A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
3answers
375 views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
2
votes
1answer
293 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
15
votes
4answers
11k views

Does a webserver need an antivirus software installed?

In what cases does a webserver need an antivirus software installed? When it is not required? If it is required sometimes, what should be considered when choosing the right one to install? (In my ...
2
votes
2answers
643 views

Odd url showing up in my pubsub stream, should I be concerned?

Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
13
votes
3answers
2k views

Is “mini-httpd” a secure web server?

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd? Being a lesser known web server means that it's less likely ...
3
votes
1answer
35 views

How to go about password hashing when constrained to low work factor

I'm developing a social website as a side-project and seeing if it actually goes anywhere. I'm using bcrypt right now to store passwords and unfortunately I'm only able to get my webserver to do a ...
2
votes
2answers
110 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
0
votes
0answers
27 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
14
votes
4answers
14k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
4
votes
0answers
3k views

Apache vs Jetty with regard to Security [closed]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
5
votes
3answers
355 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
1
vote
2answers
51 views

ssh/scp from server to server — set permissions (no root)

I have access as a regular user (not as root) to two servers. Server A is accessible via ssh with a username and password, Server B can only be accessed using a keycard and pin. I need to set up a ...
19
votes
1answer
3k views

The “.htaccess” file can be downloaded. Why? How to fix?

Maybe a noob question. I've tried searching but maybe my search terms were too specific. I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply ...
0
votes
1answer
88 views

The security of an unique URL parameter [duplicate]

Take for example a simple messaging system. Users can send each other personal messages. When reading a personal message sent to you, the URL would be something like ...
8
votes
1answer
250 views

How do I prevent users from modifying resources they do not own?

I am writing a server where I have an entity StoreOwner that "owns" or has a @OneToMany relationship to a Store entity (one store owner has 1 to N stores). Each Store has Offer and Item, each also ...
1
vote
2answers
94 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
3
votes
2answers
101 views

Custom http server security concerns

I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server ...
14
votes
2answers
7k views

How should I store SSL keys on the server?

I have a Node.JS HTTPS webserver instantiated as follows: var privateKey = fs.readFileSync('./../ssl/localhost.key').toString(); var certificate = ...
0
votes
2answers
1k views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
0
votes
2answers
198 views

What are the vulnerablities for revealing IP addresses in code

One of my developers left the IP inside his code : The code is as follows : [WebMethod] public string UploadFile(byte[] f, string fileName) { try { MemoryStream ms = new ...
0
votes
1answer
2k views

Weird request to NodeJS Webserver

So logging all the requests I get things like this: Mon Sep 07 2015 21:30:04 GMT+0200 (CEST) Received request for http://testp4.pospr.waw.pl/testproxy.php also for ...
1
vote
3answers
241 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
3answers
192 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
1
vote
3answers
120 views

How to protect from DoS on get method?

Suppose I have a website and I want to make sure that a hacker isn't making my server down by utilising a DDOS attack on my website. I thought of getting IP address and revoking the access, but it ...
2
votes
2answers
82 views

Is it possible to safely watch a specific folder with virus scan on Windows Server?

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this. ...
1
vote
2answers
471 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
0
votes
1answer
213 views

Thousands of 404s from various search engines

Since early April of 2015, my web site has been getting thousands of requests from many search engines for URLs that don't exist and never have existed. I found a similar, but less detailed, ...
8
votes
3answers
12k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
1
vote
3answers
263 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
2
votes
1answer
4k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
6
votes
1answer
566 views

Point several HTTPS domains to the same web server

We are currently running a SaaS over HTTPS(abc.net) and one of our clients(xyz.com) wants to do some custom branding. The client xyz.com will have their own subdomain xyz.abc.net which looks like its ...
3
votes
1answer
95 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...
5
votes
2answers
111 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
0
votes
1answer
107 views

What to do when one's server is being scanned very agressively

I can see that my application, which is on several virtual instances, is being scanned; I guess the attackers are in "recon mode." What I know: I understand that we can block dirbuster, and other ...
8
votes
3answers
1k views

Someone registered a domain name with the IP of my VPS [duplicate]

I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line : 192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" ...
9
votes
5answers
6k views

Webserver logs show someone is trying to hack my site, what should I do?

It looks like someone is trying to hack my site. The following comes from my IIS log files: #Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2011-07-03 00:02:39 #Fields: ...
1
vote
2answers
116 views

Checksum Calculation for Source Code tar balls downloads

Http sites like OpenSSL provide checksum for each source code tarball available for download HTTPS sites like GitHub usually do not provide checksum with 'download zip' option. Some sites although ...
-2
votes
3answers
88 views

What security problems are there with enabling directory listing on my webserver? [duplicate]

I want to to ensure that every file on my webserver is secured. The problems I am having right now: If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in ...
1
vote
2answers
84 views

Website Visited by Unresolved Ip

My Website is flooded with unknown visiters Awstats says that my website getting thousands of hits in few seconds. I am using robots.txt and .htaccess, but the problem stays there. Please help me ...
5
votes
2answers
320 views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
8
votes
2answers
5k views

Do these regex show that I was hacked?

What do these regex commands mean? I found them when I ran the history command: grep --include=\*.php -rnw . -e "update.creditcard" grep --include=\*.php -rnw . -e "e41e" grep --include=\*.php -rnw . ...
2
votes
1answer
1k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
1
vote
1answer
689 views

Security issues for host system when running a home web server on a VM

I want to run a web server at home (really for the fun and learning of web/network and other security best practices), running a web app that I plan to write with Ruby on Rails and be able to access ...
12
votes
4answers
4k views

Would making an IIS web server appear to be running Apache instead improve security?

As you can see from the tag, I know that security by obscurity is not true security. So consider a server available to the Internet on port 443 (SSL) of a fixed IP address in the dialup range of a ...
1
vote
5answers
88 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
1
vote
0answers
78 views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
-6
votes
1answer
91 views

Is this an attack [closed]

Original site: ---topbargains-com-au A fake replica: --topbargain-org How dangerous is this? Have they copied the whole database? Edit: Removed the URLs to satisfy a spam allegation Edit: The fake ...