Tag Info

New answers tagged

1

Here's a quick-and-dirty solution to block using fail2ban. (If you don't currently use fail2ban, google for your OS.) If you have fail2ban installed, see below. Note locations of the fail2ban files might be different, depending on your OS. The example below is from a Debian server. This sample doesn't cover ban times, etc.---just how to create a filter and ...


2

Proxypipe.com is hosted by Voxility S.R.L (AS39743)(AS3223). Voxility known to be a bad host by hosting Malware, Spam, DDos etc it's best to block all their IP ranges otherwise you will be dealing with Ddos atacks all day like i was was. You will find a list of their IP ranges here Voxility (AS39743) and Voxility (AS3223) Let me know if you need any ...


1

I too got similar probes. However, I got three different probes, all with different payloads. Running ls -a showed a new directory called .ssh in my document root, with a file called notshell.php I immediately deleted the directory and destroyed the DigitalOcean instance My guess is that somebody is trying to create some kind of attack on servers


5

Assuming your server doesn't use any credentials besides system-level accounts and the MySQL password, there's one thing you need to protect: the swap file. Programs are supposed to take steps to prevent credentials from winding up in swap, but they don't always do so. There are some sensitive things in /dev and /proc (such as /dev/mem and /proc/kcore). ...


0

First let me say, there is some truth in both answers from Tim X and David Wachtvogel. I'd still like to correct some of the statements of both of them. First, the impact Usually on a POP3 server, the messages are deleted after you download them. If a hacker would get your password he cannot get past messages. This is sometimes configurable, but by default ...


0

So, what do you exactly mean by "safe"? Are you concerning of the data security or privacy? (i.e. others can hack into your pc via the server applications and view/control your local data)? Or are you worrying about your php code or the software that will make damage to your computer? For 1), it is generally not possible to have access to your computer ...


2

You really can't. The issue is that the cookies are client-side and there are only two methods to fix the problem: ignore/accept the cookies or delete them. The former is probably easier than the latter, but I would not recommend it. There's a reason to keep cookies small -- they're not the full meal. (Why on earth would a server want to accept a ...


3

Most browsers have a limit on how many cookies they'll store for a single TLD. So, if the server is configured to allow a sufficiently large request to include all these cookies, the requests won't be rejected anymore. Apache has options like LimitRequestFields, LimitRequestFieldSize, etc. Setting these sufficiently high should allow the request to be ...


1

"Does doing X improve the security of my system?" -- this is a bad way to approach these issues. "Does doing X improve the security of my system enough to justify the costs?" -- is the right question to ask. Does blocking HEAD requests improve the security? Yes, by about .01%. Flaws in the code that handles HEAD requests would be harder (or impossible) ...


0

Using the HEAD command in telnet against a web server allows a potential attacker to conduct reconnaisance against your web server. Amongst other things the response can reveal what web server you are using and what technologies such as PHP or ASP, possibly with version numbers. The attacker could then use this to go and do some enumeration, which is the ...


4

There is another way leaking information about "secret" web pages: When the page calls other material (web pages, but also javascript or style sheets) the referer header points back to that page. A common scenario is loading the popular JQuery.js directly from code.google.com, leaking a web page to Google search. Access statistics are exposed to Google in ...


0

You can give Allow from a domain if you want to give access to local network. Then you can control machines in the domain. <Directory /> Order deny,allow Deny from all Allow from local.example.com </Directory> Anyway allow all and deny from 192.168.1.39 is a bad idea since black listing is not very secure. ...


1

You should specifically allow the IP address(es) that is allowed to access the resource and Deny everything else. order deny,allow deny from all allow from [your ip address] OR Allow from 10.0.0.0/24 Depending on your network configuration, requests to the server from the internet may include public IP addresses. Routers typically only provide NAT from ...


0

First question regarding the administration pages: If you delete the webpages after you are done using them, then no one will be able to find them. However, if you leave them on the server, then they can be found. There are website scanning tools that can scan your website using a dictionary to find "hidden" resources. In order to better protect these files ...


5

I see four possibilities to path leak 1) bruteforce 2) malware on your host 3) accident =) you can share this path to someone or forgot to delete, or link this from some place by accident. 4) google chrome =) because google use information from chrome (and probably ff) to feed crawler same thing is about dns. Relying on path is bad practice.


25

Your "secret files" remain secret exactly as long as their names (with full path) remain secret. You may consider the path as a kind of password. Note that the paths will leak to various places (proxy, Web server logs, history of your browser...). If the files are important and sensitive, you should just do things properly: Use SSL for upload and access to ...


1

You could do a policy based QoS, this allows you to perform rate limiting on particular IP addresses based on a particular policy. This way, you can allow IP addresses to visit your side, but when they perform a particular action (accessing a certain port, accessing a particular URL...), you'll only allow a limited number of sessions. It will limit the ...


0

There are lots of solutions which vary in their sophistication and effort / price... you can refer to this article for some simple techniques: http://www.cisco.com/c/en/us/support/docs/security-vpn/kerberos/13634-newsflash.html There are of course paid of the shelf solutions including cloud based solutions so you dont have to do much on your side such as ...


1

It is very likely that you're simply doing something like this: <?php if ( ! $is_logged_in) { header('Location: http://example.com/login.php'); exit; } Just change your redirect url to https, and everything should work as intended.


0

This is an assumption, but presumably your site is for the most part HTTP, then when it needs to process a payment it becomes HTTPS or forwards to a HTTPS page? If so there is a risk there, as it is possible to fool users into visiting a HTTPS page over only HTTP. For example see http://www.thoughtcrime.org/software/sslstrip/. As m1ke alludes to, you can ...


3

It's often not only the case that "payment information" is the only sensitive information. If your portal requires some sort of "login" (which it undoubtedly does), you allow many parties in between (Internet Cafe owners, ISP's, "hackers", employers, govermenments, ...) to see these credentials and take over the account. If your portal has anything in ...



Top 50 recent answers are included