Tag Info

Hot answers tagged

10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


5

You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it. Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...


4

If you're interested in understanding methods of protection on a more technical level, there are plenty of articles detailing more in depth strategies to protect yourself from a DDOS attack, such as this one from Cisco: http://www.cisco.com/c/en/us/support/docs/security-vpn/kerberos/13634-newsflash.html That being said, you may have noticed that even some ...


4

Your website has been compromised. Any request that includes a URL component listed by you leads to a 301 permanent redirect to a random porn site serving advertisements. GET /phxyy/whatever HTTP/1.1 Host: stratigery.com Accept: */* HTTP/1.1 301 Moved Permanently Date: Sat, 22 Aug 2015 02:17:04 GMT Server: Apache/2.4.16 (Unix) PHP/5.6.12 X-Powered-By: ...


3

I think the vulnerabilities are the same for all Internet-accessible servers, the only increase in risk is that the code exposes some specific information about how to interface with it, and because it is "in code" the programmer might not think to protect it as well as they otherwise might for a server that is explicitly advertised.


3

Will browsers recognize HPKP header on subdomain if I set it only on domain.tld and add includeSubdomains in it? If the user never visits domain.tld and the HPKP header is only send on requests to this domain then the browser will never see the HPKP header. But only after the browser has seen the header it has any effect. Once the browser has seen the ...


3

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform. SQL Authentication is a legacy authentication mechanism that in a properly ...


3

If the web server you are using is correctly configured, you don't have to worry about the actual uninterpreted ASP / PHP files themselves being served out (unless of course the attacker is exploiting a vulnerability somewhere, as you pointed out). If you're especially concerned about code theft it's probably more useful to think about other, more likely ...


3

Option 1 From the basic understanding of the DDOS attacks is that the attacker is sending a lot of data to the web server. Not in every case, the slowloris and SYN flood attacks do not send tons of data yet they are classified as DDoS. Each host attacking the target sends just a little information, enough to clog the victim's network and prevent ...


2

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability. The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is ...


2

If you care about DDOS attacks blocking by IP address will probably not help much, because DDOS means Distributed Denial Of Service and thus is typically caused by a large number of hosts, usually some botnet. In this case there are not only lots of sources for the attack but they also often change over time, so simply blocking by source IP address does not ...


2

Really, the question you are linking to answers your question. These are very brief explanations of why these options wouldn't work. For more detail see the question linked to in your question. Option 1: Even that server has a limit to the number of users it can handle. A DDOS would have to reach that limit to be effective. Option 2: If the entire botnet ...


2

Is there any type of virus or malicious file that can execute on its own without being manually executed? To build on deviantfan's answer, it's important to think about the stages through which a file will progress as it's uploaded to your server and saved to disk. As the client's browser is transferring this file to you, your server will almost ...


2

Is there any type of virus or malicious file that can execute on its own without being manually executed? As long as something is done with a file the content could trigger a bug (or backdoor) in the processing software. This means "Yes", eg. the upload to the server could be enough without you manually clicking on a file. Is it possible or ...


2

Where to place PHP files for security? Put in mind that there is no best place to store your files safely. The safety of your sensible files is only a result of a combination of good measures -such as preventing URL injections that may disclose your sensitive files- you may take and discussed below briefly. My thought is it should follow the ...


2

Basically you are right: on a server you own there is no actual need to place the PHP files in the document root directory. Only is needed some entry point like an index.php file or any other file targeted by your rewrite rules. Once the web-server hand-hovers the request processing to the PHP interpreter, you are not bound anymore by the web-server's ...


1

Using Active Directory for SQL Server has a number of advantages, which makes it the recommended approach. SQL DBAs will often want to have the database in Windows Integrated Authentication (WIA) mode only (instead of "Mixed mode" where SQL Authentication is also support) because of it: When using AD, account authentication is centralized. You have one ...


1

As has already been said, blocking IP's will not work. DDoS attacks are very hard and sometimes impossible to protect against. I would recommend using a service like CloudFlare. The DDoSers themselves use it to protect themselves from their fellow DDoSers. It has a free tier and a paid tier. If what you are protecting is low scale (i.e, smaller than a ...


1

I searched further about your issue and I found that an attacker used an opensource webshell application to execute shell on your server in a variety of common scripting languages such as ASP,ASPX,PHP,JSP,PL and Python. A quick study of that script lead me to know that: $mujj = $_POST['x']; if ($mujj!="") { This checks the password (password to ...


1

It's a PHP shell that reads and evaluates (runs) PHP commands sent to the shell via base64-encoded HTTP-POST messages. It needs some value for x to pass the check, and then the b64-encoded PHP commands sent through the z0 value.


1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


1

At the very core, a denial of service (DoS) means using a service in such a way that disrupts other users use of the service. If a user that is uploading a big file causes the server to exhaust some resources and end up rejecting requests from other users, that's a DoS. A DoS does not require intent of malice. Any service disruptions counts as denial of ...



Only top voted, non community-wiki answers of a minimum length are eligible