Tag Info

Hot answers tagged

25

You don't need DNS names to be detectable. The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on. Therefore you must assume, that your IP address has been discovered. You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project. -> Make this a nice demo. Download the ...


19

This might make very casual surfers move on, but anyone running any sort of scan on your server will discover the OS, web server version and running software. For example the nmap http-enum NSE script should detect that Outlook Web Access is running should anyone care to run it against your server. Yes, by all means replace the home page with something ...


19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


6

I agree with you that security by obscurity should never be the primary defense, but I also agree that you should never make it easy for an attacker to detect the services you are running. An attacker would probably first try to figure out the version of your web server by banner grabbing. So you should make sure that IIS is not giving away such information ...


4

1) There are no security problems. You only have more private keys, which are secure as long as they are not leaked. 2) With HSTS will be no problem, as long as every subdomain has its own certificate, which is trusted, is not revoked and there is not name mismatch.


4

Setting client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files. client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge ...


4

One way to mitigate this issue would be to implement egress filtering on your network. For example most web servers should have no requirement to make connections to the SSH ports of arbitrary hosts on the Internet, so if you block this traffic at the firewall your systems become less useful to attackers Also this can help reduce the risk of compromise in ...


3

Having directory listing enabled is not a security vulnerability just by itself. When you don't want the users to look at the content of a file, the webserver should simply not allow them to access it. When your security depends on the attacker not knowing the exact URL of a file, your security concept is flawed ("security through obscurity"). As long as the ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


2

Are you thinking of a phishing attack? A phishing attack involves tricking a user into entering credentials into a website that looks much like a legitimate one. For example, suppose First World Bank has the domain name of firstworldbank.com. Eve, the attacker, might create firstw0rldbank.com or flrstworldbank.com. She then sends an email to Bob that ...


2

At least your server wouldn't show up in a simple evil crawler that looks just for these welcome pages. Or if you mask yourself as an Apache, following automatic attacks would hopefully fail. So for a dedicated attack on your server, this makes it maybe just a tiny bit harder. But for automatic attacks this can make the difference.


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


2

Checksums are there just to inform you that nothing has been damaged during download process. You must know that checksums have nothing to do with security features such as encryption. They are there just to be sure with a certain degree that what you got is what you expected. A more secure and better solution is to check the PGP signature as when you try to ...


1

You simply can't protect your website from illegetimate requests like this. Consider moving your site behind a service which does packet scrubbing and verifies the legitimacy of the connection. One free service you could have a look at is CloudFlare.


1

I would guess this is a spider doing cache busting. The get parameter is ignored by the server and client, but since the get parameters are part of the url (as far as the caches are concerned) the url has never been seen before, so it forces a fresh load from the web server.



Only top voted, non community-wiki answers of a minimum length are eligible