Questions about the security of Apache open source software, especially Apache HTTP Server

learn more… | top users | synonyms

1
vote
1answer
23 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL?

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
1
vote
4answers
39 views

Remove possibility to read system files with PHP from Apache

When I upload a php file (file.php) with following content on Apache server <?php $file = $_GET['file']; include ( $file); ?> I am able to read any file of Apache using the below URLs http://...
0
votes
0answers
31 views

Apachelog with requests from University of California and RIPE

I have a VPS with a dedicated IP running. The only purporse of this machine is to serve a Wordpress website and to learn more about networking. I have been playing around with the machine. I got to ...
-1
votes
0answers
23 views

Client-initiated renegotiation on Apache httpd.conf

During testing we have found that one of our servers has this vulnerability and can any one of you let me know how to fix this issue. We use Apache 2.X version. Is there any variable which can be set ...
2
votes
1answer
42 views

Unsecure to allow all headers? [closed]

I'm currently developing an webapp. For testing and developing I allowed all Headers. Is this unsecure for productive use? Header unset Connection Header unset Time-Zone Header unset Keep-Alive ...
-2
votes
0answers
23 views

How to recognize if Apache HTTPD certificate uses a passphrase?

I need to recognize if Apache HTTPD certificate uses a passphrase during executing of some script. It is not the case when I have the SSLPassPhraseDialog directive in the HTTPD configuration (http://...
0
votes
1answer
37 views

SSL warnings while using Origin Certificate on my VPS

I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077. My URL is like this: https://socket....
26
votes
3answers
5k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
0
votes
0answers
103 views

Why can't I redirect my https:// domain to another https:// domain on the same IP address without a security exception? [migrated]

After some internet searches, I've determined that the HTTP request sent before the SSL connection dictates to the browser which IP address the domain is registered against. As a result, any forced ...
1
vote
1answer
24 views

Modsecurity Encrypted traffic in 3 tier architecture

The scenario is that we have 3 tier architecture DMZ > BEA > DB with end to end encryption the data is encrypted within DMZ > BEA > DB. I have read that modsecurity doest deal with encrypted traffic ...
1
vote
0answers
66 views

Executing arbitrary code with cat command when reading access.log

I made this file based on a combination of hexadecimal that can breakcat and the terminal showing the file with cat, and the reset command does not work anymore: Download Cat Killer Version 1 To ...
0
votes
0answers
102 views

Apache Web Server ETag Header Information Disclosure Weakness

How this vulnerability allow remote attackers to obtain sensitive information likes inode number and child process though ETag header ? and how to locate path to a file from inode number ?
1
vote
1answer
34 views

What are the implication of having Apache Tomcat servlets available publicly?

While testing a website which had Apache Tomcat running, I came across a directory called "Examples" which contained "Servlet Examples", "JSP Examples" and "Websocket Examples". What do you think are ...
1
vote
2answers
78 views

Tracing origin of malicious PHP script

I'm looking at a Linux server running Apache + mod_php. A malicious PHP script was uploaded during the night. It's owned by the Apache user and I would think it almost certain that the script was ...
0
votes
1answer
83 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
9
votes
1answer
140 views

Very long HEAD request in server logs: What is the intention?

I'm getting logs like (using Apache server): 119.131.152.148 - - [20/Apr/2016:18:17:47 +0900] "HEAD /?...
3
votes
1answer
14 views

Is this HSTS header set correctly in LAMP?

I have a LAMP server and my SSL certificate provider recommended me to set HSTS header as follows. I am wondering about two things. Header always set Strict-Transport-Security "max-age=63072000; ...
1
vote
0answers
70 views

HTTPS: Same certificate, different public key

I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT ...
3
votes
0answers
97 views

One-time mystery redirect from one of our pages

I'll make the explanation of the situation as thorough as I can, and the question is at the bottom. Recently, we received a report from one of our users that, immediately after logging out of our ...
2
votes
1answer
41 views

Malicious link? Apache?

I've got a link from spammer, the link is very strange, but after redirects I got the web page full of ads. Here is the link(doesn't require "http://"): /0xD805A9E4///RLI=590-UI=273411771-OI=6313-...
3
votes
1answer
86 views

Hosting multiple websites securely

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate ...
2
votes
1answer
117 views

Is this way of client-side SSL secure enough, to keep hackers away from my web app?

I'm wonderying if the following steps are enough to protect my cloud service, in a meaning that non-authorized users can not play with my web app? In other words, is it possible to bypass this kind ...
1
vote
2answers
102 views

“CHANGELOG.txt” in Apache logs

Recently I've been seeing a major uptick in the following type of requests to my Apache logs: "GET /CHANGELOG.txt HTTP/1.1" 404 211 About a month ago, I received none. Now I receive a dozen or ...
4
votes
2answers
453 views

I think my site was hacked. Can someone explain the “GET / HTTP/1.0” garbage in my Apache log, and what it's doing?

Please see below the log entry from the hack, I have decoded the base_64 code and ultimately some files are dropped onto the server and a directory listing becomes available among other niceties! ...
3
votes
2answers
138 views

My Apache server is regularly challenged with vulnerability attacks: Do I need to worry?

