Tag Info

New answers tagged

2

Where to place PHP files for security? Put in mind that there is no best place to store your files safely. The safety of your sensible files is only a result of a combination of good measures -such as preventing URL injections that may disclose your sensitive files- you may take and discussed below briefly. My thought is it should follow the ...


0

Place your public files in a folder called public and point your domain name to this folder using apache virtual host, other non-public files should be in folders above the public folder and you can refer to them by include_path for example. This is how most frameworks are structured.


2

Basically you are right: on a server you own there is no actual need to place the PHP files in the document root directory. Only is needed some entry point like an index.php file or any other file targeted by your rewrite rules. Once the web-server hand-hovers the request processing to the PHP interpreter, you are not bound anymore by the web-server's ...


1

As has already been said, blocking IP's will not work. DDoS attacks are very hard and sometimes impossible to protect against. I would recommend using a service like CloudFlare. The DDoSers themselves use it to protect themselves from their fellow DDoSers. It has a free tier and a paid tier. If what you are protecting is low scale (i.e, smaller than a ...


2

If you care about DDOS attacks blocking by IP address will probably not help much, because DDOS means Distributed Denial Of Service and thus is typically caused by a large number of hosts, usually some botnet. In this case there are not only lots of sources for the attack but they also often change over time, so simply blocking by source IP address does not ...


4

If you're interested in understanding methods of protection on a more technical level, there are plenty of articles detailing more in depth strategies to protect yourself from a DDOS attack, such as this one from Cisco: http://www.cisco.com/c/en/us/support/docs/security-vpn/kerberos/13634-newsflash.html That being said, you may have noticed that even some ...


2

Is there any type of virus or malicious file that can execute on its own without being manually executed? To build on deviantfan's answer, it's important to think about the stages through which a file will progress as it's uploaded to your server and saved to disk. As the client's browser is transferring this file to you, your server will almost ...


2

Is there any type of virus or malicious file that can execute on its own without being manually executed? As long as something is done with a file the content could trigger a bug (or backdoor) in the processing software. This means "Yes", eg. the upload to the server could be enough without you manually clicking on a file. Is it possible or ...


1

I searched further about your issue and I found that an attacker used an opensource webshell application to execute shell on your server in a variety of common scripting languages such as ASP,ASPX,PHP,JSP,PL and Python. A quick study of that script lead me to know that: $mujj = $_POST['x']; if ($mujj!="") { This checks the password (password to ...


1

It's a PHP shell that reads and evaluates (runs) PHP commands sent to the shell via base64-encoded HTTP-POST messages. It needs some value for x to pass the check, and then the b64-encoded PHP commands sent through the z0 value.


4

Your website has been compromised. Any request that includes a URL component listed by you leads to a 301 permanent redirect to a random porn site serving advertisements. GET /phxyy/whatever HTTP/1.1 Host: stratigery.com Accept: */* HTTP/1.1 301 Moved Permanently Date: Sat, 22 Aug 2015 02:17:04 GMT Server: Apache/2.4.16 (Unix) PHP/5.6.12 X-Powered-By: ...


3

If the web server you are using is correctly configured, you don't have to worry about the actual uninterpreted ASP / PHP files themselves being served out (unless of course the attacker is exploiting a vulnerability somewhere, as you pointed out). If you're especially concerned about code theft it's probably more useful to think about other, more likely ...


5

You are correct that this is not possible without mis-configuration or security vulnerabilities that allow it. Generally, the most likely culprits when it comes to coughing up application code are commented out code, backup files that have extensions allowing them to be delivered directly to clients without processing, and probably more likely that all ...


1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


10

There is no magic in there: the user will see what the web server sends, and the web server will send what you tell it to send. You said that both URLs will share the same IP using a DNS CNAME entry, so you will encounter a different behavior depending on the browser supports SNI or not. SNI is supported by all decently recent browsers and allows them to ...


2

A script or bot is probably probing for an Unvalidated Redirects and Forwards vulnerability. The reason I say this over SSRF is because the target domain is pastbin.com, and not a domain under control of the attacker. The attacker will have no way of knowing if a SSRF attack worked without validating that the server-side request was made, therefore this is ...


1

You can opt for protection from a scrubbing service by placing your applications behind a packet scrubbing service like Akamai or CloudFlare. These CDN's will take the hit for you normally before it reaches you.


5

EDIT - Updated based on comments from @AdmSelec below and info from GlobalSign Whilst usually when that error pops up it'll likely relate to SHA-1 hashing, in this case it appears more likely that it relates to a bug in Chromium on OSX (details here). Whilst the screenshot displayed doesn't show the certificate itself it does show information on the ...


3

One possibility would be to try the Internet Archive or similar to check what the site looked like in the past. You may then be able to pin point when there was the change, and whether it was legitimate in the past. You'll probably also want to look at the date the domain was first registered. Was it some years ago, or more recently? If a longer time ago, ...


0

It looks like an automated probe for information on what could be running on your server. Like mentioned, not worth going to the police and report them to their ISP's abuse email. I felt compelled to answer when the top answer suggested to ignore it. Don't ignore it! Even though it is a blind attack you should still not brush it off and do nothing. ...


4

My guess for this would be that the person has made a mistake and did not intend to set the web server to be the IP address of your site. It could be that they were intending to park the domain and got the IP address wrong In terms of security risks, the main one might be that the content of your site appears under their domain name, but that doesn't sound ...


5

While it could be part of some attack, my suspicion is that it was a mistake. Perhaps the registrant had that IP previously. You'll have to check your VPS company's/plan's details. You may have a fixed IP or a variable one (not likely). Even with a fixed IP, the VPS provider likely gave that IP to a previous VPS user. However it happened, they need to get a ...


0

A checksum can be provided for the following reasons: to validate that the download is complete; to validate that you are looking at the correct download (later in time); to make sure that a third party download service (proxy, torrent etc) provides you with a valid download. HTTPS helps you with two things: to make sure you connect to the right server ...



Top 50 recent answers are included