New answers tagged

1

Let me answer with a few observations, and comments. I will begin with the "whodunit" approach of aiding in determining who, what, when, where, and how. What - a file you found on your system When - what date was it found How - how was it uploaded Who - who uploaded it You already know the file because you found it. Let's call this file: malicious.php. ...


1

Kudos for finding it quickly, it looks like you're doing something right. But you're also doing a lot of things wrong. The most obvious one is that directories within your document root are writeable by the webserver UID. It would help to know what you are trying to achieve by "tracing the origin" of the script. Certainly you should be looking for the ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


6

Sending URLs beyond the 2000 [see note] character limit should produce a HTTP 414 error. Common error codes like 404, 401, 403, etc. are often given custom error pages, but less common ones (like 414) are often not. Default error pages often leak server version information, so it's a common trick to get the server to produce a 414 response in order to ...


1

1. What does preload do? The preload flag indicates consent for the domain to be allowed onto the HSTS preload list (used by Chrome, Firefox, IE 11, Edge, and other browsers). The Chrome security team allows any domain to submit their domain to the list, provided it meets the following requirements: HTTPS is enabled on the root domain (e.g. ...


5

It's an IP address in octal format, followed by an arbitrary path, which happens to be formed of elements that look like query parameters. You can generate octal representations of IP addresses using various online tools: 0xD83AD60E should link to Google at 216.58.214.14. They're not inherently malicious, but the fact that you received it from a spammer ...


2

Install a VM hypervisor on your server(s) and create a separate virtual machine for each user which runs an own webserver and database instance. When you don't have an unique public IP address for each user, then you can point all the DNS entries to the same public IP where you run a reverse proxy which routes each request to the LAN-IP of the correct VM ...


1

Yes, this is enough secure. I would suggest checking for: perl: $ENV{'SSL_CLIENT_M_SERIAL'} in your web app. This means you will have to have a database of valid users, and possibly which rights they have in the web application. Doing this instead of doing revocations the "PKI way" is better, since then you first, does not need to manage a CRL, and ...



Top 50 recent answers are included