A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
1answer
1k views

Can the following .htaccess rules prevent this attack?

See these related questions from the same user about the same incident first: How to find and protect against the exploited vulnerability in an PHP application based on the logged URL? ...
2
votes
1answer
72 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
2
votes
1answer
160 views

What features boost security for a home edge router?

I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
2
votes
2answers
549 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
2
votes
1answer
1k views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
2
votes
1answer
883 views

How to find the pharmacy hack in a Joomla website?

We've discovered today that our Joomla website has been hacked by a pharmacy trojan. It was difficult to discover because most users don't see it when visiting our website. One user reported about 2 ...
2
votes
1answer
251 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
2
votes
2answers
56 views

What are the security implications of STARTING a reverse proxied origin server as an unprivileged user?

A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. ...
2
votes
1answer
341 views

How to do security configuration for ibm http server?

We are using IBM HTTP Server Version 7.0 Need help related to Cross Site Scripting Prevention in IBM http server. Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
2
votes
1answer
960 views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
2
votes
1answer
95 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
2
votes
1answer
659 views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
2
votes
1answer
2k views

Something causing Sonicwall to throw Smurf Amplification Attack Warning?

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...
2
votes
1answer
355 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
2
votes
1answer
328 views

Security reason why one should upgrade old web server to modern Java EE Web Application Server

Currently the company I work for uses Sun Java System Web Server 6.1 SP9 and Java 1.4.2. I know this version of Java reached its EOSL around 2008. The Sun Server still seems to be supported but it's ...
2
votes
2answers
43 views

How to display friendly notification about no TLS 1.0 support in browser [on hold]

A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
2
votes
3answers
43 views

Find the destination script of an inbound TCP connection on our shared webserver

We have a shared webserver which is being monitored constantly by our ZABBIX agent. On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
1
vote
4answers
2k views

Prevent Users from Downloading Javascript, Images

A lot of times I see that resource XXXXX.gif or XXXXX.js can't be saved when I try to save a webpage in Firefox. So this made me think, can I implement a similar thing for my website as well? ...
1
vote
3answers
516 views

Danger of Path Traversal Attacks

I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him. However, I want to understand what more can be done if ...
1
vote
2answers
1k views

Protecting an IIS web site hosted at home

My case is I just registered at dyndns.com to get a domain for a website I am staging on my home computer (I know it's not considered good to do so). But the website is not big, and I don't expect to ...
1
vote
2answers
450 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
1
vote
3answers
450 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
5answers
311 views

Is there something similar to DNSBL's for protecting against forceful browsing?

I want to protect a couple of Apache webservers against forceful browsing. Lately there have been multiple scans querying for non-existent applications on them like phpMyAdmin, notably known for their ...
1
vote
4answers
151 views

untangle server at work place privacy

When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example: Skype chat messages Personal emails (Gmail, Yahoo)
1
vote
3answers
4k views

Building a secure server with CentOs [duplicate]

Possible Duplicate: Hardening Linux Server I recently started to manage my own server with a cloud-based server. Recently I got hacked somehow and the server was used for phising. On the ...
1
vote
4answers
83 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
1
vote
1answer
116 views

What is LFI vulnerability

LFI: Local file inclusion. After going through many tutorials I have two things I can/t figure out: checking the vulnerability: I don't understand what makes a website vulnerable or not. For ...
1
vote
3answers
461 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
1
vote
2answers
3k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
1
vote
3answers
76 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
3answers
452 views

Can my customer's ISP trace who visited my business website?

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
1
vote
4answers
334 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
1
vote
2answers
157 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
1
vote
2answers
614 views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
1
vote
1answer
2k views

WordPress Hacked - Found a suspicious “class-wp-style-table.php” [closed]

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). ...
1
vote
2answers
2k views

How to allow only some specific computer systems to access website? [duplicate]

I need a process to allow only certain computer systems access to the website irrespective of the network they are using. Much like a Licensing system, I can provide a private key or something ...
1
vote
2answers
301 views

Statistics of attacks on unhardened Web Server

Suppose my web server is on the public internet. It's not behind firewall hardware. It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
1
vote
2answers
2k views

HTTPS Certificate mismatch alert before redirection

Let's analyze the following situation: A server is hosting 10 websites: site1.com - site10.com. Only one of these websites uses SSL -site1.com. If you try to access site2 - site10 over https the ...
1
vote
3answers
3k views

Using Netcat to detect the webserver type

In order to know which server a site is running I can use netcat. Through the following command I can gather information about the type of server installed. netcat -vv www.example.com 80 But if ...
1
vote
2answers
250 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
1
vote
3answers
310 views

Is there a security problem accessing my laptop via WIFI?

I'm developing a web application for mobile devices on my local server in my laptop. My laptop is connected to company network via LAN. And, my project manager, wants to check the web application ...
1
vote
1answer
80 views

How does a browser choose which certificate to use if my web server has multiple certificates?

I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
1
vote
2answers
475 views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
1
vote
1answer
733 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
1
vote
2answers
51 views

Segregating Offline Server and Internet Connection in one pc

What I want to do: Setup a PC with two routers. One router is directly connected to the internet, the other is connected to an offline workspace server. My client will be connected to both via a ...
1
vote
1answer
111 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
1
vote
1answer
133 views

Is authentication through proxy sites safer?

usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
1
vote
1answer
1k views

Skype chat history and web browsing history CHECK

In an office work place, can a network admin have access to my Skype chat history and web browsing history without logging in to my pc since all pc's are connected with the same network? i am ...
1
vote
2answers
149 views

secure certain data on my webserver

I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
1
vote
3answers
647 views

Implication of URL injection in an URL shortener service

EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...