A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

0
votes
2answers
271 views

Place database in the DMZ and in the internal network

Is it sufficient to have single database inside the DMZ which the webservers in the DMZ receives their data from. Or if setup with two databases is a better solution, that would be to have a ...
1
vote
1answer
1k views

Cross Domain Javascript security [duplicate]

I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion." May I know how would an attacker exploit this type of ...
1
vote
1answer
570 views

How to know an Apache web server mod_cgi module is enabled?

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
1
vote
1answer
123 views

What are the traces of a mysql attack on a server when the attacker has full permissions?

I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
28
votes
4answers
4k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
1
vote
3answers
85 views

Is it good practice to let Node/Go/… act as a frontend webserver?

I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
0
votes
1answer
48 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
10
votes
4answers
1k views

What is Net-Worm.PHP.Mongiko trying to do?

I found several lines of this request in my web server access log: Source IP Dest IP Request Stat User agent 217.172.190.19 ...
5
votes
3answers
584 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
3
votes
1answer
243 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
0answers
107 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...
2
votes
2answers
4k views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
4
votes
1answer
566 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
0
votes
2answers
374 views

Google Analytics: Hacked or Ghost Referers?

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior. I've got a web application ...
-1
votes
3answers
661 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
1
vote
0answers
157 views

Securing elasticsearch behind a reverse proxy

I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on 127.0.0.1 only. I ...
0
votes
3answers
6k views

htaccess - protect php file execution in specific directory

How can I protect php execution in specific upload directory? Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers. So how can I ...
0
votes
1answer
65 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by ...
2
votes
1answer
584 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
1
vote
4answers
389 views

untangle server at work place privacy

When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example: Skype chat messages Personal emails (Gmail, Yahoo)
2
votes
1answer
193 views

How do I know if root account has been compromised?

My server was hacked with some files being overwritten to generate spam links on the index page. All my previous backups contain the same modified files, making the nuking from orbit option a puke. If ...
0
votes
1answer
145 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
0
votes
1answer
68 views

How secure is internal data on the internet with IP authentication?

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
3
votes
2answers
675 views

If I set up a home web server, will computers that use my wi-fi be vulnerable?

I'm interested in setting up a web server on an old laptop L1. My plan is to connect that laptop to an Ethernet port on my router. I also have another laptop L2 accessing the router via wi-fi. L2 ...
1
vote
1answer
152 views

Secure (P2P) Client/Company File Sharing

my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored. The ...
4
votes
3answers
2k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
4
votes
3answers
3k views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
3
votes
2answers
459 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
18
votes
4answers
3k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
0
votes
2answers
66 views

Unpublished server

Is it possible to setup my web server such that only certain sources can access and the public from internet has no access? i am thinking that we could just not publish our web server URL/IP to our ...
15
votes
4answers
28k views

Identify and disable weak cipher suites

i'm asking a question on a subject that is pure chinese to me..sorry in advance A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
2
votes
1answer
76 views

Website Implementing https site w/ self signed certs and CA

Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)? I am some what torn on how to do this - I have a number of implementaiton ...
3
votes
2answers
424 views

Would our company system be more secure using a VPN?

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm ...
0
votes
1answer
92 views

Have i been phished? [closed]

I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
1
vote
1answer
111 views

How safe are networking ACLs based on IP-address?

As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request. Therefore, I cannot see how an Access Control List (such as ...
0
votes
2answers
314 views

Security of php code on webserver - obfuscate?

Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft? I think my question boils down to 'Is there a ...
0
votes
2answers
4k views

Scan all possible files on server (Brute force Filenames)

I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
20
votes
5answers
4k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
2
votes
1answer
103 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
0
votes
2answers
341 views

Security risk of using virtual hosts for public and internal sites

I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
1
vote
2answers
1k views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
4
votes
4answers
142 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
15
votes
5answers
657 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
2
votes
1answer
66 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
2
votes
4answers
156 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
1
vote
3answers
241 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
-5
votes
2answers
135 views

Large web application security challenges [closed]

What are the biggest challenges of security in web applications? I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
2
votes
2answers
601 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
7
votes
3answers
288 views

What are the risks to a network if a single computer is compromised?

If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
3
votes
1answer
93 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...