1

I know that if you are using software for your website like wordpress, ip-board etc. there can be like in every software vulnerabilities.

But what if you just have an apache server and a simple index.html with really simple html code. Can there be vulnerabilities? I ask because I've seen a site that looked really, really simple, that was hacked and some other stuff was put on like "Hacked by.....".

  • You still need a way to update this HTML, and that is a point of weakness. – rook Dec 5 '14 at 16:57
3

Simple static HTML protects you for things such as sql injections and many common forms of hacking but it does not protect you from flaws in Apache or bad rights assignment to the Apache service user. This is where rights escalation comes in if you can break Apache server itself. That being said Apache is very mature so a current stable version will probably be pretty secure as long as you follow best practices with setting it up.

The other side to look for is the OS and making sure that is hardened as well, in other words static pages does not relieve you from due diligence with hardening the OS and application. In the end Apache is just an application, just like Wordpress or any of these other Web based services, so you have to be aware.

Hope that helps

  • Might be important to remember that, although Apache core is quite secure, there are many (popular) modules for Apache which are of crap quality, which is one big thing giving this particular web server a bad name. – forest Dec 21 '17 at 6:03
2

It all depends on what is written in the HTML. Is there code such as php, asp, .net. It can also depend on the server, is the version of whatever software your using (e.g. Apache, IIS, nginx) vulnerable. There is more to it then what you may think. Also, are there other means to get into the server? (SSH, FTP, RDP, VNC). Is it easy to determine a possible username? If so, can we also attempt a bruteforce against the server, or will connections be blocked after N amount of attempts.

When you configure your server, you need to take into account a bit of information:

  • "What is the purpose of this server? If it just a webserver, if so, do I solely run httpd, or do I also need SSH access.
  • "If I need SSH access, will I always be accessing the server from a dedicated address, or a dynamic one? Can I block (firewall) all and allow just me?"
  • "If I am going to use PHP, is it something I have written, or is it written by someone else? Has the code been tested for security vulnerabilities (tampering, injection, etc)"

There are many variables to consider when putting up a webserver besides worrying only about the code.

1

Apache is software too, and can have vulnerabilities. Having a simpler "attack surface" does help reduce exposure to vulnerabilities, but it doesn't make you invulnerable.

  • Thank you Graham :) So Apache would be the only vulnerability? Can html be vulnerable? Can there be bufferoverflow? – Joey Dec 5 '14 at 16:56
  • HTML is just a file format, the vulnerability would be in the server software that renders them; which would be apache here. (Also, you almost certainly have other things besides the web server listening to the network on the server, which may have their own vulnerabilities.) – Graham Hill Dec 5 '14 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.