Tag Info

New answers tagged

0

The openssl in ubuntu does not support TLSv1.2, They have disabled it. It is documented in bug 1256576


0

Simple, set up an Apache server, which is listening on HTTPS, and make sure you use an older version of OpenSSL. Heartbleed.com suggests that OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable. It even has a list of OS'es that are vulnerable, so you could simple set up a VM with that OS and you're good to go. There are enough scripts out there to ...


0

For starters, install an Apache version that contains a vulnerable OpenSSL version. According to the OpenSSL Security Advisory regarding CVE-2014-0160 [07 Apr 2014]: Only 1.0.1 and 1.0.2-beta releases of OpenSSL are affected including 1.0.1f and 1.0.2-beta1.


0

Not only should you implement HTTPS, but it should be on by default. This reminds me of a quote from the EFF that went something like this: "in an ideal world, every web request would be sent over SSL/TLS." Security and Privacy should be on by default. It cannot be optional. And for privacy to not be suspicious, everybody needs to do their part. Like others ...


1

I like keeping this simple. If the webserver runs OpenSSL 1.0.1 through 1.0.1f and accepts SSL connections, it will most likely be vulnerable. As Steven says, this is SSL/TLS protocol wich is transport layer security. This exploit is not on the application layer of the OSI layer. Have a look at heartbleed.com for detailed information about the exploit.


0

If you're hosting the web site in Internet Information Services (IIS), you won't be affected because IIS doesn't use OpenSSL to support the SSL/TLS protocol. See Vulnerability Note VU#720951 for reference. Not sure what SSL/TLS implementation Apache for Windows uses, though. Chances are it does use OpenSSL, in which case you'll want to apply a security ...


3

Teun Vink is right, it's not vulnerable if you are certain that https is turned off, for example by turning mod_ssl off. Even if you don't actively use https, it may still be enabled. Many servers have https enabled by default with some automatically generated certificate. This will not be valid and throw an error or warning in browsers, but it will still ...


1

No it's not. Heartbleed is an OpenSSL vulnerability, no OpenSSL is used for HTTP.


1

are there any general techniques which can be used on a black-box security test to identify/enumerate enabled modules on a running Apache server? tl;dr: you cannot detect all installed/enabled modules, and you need to analyze headers manually, if you dont want to X-MISS something we use a custom tool to investigate all server-headers; this tool, ...


0

make a screenshot of the result-page; there are always some links to documentation when testing a server, and a lot of hints on what do do to improve to get a rank A : SSL/TLS Deployment Best Practices SSL Server Rating Guide OpenSSL Cookbook are you sure you followed those guides for your setup? beside pfs you need hsts enabled to get an A iirc the ...


0

this is a usual open-proxy-scan ("GET http://..." instead of a npormal GET - Request like "GET /index.html") which is answered by a 404 - Not -Found-Error from your server, so no need for action from your site


3

It seems "they" are trying to get different ads through your server - expecting it to behave as an HTTP proxy server. (Maybe your was misconfigured before to be an open proxy.) Instead of sending a: GET /filename.php HTTP/1.1 They're sending a GET http://adhost.com/dir/file HTTP/1.1 This way, "they" will be able to render many ads for their ...


0

This is normal fingerprint scan. Various tools sent direct/odd looking GET requests. It is usually done to detect the type of server and other information. There is no real "magic" here. It can be faked.


2

Apache itself should not serve files outside of its DocumentRoot. However, in your example, the directory traversal is done as a GET parameter to the ssi.html file. A script have access to the filesystem with the same permissions as the user running the web server (nobody or www-data is common). I find it strange that the manual for for SSI should contain a ...


0

Certificates are signed. When a server authenticates clients through certificates, the following three things happen: The client demonstrates mastery of the private key corresponding to the public key which is contained in its certificate. This part happens within SSL; as part of the protocol, a signature is computed by the client over a challenge from the ...


0

These kind of scans are more or less normal nowadays. I sometimes get dozens of them a day. Just make sure your server is hardened, especially the php installation. If you want to be on the safe side you may want to use a web application firewall like http://www.modsecurity.org/


2

Since I use php as an Apache module instead of CGI, and the http code was 404, I think nothing bad happened, right? right What was the attacker trying to do (or, if he was successful, what did he do) to my system? it was probably the first stage in a multi-stage-attacke(script); this is just the first scan, if you system is vulnerable or not.


2

very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501 do you run tomcat/jboss or a similar app-serever? i guess, not. this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting ...



Top 50 recent answers are included