
votes
11answers
24k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
0
votes
1answer
105 views

What to do when one's server is being scanned very agressively

I can see that my application, which is on several virtual instances, is being scanned; I guess the attackers are in "recon mode." What I know: I understand that we can block dirbuster, and other ...
8
votes
3answers
1k views

Someone registered a domain name with the IP of my VPS [duplicate]

I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line : 192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" ...
9
votes
5answers
6k views

Webserver logs show someone is trying to hack my site, what should I do?

It looks like someone is trying to hack my site. The following comes from my IIS log files: #Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2011-07-03 00:02:39 #Fields: ...
1
vote
2answers
114 views

Checksum Calculation for Source Code tar balls downloads

Http sites like OpenSSL provide checksum for each source code tarball available for download HTTPS sites like GitHub usually do not provide checksum with 'download zip' option. Some sites although ...
-2
votes
3answers
88 views

What security problems are there with enabling directory listing on my webserver? [duplicate]

I want to to ensure that every file on my webserver is secured. The problems I am having right now: If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in ...
1
vote
2answers
83 views

Website Visited by Unresolved Ip

My Website is flooded with unknown visiters Awstats says that my website getting thousands of hits in few seconds. I am using robots.txt and .htaccess, but the problem stays there. Please help me ...
5
votes
2answers
302 views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
2
votes
1answer
1k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
1
vote
1answer
653 views

Security issues for host system when running a home web server on a VM

I want to run a web server at home (really for the fun and learning of web/network and other security best practices), running a web app that I plan to write with Ruby on Rails and be able to access ...
12
votes
4answers
4k views

Would making an IIS web server appear to be running Apache instead improve security?

As you can see from the tag, I know that security by obscurity is not true security. So consider a server available to the Internet on port 443 (SSL) of a fixed IP address in the dialup range of a ...
1
vote
5answers
87 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
1
vote
0answers
73 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
-6
votes
1answer
87 views

Is this an attack [closed]

Original site: ---topbargains-com-au A fake replica: --topbargain-org How dangerous is this? Have they copied the whole database? Edit: Removed the URLs to satisfy a spam allegation Edit: The fake ...
3
votes
1answer
180 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
1
vote
1answer
106 views

Receiving random numbers in GET request query string. Exploit?

I recently spun up a web server and have been receiving hits where the client appends a random number, for example "12345" as a query string to the root (/) endpoint. Here's an example log entry: ...
4
votes
2answers
7k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
2
votes
1answer
60 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...