A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

1
vote
1answer
79 views

Recognizing malicious URL attempts against your website

On serveral websites I've run, I periodically see URLs run against my servers that look like this: /url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........ Does anyone recognize it? I've tried to ...
8
votes
3answers
6k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
2
votes
1answer
273 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
0
votes
2answers
385 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
1
vote
2answers
261 views

Statistics of attacks on unhardened Web Server

Suppose my web server is on the public internet. It's not behind firewall hardware. It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
8
votes
4answers
4k views

What are the disadvantages of Tor?

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits. What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
-2
votes
2answers
193 views

Automatic robot crawler to check web pages authenticity?

Our servers seem to be commonly hacked, mostly injecting malicious codes/frames to our web pages or changing downloadable files with backdoors and so on. Is there any tool that can crawl our website ...
0
votes
3answers
186 views

Odd Server Logs

I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault). ...
3
votes
2answers
126 views

How could this file have been modified?

I was recently asked to help make a few modifications to an old ASP Classic website. At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
3
votes
2answers
871 views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and ...
13
votes
2answers
928 views

How to not reveal that you are using PHP?

I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
0
votes
3answers
158 views

If my server was compromised, is my database safe?

I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
-5
votes
2answers
468 views

PHP injection on 777 file [closed]

Some one has modified a PHP file, which had permissions set to 777, on my VPS server. How can someone do that without administrative access to the server? What information I can give you? I know ...
4
votes
3answers
4k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
-1
votes
1answer
155 views

setting up website for logged in users, anyone, and files no one should see (via the web) [closed]

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
0
votes
2answers
313 views

Is there an easy way to secure Apache on debian?

I run an Apache webserver with lots of PHP-sites of several customers. I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: ...
2
votes
1answer
767 views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
2
votes
3answers
2k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
1
vote
2answers
1k views

HTTPS Certificate mismatch alert before redirection

Let's analyze the following situation: A server is hosting 10 websites: site1.com - site10.com. Only one of these websites uses SSL -site1.com. If you try to access site2 - site10 over https the ...
2
votes
1answer
95 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
8
votes
1answer
2k views

How should I store SSL keys on the server?

I have a Node.JS HTTPS webserver instantiated as follows: var privateKey = fs.readFileSync('./../ssl/localhost.key').toString(); var certificate = ...
10
votes
4answers
4k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
2answers
207 views

Can other customers on shared hosting see requests from/to my site?

I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account. The wiki ...
2
votes
2answers
387 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
1
vote
2answers
291 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
-6
votes
2answers
4k views

How can I spoof my IP address using the PHP curl function? [closed]

I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
1
vote
3answers
2k views

Using Netcat to detect the webserver type

In order to know which server a site is running I can use netcat. Through the following command I can gather information about the type of server installed. netcat -vv www.example.com 80 But if ...
3
votes
2answers
770 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
1answer
296 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
0
votes
3answers
161 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
0
votes
2answers
283 views

How to restrict web access to certain countries

What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
3
votes
1answer
320 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
5
votes
2answers
108 views

Is it actually feasible or useful to use a high number of proxy servers?

In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
0
votes
2answers
711 views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
1
vote
1answer
145 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
2
votes
1answer
1k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
1
vote
2answers
239 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
3
votes
3answers
202 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
2
votes
2answers
401 views

A security checklist for choosing an internet hosting service provider for a virtual private server?

I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of ...
4
votes
2answers
3k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
-2
votes
1answer
109 views

can vps be made as secure as having two dedicated server computers? [closed]

Which is a better option security wise : 1) cheaper option - vps (Iam assuming that if one particular virtual server is hacked,then still other virtual servers on that comp will be ...
0
votes
1answer
528 views

Phishing attack stuck with jsp loginAction.do page? [closed]

I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
0
votes
1answer
299 views

Is it dangerous to serve executable cgi files in public folder?

In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
2
votes
2answers
1k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
7
votes
5answers
894 views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
6
votes
2answers
401 views

Where to put private files on a shared web server

I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
4
votes
2answers
966 views

How helpful is rkhunter?

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website. With these things already in place, do ...
3
votes
2answers
377 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
916 views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
686 views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...