A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

0
votes
1answer
201 views

Virtual private server security [closed]

I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
4
votes
3answers
97 views

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server? Whether it it be through htaccess setups, posting login ...
6
votes
3answers
344 views

Failed PCI-DSS Compliance | Submitting Evidence

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
3
votes
2answers
2k views

What kind of security injection are these traces of, SQL, javascript, or otherwise?

I've tried to secure all information going to the server to make sure there are no SQL injections. However there are new folders on my server with weird names. One of our online services is such that ...
4
votes
4answers
104 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
1
vote
1answer
86 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
2answers
71 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
0
votes
1answer
58 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
1
vote
1answer
216 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
0
votes
2answers
68 views

Is it possible to sabotage google bots? [closed]

Consider the following theoretical webserver: On any request, produce an html response that consists of 2 links, which are each randomly chosen strings followed by ".html". When the google bot ...
6
votes
3answers
1k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
0
votes
1answer
227 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
6
votes
3answers
2k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
0
votes
0answers
23 views

Why is it not advisable to have the database and web server on the same machine? [duplicate]

I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..). My hypothesis is that the cost of ...
1
vote
3answers
74 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
1answer
127 views

Is authentication through proxy sites safer?

usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
2
votes
2answers
370 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
4
votes
1answer
87 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
1
vote
2answers
430 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
0
votes
1answer
85 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
7
votes
5answers
1k views

Malware code added when site viewed externally

Please see second followup at the bottom! (Now with added real malicious code! ...ish) Prompted by this question, I've noticed that my university's student charity organisation has an interesting ...
12
votes
5answers
9k views

What is the best practice for placing DataBase servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
0
votes
1answer
298 views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
1
vote
0answers
40 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
1answer
113 views

What is LFI vulnerability

LFI: Local file inclusion. After going through many tutorials I have two things I can/t figure out: checking the vulnerability: I don't understand what makes a website vulnerable or not. For ...
4
votes
1answer
1k views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
2
votes
2answers
751 views

What is the ultimate goal of hacking a webserver? [closed]

Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
10
votes
5answers
9k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
6
votes
3answers
2k views

What's involved in taking over someone else's domain name?

I'm asking this for purely academic reasons. I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
4
votes
2answers
8k views

Identify and disable weak cipher suites

i'm asking a question on a subject that is pure chinese to me..sorry in advance A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
1
vote
3answers
417 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
0
votes
1answer
59 views

What security exposure (if any) can result from lots of apparently odd referrers in server log

I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one. 8 3 http://tiandeural.ru/ 19 ...
24
votes
5answers
18k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
4
votes
1answer
195 views

Increased HEAD traffic to my website

In the last few weeks I have been getting an increased HEAD traffic to my website of the form HEAD / HTTP/1.0" 200 0 "-" "-" This just returns the details of my web server, right? The IPs are from ...
7
votes
1answer
181 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
3
votes
2answers
503 views

Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?

Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
3
votes
1answer
716 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
1
vote
2answers
545 views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
-1
votes
1answer
118 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
20
votes
7answers
858 views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
1
vote
3answers
446 views

Can my customer's ISP trace who visited my business website?

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
0
votes
1answer
2k views

What methods are there of protecting a VPS from DDOS attacks? [duplicate]

I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
2
votes
1answer
5k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
1
vote
2answers
247 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
1
vote
1answer
585 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
2answers
528 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
7
votes
3answers
5k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
2
votes
3answers
158 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
0
votes
1answer
291 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
0
votes
1answer
107 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...