Tag Info

New answers tagged

2

Checksums are there just to inform you that nothing has been damaged during download process. You must know that checksums have nothing to do with security features such as encryption. They are there just to be sure with a certain degree that what you got is what you expected. A more secure and better solution is to check the PGP signature as when you try to ...


0

First, there is a problem with your assumption: "My Javascript and PHP validation are pretty good". You can't make such a statement, because you don't know of all the places you missed. Also, client-side valiation (i.e., Javascript) is useless, security-wise. An attacker can simply bypass it by sending you the corresponding HTTP request directly. Now for ...


0

Defense in depth principles ask to disallow directory listing: why ? Because at least it will lead the nefarious person to waste his time and efforts in getting some valuable information that would probably push him to go away. For the sake of one of our clients, we actually succeeded to have full control on his website after getting a precious information ...


3

Having directory listing enabled is not a security vulnerability just by itself. When you don't want the users to look at the content of a file, the webserver should simply not allow them to access it. When your security depends on the attacker not knowing the exact URL of a file, your security concept is flawed ("security through obscurity"). As long as the ...


0

You can easily set iptables rules in your firewall to filter the connexions you want and block the undesired ones. You can use your firewall in conjunction with Fail2ban that will help your server (where you hosted your website) in order to update your iptables rules and reject suspicious IP addresses.


1

You simply can't protect your website from illegetimate requests like this. Consider moving your site behind a service which does packet scrubbing and verifies the legitimacy of the connection. One free service you could have a look at is CloudFlare.


0

Fail2ban is an interesting tool for that. From the official wiki page 1: Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, ...


4

One way to mitigate this issue would be to implement egress filtering on your network. For example most web servers should have no requirement to make connections to the SSH ports of arbitrary hosts on the Internet, so if you block this traffic at the firewall your systems become less useful to attackers Also this can help reduce the risk of compromise in ...


19

The commands themselves don't seem particularly concerning - they're a few random-looking searches for particular substrings. However, if your shell history has unexplainable entries, that's a sign that you've been hacked. At this point, what I would recommend is to check your SSH logs to find out when this occurred (and from what IP), and secure your ...


16

It's several text searches. The first one searches for update.creditcard (the dot is a any-single-character wildcard) across all subfolders. (More detail about grep -rnw on StackOverflow.) And if you or another admin didn't run these commands then I'd be very worried and wipe and reinstall that server. The searches themselves are harmless. But if anybody ...


4

Setting client_max_body_size to 20 GB is, obviously, not reasonable and I wonder why you would allow (users?, yourself?) to upload such very huge files. client_max_body_size governs the corresponding HTTP Header parameter. As a security good practice, we must always limit the header and message body to a minimal reasonable length. Why ? 20 GB is so huge ...


0

Can't we, as a web owner, resolve issue by ourselves? No, simply because you have less bandwidth than your upstream provider... who may have less than a DDoS mitigation service. The attackers throw lots of bandwidth-consuming traffic at you - if you're paying for a 100 Mbps Internet connection, and they throw 1 Gbps traffic at you, you'll be overloaded ...


-3

You can mitigate 99% of the DDOS attacks yourself with a front end load balancer


2

CloudFlare works very well. You can learn more about what they actually do to protect your site from this talk: https://www.youtube.com/watch?v=w04ZAXftQ_Y It's not really possible to deal with such attacks on your own. Maybe in the earlier times, when such attacks were not very sophisticated, you could block off some traffic with your firewall, but now ...


3

Distributed Denial of Service attacks work because they use multiple (sometimes thousands) of hosts sending traffic to your site to overwhelm your resources. This is not something you, as the target, can remedy. Cloud services, like the ones you mentioned, modify and limit the traffic to your site, and to do that, they need access along the path between your ...


-3

Yes, they work. No you cannot generally solve this yourself, but there are things you can do to mitigate SOME of the problem.


2

At least your server wouldn't show up in a simple evil crawler that looks just for these welcome pages. Or if you mask yourself as an Apache, following automatic attacks would hopefully fail. So for a dedicated attack on your server, this makes it maybe just a tiny bit harder. But for automatic attacks this can make the difference.


25

You don't need DNS names to be detectable. The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on. Therefore you must assume, that your IP address has been discovered. You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project. -> Make this a nice demo. Download the ...


19

This might make very casual surfers move on, but anyone running any sort of scan on your server will discover the OS, web server version and running software. For example the nmap http-enum NSE script should detect that Outlook Web Access is running should anyone care to run it against your server. Yes, by all means replace the home page with something ...


6

I agree with you that security by obscurity should never be the primary defense, but I also agree that you should never make it easy for an attacker to detect the services you are running. An attacker would probably first try to figure out the version of your web server by banner grabbing. So you should make sure that IIS is not giving away such information ...


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


2

Are you thinking of a phishing attack? A phishing attack involves tricking a user into entering credentials into a website that looks much like a legitimate one. For example, suppose First World Bank has the domain name of firstworldbank.com. Eve, the attacker, might create firstw0rldbank.com or flrstworldbank.com. She then sends an email to Bob that ...


4

1) There are no security problems. You only have more private keys, which are secure as long as they are not leaked. 2) With HSTS will be no problem, as long as every subdomain has its own certificate, which is trusted, is not revoked and there is not name mismatch.


1

I would guess this is a spider doing cache busting. The get parameter is ignored by the server and client, but since the get parameters are part of the url (as far as the caches are concerned) the url has never been seen before, so it forces a fresh load from the web server.



Top 50 recent answers are included