A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
-6
votes
1answer
91 views

Is this an attack [closed]

Original site: ---topbargains-com-au A fake replica: --topbargain-org How dangerous is this? Have they copied the whole database? Edit: Removed the URLs to satisfy a spam allegation Edit: The fake ...
3
votes
1answer
185 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
1
vote
1answer
111 views

Receiving random numbers in GET request query string. Exploit?

I recently spun up a web server and have been receiving hits where the client appends a random number, for example "12345" as a query string to the root (/) endpoint. Here's an example log entry: ...
4
votes
2answers
7k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
2
votes
1answer
61 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
1
vote
2answers
180 views

Server compromised with magento vulnerability, possible rootkit

I am experiencing a security issue with one server that it happens that I manage. I will try to cite all relevant facts as briefly as possible. I am asking for any additional information and course of ...
3
votes
1answer
125 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
6
votes
1answer
1k views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
-3
votes
1answer
807 views

insecure HTTP Methods Enabled — how to control? [closed]

Here I am new to insecure HTTP Methods Enabled. The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE Software used: ...
2
votes
2answers
249 views

Did this ShellShock exploit work?

Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time ...
1
vote
0answers
72 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
-1
votes
2answers
173 views

webshell on webserver, but what does it contain/do? [closed]

Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely. This is the part where I am missing some information: md5($_POST['_f__f']) Does ...
3
votes
3answers
677 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
1
vote
1answer
347 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
1
vote
4answers
459 views

Malware script uploaded - CPU has been maxed out

I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server. The file it was calling ...
15
votes
5answers
3k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
4
votes
3answers
3k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
4
votes
2answers
187 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
2
votes
1answer
523 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
0
votes
1answer
337 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
1
vote
2answers
191 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
12
votes
6answers
5k views

Index page has been compromised, suspicious files are showing up

My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
68
votes
4answers
65k views

“Optimal” Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...
1
vote
1answer
246 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
13
votes
4answers
750 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
1
vote
1answer
46 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
-1
votes
1answer
524 views

How to test if my server is secure? [closed]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
0
votes
1answer
116 views

Are DLLs in URLs executed on users local machine or on the remove machine?

In this question I am referring to DLLs listed in URLs such as this one: http://survey1.sendyouropinions.com/mrIWeb/mrIWeb.dll When this kind of URL is navigated to, is the code in the DLL executed ...
0
votes
1answer
42 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
1
vote
1answer
280 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
0
votes
1answer
175 views

“Transferring” SSL certificate to another person [closed]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
1answer
122 views

HttpOnly at logout page [closed]

Firstly, my website can't be accessed without a session established. After a session is established then the server would set cookies. However, if i assess the website without a session, my site will ...
7
votes
1answer
265 views

Secure HTTP headers

In this article, the example shows ... HttpOnly;Secure However, a check on my server response show ... Secure;HttpOnly This may be a stupid question but, does the order matter? thanks
1
vote
1answer
45 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
2
votes
1answer
101 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
2
votes
2answers
75 views

Using a special user to manage web server? [closed]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
3
votes
1answer
132 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
0
votes
1answer
70 views

System backup in case of attack?

My system will be running for a well known insurance company within the UK, it will hold and process a lot of information for claims, brakdowns etc etc. I am worried that the company and the site as ...
8
votes
2answers
4k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
1
vote
1answer
114 views

How to find out if content on my XAMPP server has been altered

During the development of a site, me and the team decided to develop the site with my computer as a server, with me making my localhost available from outside. I have been using several settings to ...
2
votes
1answer
1k views

Worrying httpd access logs [duplicate]

so after setting up a new server with just ssh (public key only) and a webserver which just serves one index.html I left for the weekend. Logging in on Monday I see this type of thing in my httpd ...
2
votes
1answer
57 views

Secure the config file of a service

I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would ...
2
votes
1answer
223 views

Whitelist for HTTP request

Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
29
votes
4answers
38k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET ...
12
votes
9answers
4k views

Can an old operating system webserver be made secure?

I have an old laptop with far too little RAM to run Linux (including specialty distributions). It can however run Windows 98 just fine, and I'm looking into turning it into a tiny retro webserver. Is ...
0
votes
1answer
389 views

How does a reverse proxy change the security posture of a web server residing in the DMZ? [closed]

How does the reverse proxy change internal and external security posture with a reverse proxy compared to not having a reverse proxy? For example, you have a publicly accessible iis server, what is ...
4
votes
1answer
235 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
2
votes
3answers
170 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
0
votes
2answers
276 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...