A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

5
votes
3answers
699 views

Can allowing a web application to move, copy and/or delete files outside of the server root be a security issue?

I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it ...
4
votes
2answers
204 views

You've just acquired a newly created CentOS server, what should you do to secure it?

I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?
0
votes
2answers
87 views

What type of probing sends GET /“ data ” to a server?

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like No route found for "GET /wp-login.php" (uncaught exception) No route found for "GET ...
2
votes
1answer
347 views

What security does nginx provide between server blocks?

What security does nginx provide between server blocks? Here is an example scenario. Say I have two server blocks configured with nginx. Each serves up a web application to authenticated users. I ...
-3
votes
1answer
65 views

Security concerning using Windows 7 as a web server [closed]

Can Windows 7 be used for hosting a low traffic website which only use php and mysql and nothing else, like email, file hosting, etc.
0
votes
3answers
94 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
2
votes
1answer
237 views

What features boost security for a home edge router?

I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
19
votes
4answers
2k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
1
vote
3answers
777 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
5
votes
1answer
208 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
0
votes
1answer
247 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
1answer
94 views

Should statically-linked server binaries (daemons) be deemed more secure? [closed]

For a long time I've pondered this question. I am aware of the benefits and downsides of dynamic libraries (shared objects), including the infamous article by Drepper. All other things being equal, ...
30
votes
4answers
40k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
0
votes
1answer
37 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
2
votes
1answer
634 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
1
vote
1answer
249 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
-2
votes
1answer
334 views

Backdoors and hard-coded usernames and passwords

I have been researching on computer worms that brought me to this topic of backdoors. According to my research, backdoors are malicious pieces of code that are inserted into either computers to get ...
1
vote
1answer
2k views

Skype chat history and web browsing history CHECK

In an office work place, can a network admin have access to my Skype chat history and web browsing history without logging in to my pc since all pc's are connected with the same network? i am ...
36
votes
6answers
4k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole ? ...
1
vote
1answer
234 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
2
votes
4answers
481 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
0
votes
2answers
185 views

Does the Heartbleed vulnerability affect signed java applets [closed]

I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
13
votes
7answers
978 views

Online Government Elections System - Is it possible?

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
1
vote
4answers
695 views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
13
votes
4answers
872 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
4
votes
2answers
644 views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
14
votes
4answers
1k views

Is displaying what server I am running on the error pages a security risk?

I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info: Apache/2.2.3 (Red Hat) Server at ... Port 80 Is revealing this information a security risk?
8
votes
3answers
718 views

Does hiding version numbers increase my security? [duplicate]

I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits. As an ...
8
votes
1answer
210 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
-1
votes
1answer
181 views

How bad is to buy domain name with .ext from another country even if they allow non citizens to own one?

I'd like to purchase a domain name from a country that does not require citizenship, since they can make nice urls, they are more available and sometimes not too expensive too! But few things annoys ...
7
votes
1answer
9k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
0
votes
1answer
255 views

oracle weblogic vulnerability

I searched for Oracle Web logic vulnerabilities and found this vulnerability: Oracle WebLogic Server Cross-Site Scripting and Manipulation of Data Vulnerabilities ...
0
votes
4answers
216 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd ...
0
votes
1answer
407 views

Virtual private server security [closed]

I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
4
votes
3answers
183 views

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?

Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server? Whether it it be through htaccess setups, posting login ...
6
votes
3answers
444 views

Failed PCI-DSS Compliance | Submitting Evidence

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
3
votes
2answers
4k views

What kind of security injection are these traces of, SQL, javascript, or otherwise?

I've tried to secure all information going to the server to make sure there are no SQL injections. However there are new folders on my server with weird names. One of our online services is such that ...
1
vote
1answer
129 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
2answers
111 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
0
votes
1answer
66 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
1
vote
1answer
352 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
0
votes
2answers
84 views

Is it possible to sabotage google bots? [closed]

Consider the following theoretical webserver: On any request, produce an html response that consists of 2 links, which are each randomly chosen strings followed by ".html". When the google bot ...
6
votes
3answers
2k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
1
vote
1answer
741 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
6
votes
3answers
4k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
1
vote
3answers
98 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
1answer
158 views

Is authentication through proxy sites safer?

usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
2
votes
2answers
588 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
4
votes
1answer
113 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
0
votes
1answer
119 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...