A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

-1
votes
0answers
13 views

How do I set up SSL in wampserver [migrated]

When transmitting sensitive data over the Internet its exposed to malicious users or links therefore ssl or ssh is adopted. I have wampserver in my local machine and would love help on how to set up ...
0
votes
1answer
115 views

What would cause a server to only send over 1 SSL certificate to a client? [on hold]

We have a secure server that seems to only be sending over the identity certificate. Running the hostname through Qualys says that only 1 cert was provided. The intermediate had to be downloaded on ...
-1
votes
1answer
50 views
0
votes
1answer
22 views

Unrestricted File Upload Problem [closed]

I have a website www.example.com where I can upload word docs, and then the site will give me a link which I can click to download them at a later time. However I managed to bypass this so I can ...
0
votes
1answer
40 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
6
votes
4answers
905 views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
0
votes
1answer
23 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by ...
0
votes
1answer
63 views

How to determinate if someone scanning my server?

How is possible to determinate if someone make requests with tools for pentesting? Is there any linux command?
0
votes
3answers
116 views

Shellshocking Webservers, does anyone know of an attack-vector other than Headers?

i've see a lot of different webserver-attacks against cgi-pages, but have seen the malicious payload only in the headers, might it be User-Agent Cookies Referer Custom-Headers does anyone know if ...
0
votes
1answer
58 views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS ...
19
votes
3answers
1k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked. Check this out: ...
0
votes
2answers
84 views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
24
votes
3answers
1k views

Is there a way to detect web server in case it's not present in HEADER?

I'm trying to detect what web server a particular website uses. For instance whether it's nginX, Apache, Tomcat and so on. I usually use Live HTTP Headers Firefox add-on. The problem is that sites ...
2
votes
5answers
1k views

htaccess hacked

I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of attack? Update: I have no code/site live, only a coming ...
1
vote
2answers
320 views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
5
votes
2answers
270 views

Escalating from Apache shell to root

I have one noob question.I tried to exploit shellshock on my Slackware linux server, but after I connect with reverse shell and User Agent I get that I am apache user and apache user don't have too ...
0
votes
1answer
31 views

Period and direction of risk when connecting to malicious webserver

Please forgive my terminology mishaps. Recently, I tried to connect to a server over SFTP. The SSH public key response differed by 1 byte to what I was expecting, from an info page. I was tempted to ...
1
vote
1answer
26 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
1
vote
1answer
51 views

securing /var/www with .htaccess

So I have a web directory running on a server and I want only people with the password to be able to get in. Is it possible to secure the web root with .htaccess? Is there any extra steps I need to ...
0
votes
1answer
233 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET ...
2
votes
2answers
62 views

Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?

Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. ...
0
votes
2answers
43 views

Can Subject Alternative Name(SAN) Certificate install on different Web Server or OS?

Let say: application.house.com apache tomcat : physical server email.house.com apache tomcat : virtual finance.house.com Oracle Wallet Manager : physical server ...
1
vote
1answer
132 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
0
votes
1answer
153 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
0answers
44 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
2answers
83 views

How risky is having sensitive files on webroot?

I understand that having anything sensitive under webroot is not smart; someone may be able to access it via url. However, I do not have a choice with my web host (iPage) as they limit my server space ...
0
votes
1answer
54 views

HTTPS enable for proxy server or web server

Say I have 2 separated servers which are one web server (apache) and one proxy server (nginx), I want to use HTTPS for the website running on the Apache. Do I enable SSL on apache or nginx or both? ...
0
votes
2answers
65 views

Attack surface for a site that hosts only static content HTML and images?

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
0
votes
1answer
59 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
0answers
35 views

securing my API: concept of accesstokens

first of all I want to excuse for the bad spelling and grammar. English is not my mothertongue. I have built a JSON communication between frontend(website) and my NodeJS webserver. I want to keep in ...
7
votes
2answers
1k views

IIS IP Address Restriction - can I rely on it online?

I've been told that I might have more luck posting here than on Stack Exchange, so here goes: I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
0
votes
2answers
3k views

Questionable request to /user/soapCaller.bs

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error. ...
6
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
20
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
11
votes
5answers
7k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
1
vote
2answers
689 views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
7
votes
4answers
184 views

DNS spoofing of linux distribution repositories

Question(s) Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when running the ...
1
vote
1answer
105 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
0
votes
0answers
94 views

How to stop auto-created files to happen?

I'm new to "Information Security" so I hope I'm in the right place. I'm experimenting a very disapointing problem on my hosting server: some files are automaticaly created and I don't know how. The ...
0
votes
1answer
29 views

Does serving Tomcat via Apache Webserver improve security?

This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios: Tomcat serves ...
3
votes
1answer
68 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
-2
votes
1answer
64 views

protect files on webserver, allow only internal use

I have a website and it has an audio player to play music files, the music files are hosted in a public directory. Since they are they anyome can point there and use the files on their website. Is ...
2
votes
3answers
192 views

Is there any way to block LD_PRELOAD and LD_LIBRARY_PATH on Linux?

Preferably with a vanilla Linux kernel i.e. not using SELinux or GrSecurity? Lately there has been a case of in-the-wild UNIX server malware: ...
2
votes
1answer
485 views

How to run a tor hidden service from home securely?

Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught? Assume I am running the server from home, over a ...
18
votes
2answers
2k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
1
vote
4answers
127 views

untangle server at work place privacy

When I am browsing in an environment where Untangle server is installed, can the network admin track everything I do? for example: Skype chat messages Personal emails (Gmail, Yahoo)
0
votes
1answer
49 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
0
votes
0answers
71 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
4
votes
2answers
229 views

How widely deployed is TLS with cipher ECDHE?

Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers. Cipher suite Exchange Encryption Hash TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
5
votes
3answers
615 views

Can allowing a web application to move, copy and/or delete files outside of the server root be a security issue?

I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it ...