Tagged Questions

A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
3answers
2k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
1
vote
2answers
2k views

HTTPS Certificate mismatch alert before redirection

Let's analyze the following situation: A server is hosting 10 websites: site1.com - site10.com. Only one of these websites uses SSL -site1.com. If you try to access site2 - site10 over https the ...
2
votes
1answer
95 views

Quick Security Mitigations to Impending attacks

Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
11
votes
1answer
2k views

How should I store SSL keys on the server?

I have a Node.JS HTTPS webserver instantiated as follows: var privateKey = fs.readFileSync('./../ssl/localhost.key').toString(); var certificate = ...
10
votes
4answers
5k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
2answers
224 views

Can other customers on shared hosting see requests from/to my site?

I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account. The wiki ...
2
votes
2answers
448 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
1
vote
2answers
329 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
-6
votes
2answers
4k views

How can I spoof my IP address using the PHP curl function? [closed]

I want to spoof my IP address with the PHP curl function. I'm sending requests to a server with PHP curl, my IP address is $ip2, but I want the server to believe that the request is coming from $ip1. ...
1
vote
3answers
3k views

Using Netcat to detect the webserver type

In order to know which server a site is running I can use netcat. Through the following command I can gather information about the type of server installed. netcat -vv www.example.com 80 But if ...
3
votes
2answers
866 views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
3
votes
1answer
361 views

Mitigation Strategies for Response Spliting Attack

I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
0
votes
3answers
162 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
0
votes
2answers
308 views

How to restrict web access to certain countries

What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
3
votes
1answer
337 views

What are some steps to take for securing a Linux server that aren't in this list of obvious ones?

Obvious things: Disable root login (rather, don't enable it) Secure SSH (no root login, key auth only, timeout after inactivity, whitelist users who can SSH in, etc.) IP Tables firewall whitelisting ...
5
votes
2answers
112 views

Is it actually feasible or useful to use a high number of proxy servers?

In the movies, it's not uncommon to see the digitized global map projected on a huge wall with a line of light (presumably a user's connection) travelling back and forth all over the globe in a ...
0
votes
2answers
833 views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
1
vote
1answer
153 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
2
votes
1answer
2k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
1
vote
2answers
247 views

Good Practices to secure a Gaming Web Server, Memcached Server & MySQL Server

We have developed Game for Facebook platform. We have several Gaming Web Server, Memcached Server & MySQL Server. Here we have to work with facebook Payment API. We need to secure enough our ...
3
votes
3answers
204 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
2
votes
2answers
432 views

A security checklist for choosing an internet hosting service provider for a virtual private server?

I am in the process of choosing an internet hosting service provider for my website. Besides looking at the reputation of the hosting provider through internet forums, is there a more concrete way of ...
4
votes
2answers
3k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
-2
votes
1answer
111 views

can vps be made as secure as having two dedicated server computers? [closed]

Which is a better option security wise : 1) cheaper option - vps (Iam assuming that if one particular virtual server is hacked,then still other virtual servers on that comp will be ...
0
votes
1answer
562 views

Phishing attack stuck with jsp loginAction.do page? [closed]

I'm testing a phishing website on a staged replica of an jsp web-application. I'm doing the usual attack which involves changing the post and action field of source code to divert to my own written ...
0
votes
1answer
357 views

Is it dangerous to serve executable cgi files in public folder?

In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
2
votes
2answers
2k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
7
votes
5answers
977 views

Securing Debian Apache PHP Server

I have Debian Apache PHP server. I want to secure him after the classic installation process. My usual steps are : List item update all packages remove all unnecessary services like named, portmap, ...
6
votes
2answers
442 views

Where to put private files on a shared web server

I continually hear and read people warning against the perils of placing proprietary information or confidential documents within the web server root directory. If I am on a shared server, I cannot ...
4
votes
2answers
1k views

How helpful is rkhunter?

I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website. With these things already in place, do ...
3
votes
2answers
419 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
3
votes
2answers
1k views

How to counter or fix banner grabbing vulnerability

During an audit i came across banner grabbing findings,and would like to know how to mitigate that on IIS and apache server.
3
votes
2answers
770 views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
4
votes
2answers
203 views

Most secure response for a server to return to a user scanning for exploits

I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc. Currently these requests all return 404 because ...
3
votes
1answer
134 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
3
votes
3answers
463 views

What is the actual security of this login page?

Please visit https://devforums.apple.com If I visit this site using my Safari 6 web browser, this page does not show the normal security indicator that secure sites normally show. Does this ...
6
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
1
vote
3answers
4k views

Building a secure server with CentOs [duplicate]

Possible Duplicate: Hardening Linux Server I recently started to manage my own server with a cloud-based server. Recently I got hacked somehow and the server was used for phising. On the ...
1
vote
2answers
295 views

What are the go-to books on server security? [closed]

To learn how to keep things secured, and to do a good job at it, what books should one check out?
4
votes
1answer
471 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...
0
votes
1answer
475 views

What security concerns exist in running a glassfish app directly on port 443

I have installed Apache http server in front of glassfish based on recommendations i had in this question. I have been told that i will run into performance problems along with security issues. I was ...
1
vote
2answers
120 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
0
votes
1answer
458 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
1
vote
4answers
330 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
4
votes
5answers
2k views

Is it dangerous to allow user to view a file directory via web browser?

I have a URL which displays all of the pdf files at a given dir by visiting the following site location : http://www.mysite.com/allpdffiles/ Does this present any security vulnerabilities?
16
votes
2answers
2k views

HSTS extra security over HTTPS

Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS) Also does HSTS make even the resources like CSS, images to be ...
1
vote
1answer
595 views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
1
vote
3answers
448 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
2
votes
4answers
1k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
-1
votes
1answer
218 views

Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?

Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...