Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

Filter by
Sorted by
Tagged with
0
votes
1answer
77 views

Very Strange Access Request to my website [duplicate]

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
1
vote
0answers
30 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
0
votes
0answers
24 views

ModSecurity won't apply rules - no error log entries [migrated]

I have a fresh installation of CentOS 8. I installed Apache 2.4.37 from the repo. Then installed the latest ModSecurity: dnf install mod_security -y Checked the installation dnf info mod_security ...
2
votes
0answers
28 views

Force Apache Server/Tomcat to ignore Transfer-Encoding

I am trying to reproduce HTTP request smuggling using an Apache HTTP Server as a reverse proxy (using mod_proxy) and a Tomcat Server in the back-end. Is it possible to force either Apache Server or ...
0
votes
1answer
57 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
32 views

Using apache mina for ssh using signed ssh-rsa-cert-01 from Certification Authority

There is an existing client configured and running (SshClient) using apache mina to ssh to one of our internal jump boxes. It currently uses PEM based authentication. Due to compliance we have to ...
3
votes
2answers
254 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
123 views

SSL/TLS client-initiated renegotiation enable

I am researching the CVE-2011-1473 - SSL/TLS client-initiated renegotiation vulnerability, and my goal would be to crash the test environment due to the denial of service vulnerability. My ...
0
votes
1answer
60 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
1
vote
3answers
140 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
1
vote
1answer
122 views

Why is my web site being scanned for license.txt, and should I be worried?

Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
0
votes
0answers
45 views

Vulnerable Apache Tomcat server

I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617. Any Apache Tomcat ...
1
vote
2answers
111 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
1
vote
1answer
51 views

On TLS-enabled nginx/httpd, is “ssl_verify_client optional_no_ca” disabling TLS's “CertificateVerify” checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
0
votes
0answers
54 views

modest 2.9.2 - response body: transformed: dechunked

I would appreciate if someone can point me to the right way solving this Have a POST for a refresh token and modsec closes the connection(?) -- the browser goes into an endless loop back and forth ; ...
0
votes
0answers
68 views

How to use Burp Suite together with The BodgeIt Store?

The BodgeIt Store is a vulnerable web application for studying web development security. It can be downloaded from the internet and installed locally on your computer as a docket container. This web ...
0
votes
1answer
74 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
24
votes
6answers
8k views

Is HTTPS required for local network server to server communication

I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication. Separated REST API servers making requests among each ...
1
vote
0answers
79 views

Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
0
votes
1answer
29 views

can one obtain a file listing from a protected directory when one has not authenticated

I am monitoring a webdav service that has been probed repeatedly since the beginning of February. The Apache 2.4 httpd server hosts just this one application. Access to the application is only ...
1
vote
0answers
76 views

Left port 80 exposed, several IPs accessed phpmyadmin

A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
1
vote
2answers
76 views

Patching session fixation issue on Apache server

I recently ran a Nessus scan on my network, and one of the issues that it revealed is a possible avenue for cookie injection (session fixation) through Javascript. The related Nessus issue can be ...
0
votes
0answers
49 views

.htaccess File Changed - Question About Possible Breach Or Default Defense Mechanism

Today I got reports about one of my websites becoming inaccessible. I've come to learn that at the time we were under DDOS attack. After getting through that, the website started throwing a ...
2
votes
1answer
438 views

Can a user hack a server running apache from a website

Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host ...
0
votes
1answer
66 views

Injecting script from outside for local machine url request

I have setup a local apache server with php module.I deployed a dvwa in my localmachinne..I am learning about XSS(DOM) type of attack.I setup the low level security in dvwa.When i added <script>...
2
votes
0answers
130 views

A bitcoin miner is getting install on my web server with the apache2 process [duplicate]

For a few weeks, someone, probably a bot keep installing a bitcoin miner on my server, I find it because it is taking all the CPU. The process name is kdevtmpfsi located at /tmp/kdevtmpfsi, there's ...
1
vote
1answer
127 views

How did a malicious website managed to serve me the app that is running on my local apache server?

Today I accidentally miss-typed a popular's website domain, which led me to a malicious website. I realized immediately but before I had time to close the tab, I was surprised to be presented with the ...
1
vote
1answer
102 views

How to identify malicious Wordpress user agents

I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress ...
1
vote
1answer
103 views

Modsecurity - OWASP CRS 901001

Ubuntu 18.04 Apache/2.4.29 ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0 modsecurity-crs 3.0.2-1 This is a new server. The following message appears in modsec_audit.log ...
1
vote
1answer
163 views

OCSP multi stapling : how to enable it? Simple stapling is OK

I would like to set up OCSP multi stapling and I can not find a lot of documentation on it, or in any case, recent information. I have a root certificate authority (CA) and a daughter CA below. Both ...
1
vote
2answers
121 views

Using certificate on same server but different port for https

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
2
votes
1answer
589 views

Is it possible to gain RCE from Arbitrary file write by an unprivileged user?

I am pentesting a PHP website running on Apache in a Ubuntu server. I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP ...
1
vote
1answer
227 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
0answers
63 views

Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]

I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
0
votes
0answers
63 views

SElinux blocks rotatelogs when called from an intermediate script

I need to intercept log messages from Apache (used as reverse proxy and authentication gateway). In order to do this reliably, I want to use a CustomLogs configuration to run a python script. This is ...
1
vote
1answer
312 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
0
votes
0answers
100 views

How to read SlowHTTPTest range attack when Nginx is the server?

I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
1
vote
0answers
60 views

apache struts 2 s2-057 does not return shell? [closed]

I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution ...
3
votes
1answer
1k views

Extracting openssl pre-master secret from apache2

I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django. I have seen this post: Extract pre-master ...
0
votes
2answers
110 views

Is there any good reason to move files outside webserver document root?

Let's say I create a website (with apache for example) and my php pages get some sensitive information from a file on disk (a .ini file, a SQLite db or whatever). I thought two ways to prevent users ...
0
votes
2answers
196 views

Some bots are trying to locate files on server, how to protect?

In my apache error log I am getting these errors (there are 100s of these lines), most of these IPs are from China. I guess some bots are trying to find vulnerable files. Is there any way to protect ...
-1
votes
1answer
71 views

In my webserver I found may PHP with random strings [duplicate]

In one of my webserver, I found some new folders got created and many files are there, In access log I found many files access from that folder. Sample file: After this strings: But it I copy ...
0
votes
0answers
128 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
0
votes
2answers
323 views

TSA server with OpenSSL

From OpenSSL documentation of openssl-ts command: HTTP server support is provided in the form of a separate apache module Does anybody know which module is the one? I haven't found any module to ...
0
votes
1answer
69 views

How to access a shared webhosting webpage without the domainname?

I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally I need to access it since the ...
0
votes
1answer
120 views

Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved?

I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
0
votes
1answer
77 views

Rule does not log X-Forwarded-For environment variable

The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far. Here's ...
2
votes
0answers
64 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
1
vote
1answer
67 views

Unusual Get/Connect requests to Apache [duplicate]

Not sure if that has been asked before but over the last week I am getting hundreds of CONNECT and GET requests to my Apache web server for domains that are not on my server. Some are for well known ...

1
2 3 4 5
10