A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

1
vote
4answers
221 views

What needs to be focused on when hardening a LAMP stack? [closed]

I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
1
vote
2answers
71 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
1
vote
2answers
247 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
1
vote
2answers
332 views

How do I import a PKSC#12 private key into Java 5 (which may require PKCS#7)

I have a newer private key I have to import into an older server. How do I take a newer PKCS12 cert and import it into an older version of java that uses a different format?
1
vote
1answer
153 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
1
vote
2answers
297 views

What are the go-to books on server security? [closed]

To learn how to keep things secured, and to do a good job at it, what books should one check out?
1
vote
1answer
600 views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
1
vote
1answer
119 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
1
vote
1answer
168 views

Should I keep all UUIDv4 generated oAuth2 Bearer Tokens in my database to prevent an attack?

I generate oauth2 access and refresh tokens and store them in my database. I generate these tokens using UUID v4 and remove the dashes. I used to delete the tokens after they expire but now I store ...
1
vote
1answer
170 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
1
vote
2answers
364 views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
1
vote
1answer
216 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user999 to execute any shell (php, pl, py, binary). The ...
1
vote
1answer
138 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
1
vote
1answer
585 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
1
vote
1answer
148 views

Security Standards for storing private customer data

A certain government regulation in my country mandates all non-resident donors to provide a copy of their identification (usually, the passport). So, we ask the donors to upload a copy of their ...
1
vote
1answer
82 views

Recognizing malicious URL attempts against your website

On serveral websites I've run, I periodically see URLs run against my servers that look like this: /url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........ Does anyone recognize it? I've tried to ...
1
vote
1answer
383 views

Where do I find more information about a given hacking attempt requests to my website?

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this: Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
1
vote
1answer
2k views

How can log poisoning be successful with a Local File Inclusion attack?

I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
1
vote
0answers
36 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
1answer
59 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
115 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
1
vote
0answers
40 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
1answer
86 views

How to Minimize Apache Loadable Modules (serving MediaWiki)

According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy: "In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
1
vote
3answers
616 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
0
votes
2answers
843 views

Weird IP addresses showing up on my server

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server ...
0
votes
3answers
122 views

Shellshocking Webservers, does anyone know of an attack-vector other than Headers?

i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be User-Agent Cookies Referer Custom-Headers does anyone know if ...
0
votes
3answers
162 views

How to retrieve a site whose server is running Linux

I'm struggling to find a way to retrieve through Google a list of sites having Linux as their server operating system. Actually, I'd like to be able to test the following command: nmap -O ...
0
votes
2answers
3k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
0
votes
1answer
281 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
0
votes
2answers
82 views

Attack surface for a site that hosts only static content HTML and images?

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
0
votes
4answers
69 views

Masking IP address and port number for Web application [closed]

I have a Web application running on port 89 ( non-standard port) of a Windows 2012 R2 machine. The login page for this application needs to be accessible through a link on my website - let's call it ...
0
votes
1answer
273 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
0
votes
3answers
59 views

How secure is my method?

I want to select data from a MySql database on an iphone device. The method I seem is the easiest one is to connect to a php file with GET arguments and then return it as a string. Now I'm just ...
0
votes
4answers
140 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd ...
0
votes
1answer
201 views

Virtual private server security [closed]

I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
0
votes
2answers
412 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
0
votes
1answer
2k views

Ban MAC address from website? [duplicate]

Possible Duplicate: Can I block based on Mac Address? I have a situation where I need to ban a MAC address from accessing my webserver. (Windows Web Server 2008 R2). Is this possible? P.S. ...
0
votes
1answer
210 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
2answers
68 views

Is it possible to sabotage google bots? [closed]

Consider the following theoretical webserver: On any request, produce an html response that consists of 2 links, which are each randomly chosen strings followed by ".html". When the google bot ...
0
votes
1answer
100 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
0
votes
2answers
135 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
0
votes
1answer
171 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
0
votes
2answers
119 views

To-dos when taking over an existing webserver [closed]

I'm taking over as a system administrator on an existing LAMP server for a site with a number of individual applications. The person I'm replacing has done a pretty good job with security as far as I ...
0
votes
3answers
163 views

If my server was compromised, is my database safe?

I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
0
votes
2answers
63 views

Infected Drupal 6 website page with a php shell

I have a server with Drupal 6 which was hacked and now by accessing the main page i can see the php shell. The problem is that i could not find the shell. The site files are not infected because i ...
0
votes
2answers
99 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
0
votes
1answer
60 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
120 views

What would cause a server to only send over 1 SSL certificate to a client? [closed]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
0
votes
1answer
56 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
0
votes
1answer
227 views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?