A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

4
votes
2answers
1k views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
4
votes
3answers
227 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
4
votes
1answer
544 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
4
votes
3answers
523 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
2answers
233 views

Most secure response for a server to return to a user scanning for exploits

I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc. Currently these requests all return 404 because ...
4
votes
2answers
1k views

Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?

Is it worth separating www-data and apache service from each other, in jails? I currently have this setup: Freebsd 9 1x Public ip (jails are in private ip's, nat'ed) 2 separate domains, managed by ...
4
votes
3answers
617 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
4
votes
3answers
1k views

Reverse Proxy Secure Configuration

I have a Forefront TMG 2010 acting as a reverse proxy: I can force HTTP*S* between internet clients and TMG. I can force HTTP*S* between TMG and my web servers. From a security point of view, it ...
4
votes
1answer
150 views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
4
votes
2answers
989 views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
4answers
130 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
4
votes
1answer
481 views

Increased HEAD traffic to my website

In the last few weeks I have been getting an increased HEAD traffic to my website of the form HEAD / HTTP/1.0" 200 0 "-" "-" This just returns the details of my web server, right? The IPs are from ...
4
votes
1answer
680 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...
4
votes
1answer
668 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
4
votes
1answer
112 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
4
votes
1answer
201 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
4
votes
1answer
888 views

VPS Safety in the Cloud

Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
4
votes
2answers
498 views

How to improve VPS security?

I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
4
votes
1answer
48 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
4
votes
2answers
6k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
4
votes
1answer
129 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
4
votes
2answers
882 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
4
votes
3answers
88 views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
4
votes
0answers
20 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
4
votes
2answers
174 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
3
votes
2answers
1k views

Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?

Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
3
votes
3answers
476 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
3
votes
4answers
2k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
3
votes
3answers
4k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
3
votes
3answers
1k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
3
votes
2answers
423 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
3
votes
1answer
520 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: ...
3
votes
1answer
2k views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
3
votes
4answers
4k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
3
votes
3answers
73 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
3
votes
3answers
152 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
3
votes
2answers
4k views

What kind of security injection are these traces of, SQL, javascript, or otherwise?

I've tried to secure all information going to the server to make sure there are no SQL injections. However there are new folders on my server with weird names. One of our online services is such that ...
3
votes
1answer
166 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
3
votes
3answers
345 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
3
votes
2answers
189 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
3
votes
3answers
3k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
3
votes
2answers
92 views

Custom http server security concerns

I am using a framework called VERTX to create an HTTP server. This is different from a traditional web server such as APACHE or NGINX. Here I will simply be using JAVA code to create a HTTP server ...
3
votes
2answers
387 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
3
votes
2answers
513 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
3
votes
1answer
194 views

Is using a WebServer as a proxy a secure solution

There are 2 machines - both running Windows Server. Machine1 can access the internet. Machine2 cannot access the internet, but can access Machine1. Machine2 needs to continuously access one external ...
3
votes
1answer
4k views

My web server is hit by strange traffic, what is that?

I'm a noob and just set-up a linode account to play around with linux development. I started nginx and made a simple homepage for my domain (giuliopizzini.com). Today I checked the nginx logs and ...
3
votes
3answers
411 views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
3
votes
1answer
608 views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
3
votes
3answers
627 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
3
votes
1answer
472 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...