A system whose primary function is to deliver web pages on request to clients.
62
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
47
votes
15answers
5k views
How is “hacking” even possible if I “defend” properly?
On a Linux-based server, I follow basic practices as below:
Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
38
votes
13answers
4k views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
19
votes
4answers
8k views
Why is passing the session id as url parameter insecure?
I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
19
votes
3answers
660 views
Does password-protecting a server's BIOS help in securing sensitive data?
I'm running a server of which I protected the BIOS with a password. One doesn't have to enter this password before booting, but before entering the BIOS setup. I just did this from routine. However, ...
18
votes
6answers
2k views
Why do DDoS attacks cost a fortune to stop?
I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions:
Is this because they try to keep the servers accessible to real site ...
17
votes
7answers
615 views
Protecting WordPress installations
How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome. Thanks.
...
16
votes
2answers
362 views
What risks should I be aware of before allowing advertisements being placed on my website?
The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site.
Does serving ...
15
votes
4answers
631 views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
15
votes
1answer
1k views
Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?
Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites?
The pitch is that if such a HTTP request were to come in, then certain XSS ...
15
votes
3answers
876 views
How to keep a shared web hosting server secure?
What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user?
Edit: I am mainly thinking of securing the server from the users themselves and between ...
15
votes
3answers
639 views
What are the risks of using a CDN to speed up my website? How do I avoid them?
Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN.
What ...
14
votes
5answers
357 views
What is the best option for setting up a several sites supporting SSL on the same IP?
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
14
votes
4answers
7k views
What ciphers should I use in my web server after I configure my SSL certificate?
There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list.
...
13
votes
2answers
648 views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
13
votes
4answers
951 views
How to detect “forged” SSL certificates from the webserver end
The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
12
votes
4answers
382 views
What are the most important security checks for new web applications?
I'm wondering what are the top priority security checks you should make befor launching a new webapp?
I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
11
votes
7answers
514 views
Online Government Elections System - Is it possible?
I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
11
votes
5answers
2k views
Index page has been compromised, suspicious files are showing up
My website has been hacked lately and it has been defaced. Now I have weird files, don't know where they coming from. I just want to know, what of these files are harmful or can cause that I get ...
11
votes
2answers
327 views
Where to report malicious URLs, phishing, and malicious web sites?
I recently discovered that my web designer was hacked: there was a HTML hidden div selling about shoes... I Googled the text in question and voila: thousands of sites have been hacked.
Check this ...
10
votes
4answers
673 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
10
votes
4answers
798 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
10
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
10
votes
2answers
192 views
What is the best way to verify the SSL configuration of my web server?
How do I ensure I have my SSL configuration setup securely?
10
votes
4answers
3k views
Does a webserver need an antivirus software installed?
In what cases does a webserver need an antivirus software installed?
When it is not required?
If it is required sometimes, what should be considered when choosing the right one to install?
(In my ...
10
votes
2answers
788 views
CloudFlare benefits or drawbacks
Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
9
votes
5answers
2k views
What is the best practice for placing DataBase servers in secure network topologies
I have a classic DMZ architecture:
My webserver is placed in the DMZ.
The webserver needs to communicate with a database server. This database server is the most critical component of my network ...
9
votes
2answers
2k views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
8
votes
3answers
2k views
Installing Development Tools on Production Server? Security Risk?
I am using an Amazon Linux EC2 instance as a web server. My web app uses ImageMagick. Because the Amazon Linux (CentOS) repository doesn't include an up-to-date version of ImageMagick, I am compiling ...
8
votes
4answers
2k views
IIS logs show someone is trying to hack my site, what should I do?
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: ...
8
votes
3answers
411 views
How does an attacker approach a website?
What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
3answers
296 views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
8
votes
4answers
3k views
How safe is it to install XAMPP on my home computer to test PHP code?
I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer.
Is it generally safe to install XAMPP (given that I ...
8
votes
4answers
771 views
Combat Apache Killer
Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.
This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
8
votes
2answers
629 views
HSTS extra security over HTTPS
Is HSTS good to use even if my servers are configured to use HTTPS (Even if HTTP is used, the rewrite rules in apache makes it to HTTPS)
Also does HSTS make even the resources like CSS, images to be ...
8
votes
2answers
180 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
8
votes
1answer
230 views
Is Chinese great firewall white or black list based? [closed]
Is a new website blocked by default in China ?
I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed).
However a friend of a ...
8
votes
1answer
399 views
Relative importance of CHROOT for web servers
I have read extremely mixed opinions on the process of chrooting for a web server (non-shared environment). Some people swear by it, yet others say that it isn't as secure as everyone says.
Given ...
7
votes
4answers
2k views
Protecting against DOS attacks
Our current site is easily DOS'd. I can perform an AB test against it from Apache and it disappears for about 5-10 minutes. We have been having problems with others DOSing the site - to the point ...
7
votes
2answers
1k views
Securing my web-server / website [closed]
Does anyone know of a comprehensive security guide about important basics / fundamentals which should be done to secure a web-server / website? A web link would do.
7
votes
3answers
410 views
How is “anonymous” getting ahold of all these plain-text passwords
In the last several months there have been several publicized data breaches and public website defacements done by several different hacking groups (which the media loves to group under a single ...
7
votes
2answers
89 views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
7
votes
3answers
346 views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
6
votes
3answers
5k views
Which webserver is more secure, Apache, nginx or lighttpd?
We are trying to decide which webserver to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
6
votes
5answers
2k views
Can I block based on Mac Address?
Incase of dynamic IP's the hacker can work around by taking a new IP or use a Proxy, is it possible to make a ban based on Mac Address ?
I want to block at the Webserver level so that unwanted users ...
6
votes
3answers
393 views
Is displaying what server I am running on the error pages a security risk?
I just noticed that my 403 Forbidden (the default, not a custom one) page displays some server info:
Apache/2.2.3 (Red Hat) Server at ... Port 80
Is revealing this information a security risk?
6
votes
4answers
1k views
Is .htaccess protection secure enough?
For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure?
I don't know ...
6
votes
2answers
725 views
IIS IP Adress Restriction - can I rely on it online?
I've been told that I might have more luck posting here than on Stack Exchange, so here goes:
I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no ...
6
votes
4answers
1k views
What are the best ways to fake a web server
I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