When I look into my access logs: I find a lot of suspicious activity that looks like attempts to gain administrative access to my system using vulnerabilities from known web software products such as ...
17
votes
1answer
2k views

Why am I receiving HTTP GETs for a domain I don't own?

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these: 94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 ...
3
votes
0answers
86 views

What is the best way to lock down web service access permissions?

After everything what I did in order to protect my server, i have uploaded webshell (WSO 2.1 Web Shell) , to see how far can hacker go and gues what, I was shocked, because I was able to read very ...
1
vote
0answers
102 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
66
votes
3answers
7k views

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I currently run an Apache HTTP server, and have set up monitoring to receive emails whenever an error appears in the error logs. I get the usual trying to find if I'm using HTTP 1.0 and trying to see ...
0
votes
1answer
424 views

Strange access in apache's access.log

Does anyone know what that means? I found those today on apache's access logs. Thanks! XX.82.64.68 - - [18/Jan/2016:14:30:45 -0800] "GET /wp-content/themes/Akhbar24/images/alemarah.jpg HTTP/1.0" 404 ...
3
votes
1answer
86 views

Unusual potential vulnerability scan results in Apache logs

Recently I've been seeing entries similar to the following in my Apache access logs. I've replaced the IP address and time with Xs: access_log:xx.xx.xx.xx - - [xx/xx/xx:xx:xx:xx -0100] "GET /js/query-...
5
votes
1answer
67 views

HSTS Strict Transport Security: Include base domain

I configured my apache webserver to use HSTS Strict Transport Security. If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security ...
2
votes
2answers
164 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
6
votes
3answers
132 views

Crawler massively changing user-agent

This morning I noticed a single IP-address was kinda crawling my website, though it was querying the same page many times in a few minutes. Then I noticed that it was doing that with different user-...
1
vote
2answers
64 views

Do secure ciphers break multi-domain certificates?

In the past days, I was halfway successful with securing my websites. So far, I have achieved the following: Get a certificate from letsencrypt.org, securing the domains example1.com, example2.com ...
1
vote
1answer
82 views

phpBB under nginx, htaccess protection is lost – what are the risks?

I'm running phpBB 3.1 on a server that uses nginx not Apache, and due to this, none of the phpBB .htaccess files work, and so files in the document root that are normally protected under Apache, are ...
1
vote
3answers
162 views

Strongest cipher suite in apache 2.4

I am trying to use only the strongest ciper suite available, from the documentation I tried: SSLCipherSuite HIGH:!aNULL:!MD5 But the browser says that it is obsolete: What is the strongest one ...
4
votes
4answers
105 views

Secure environment for servers with sensitive private data

I am developing a web application that will expose a public API to the world, but will store very, very sensitive personal, private data. Having the content hacked would be fatal. I will be using the ...
1
vote
1answer
75 views

Are exposed php class files a security vulnerability?

I'm currently trying to make an old PHP web application a little bit more secure. Currently, the apache setup is such that all of the application's class files are available for user access (although ...
2
votes
1answer
197 views

What ciphersuites does Java 6 support out of the box that are not broken?

I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4. (An upgrade for Java 6 is on the cards, but not before go-live date.) We have pentest fails for a weak ...
5
votes
1answer
798 views

Is it safe to email the contents of your .htaccess?

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file? I'm a novice in this ...
-3
votes
2answers
218 views

attack on port 80 [closed]

I have a ubuntu ec2 instance server hosting apache2 site & tomcat7 at back end. According to apache logs I have doubt there malicious attack ! Please can anyone confirm it & what can i do to ...
4
votes
1answer
34 views

Is it alright to put .htpasswd in the protected directory if there's just one user?

I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory: Make sure that the ...
-3
votes
2answers
94 views

Is it possible to stop an SSL Certificate from being portable between servers? [closed]

From what I read it seems that the certificate isn't a big deal since it's already public, and downloaded by every browser, however if someone gets hold of your key file, then you have an issue.
3
votes
1answer
162 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
1answer
84 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
-3
votes
1answer
44 views

LFI attacks auth.log , environ , passwd [closed]

paths like /proc/self/environ , /etc/passwd and /var/log/auth.log are targeted by the attackers. how can I hide those files ( passwd ) ( environ ) ( auth.log ) to be not include in LFI attack
1
vote
1answer
116 views

Strange Log in Apache

I found in my Apache log something strange in requested URL / method request (I suspect an attempt to hack): \x1b\x95J\xe2h\xa7\xcfj\xe1`\x85R\x1f\x98\x9e\xcf\xdedFM(\xa8\xbcc\xc0P\xd9::e\xed\xaa~...
2
votes
0answers
44 views

Cloned site with tricky HTTP_HOST

Another site has cloned mine. The site in question is netdna-cdn.com, and if you do a search on Google ("site:netdna-cdn.com") you will see it has cloned 100's if not 1000's of sites. So in times ...
4
votes
1answer
69 views

What attacks new Apache 2.0 vulnerable to?

I am new to Security field and still learning how all the attacks works. for my testing, I have implemented Apache 2.0 on a Cent OS virtual machine. I have created another machine using FreeBSD, ...