3

I have a VPS where I'm hosting a web app built by PHP. Yesterday I Looked to the apache log and I found that someone running a scanner to guess some urls like:

  1. /wp-admin
  2. /joomla
  3. /mysql
  4. and so on

That wasn't a problem for me but today I found some urls that only me know about them and they aren't so easy to guess.

I'm wondering could anyone capture the traffic between me and the server? For more info I live by myself so no one has access to my network to plant a sniffer. Also the IP address of the bad guy is from China and I'm in the US and I'm using HTTPS.

Improve this question
4
  • you are asking a few different questions all at once: 1) yes, it is possible to sniff web traffic at any point between you and your server to discover URLs, 2) if someone has access to the hosting environment, then they can see traffic, 3) there are lots of other ways someone might discover your web directory structure
    – schroeder ♦
    Mar 23, 2016 at 19:34
  • Did you check your computer for malware? Did you find evidence of login attempts and, if so, did they succeed? Most importantly, are you relying on unusual filenames to hide admin stuff and such? This would be bad practice.
    – A. Darwin
    Mar 23, 2016 at 19:36
  • I'm working on Mac OS x so I don't think that it will be infected!
    – MNIF AKRAM
    Mar 24, 2016 at 14:39
  • Thinking that there are no malware for *nix is a horrible trend that needs to stop. The only difference is the number of malware for *nix systems, of which Mac is one. I doubt it's malware, but it is still a good idea to scan it.
    – Robert Mennell
    Mar 25, 2016 at 16:01

2 Answers 2

Reset to default
1

Depends. If the server responded to the PHP Easter eggs they found out you're on PHP. Now they're probably running through a list of common PHP frameworks looking for those URLs. You need to make sure those URLs aren't able to be accessed by anyone other than yourself and your predefined IP address in the .htaccess file. Otherwise they'll eventually find the URLs, and start attacking them to get access.

Best practices for securing a web app

  • Make sure the administrative or any damaging pages can only be accessed from pre-defined static IP addresses that need access
  • Make sure that anyone who shouldn't have access to your website doesn't have access to your website(if it's only for a specific country, limit access using a GEO-IP service)
  • Utilize your services and control devices to lock down as many features of your application/server as you can until it's at a bare minimum use state(block incoming ports you don't need, limit access, limit access rates by IP, so forth and onward)
  • Make sure you aren't leaking data
  • Make sure your SSL is up to date and you don't use out of date vulnerable ciphers

There are a lot of things I've forgotten, but this is a good first few steps.

Improve this answer
4
  • 1
    On the static IP point, ssh port forwarding or socks proxying or a VPN is good if the home IP is dynamic.
    – Phil Lello
    Mar 23, 2016 at 20:09
  • Depending on if they can guarantee the tunnel is always secure. Should be easily doable though. Good catch.
    – Robert Mennell
    Mar 23, 2016 at 20:13
  • for the ssh I'm using a public and private key so I don't think that he can break through! Also my home IP address is Dynamic.
    – MNIF AKRAM
    Mar 24, 2016 at 14:33
  • IF the home IP address is dynamic and that's the only place you're accessing it from, pay the extra money and make it static. Then IP limit access to those pages. Contact your DNS and ask about making your IP static.
    – Robert Mennell
    Mar 24, 2016 at 18:22
0

It's a VPS, so there's the risk of someone on the hosting side grabbing your cert and scanning the filesystem. There's also the risk of poor isolation from other customers who might do the same.

There's a risk of a trojan on your client machine.

There's a risk of someone spoofing the IP in the logs, or proxying via China.

There's a risk your URLs aren't as unguessable as you think.

If there's no evidence of intrusion, I wouldn't worry too much. Presumably you're not using a VPS for anything particularly confidential.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .