Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

2
votes
0answers
144 views

Does CVE-2019-0211 affect Apache w/ php-fpm?

Intro From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading ...
0
votes
0answers
30 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
2
votes
1answer
53 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
1
vote
0answers
72 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
1
vote
0answers
57 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
-5
votes
2answers
99 views

How do you suppress SSL error messages? [closed]

I noticed that some SSL error messages that are returned back to my browser (firefox) reveals all SSL keys, including the private server keys for sites like Facebook, Google Hangouts, Amazon. How ...
2
votes
0answers
37 views

Drupal logs are reporting 404s from bot visits but I have apache basic auth set up

In the Drupal logs on my dev site there are "page not found" reports that are obviously from a bot trying out well known urls (e.g. /wp-login). But I have set up apache basic auth and I am the only ...
0
votes
0answers
31 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
2
votes
1answer
83 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
0
votes
4answers
169 views

Can my computer get hacked if I use a local server for development only? For example WAMP?

If I use software like WAMP to test and develop my PHP websites, can someone access my computer and steal data or view my in-development websites, or even hack my computer?
0
votes
0answers
29 views

mod security rule to send email on every trigger

I made a script that reads the log file of the modsec 3 module in apache. It sends an email every 5 minutes with new triggers. I discovered that it is also possible to execute a script (e.g. send ...
2
votes
2answers
67 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
2
votes
2answers
72 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
45
votes
5answers
13k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
2
votes
1answer
86 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
0
votes
1answer
167 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
1answer
70 views

NGINX 444 response equivalent for Apache server

How can I configure Apache HTTPD server to send no response and close connection in case of DDoS or malicious request
0
votes
1answer
97 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
1
vote
0answers
68 views

SSL Certificates and Private Key passhprases

I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases. We'd like to implement Microsoft Active Directory ...
2
votes
2answers
111 views

Is it okay to have your SSL cert showing when server is reached by IP?

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you ...
0
votes
1answer
79 views

Apache2 Logs, need help in identifying if it is an attack or not

Are this an example of an attack that had happened to my server? This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all ...
0
votes
1answer
212 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
1
vote
2answers
367 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
0
votes
1answer
901 views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
1
vote
2answers
105 views

apache http https redirect server still listenting on port 80

I have an application that is using Apache. I have install the mod_ssl module for Apache, configured an SSL certificate and because the application provides such function configured http to https ...
1
vote
1answer
668 views

X-Frame-Options header on redirect

I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
2
votes
1answer
168 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
2
votes
1answer
387 views

JBoss Web vulnerabilities [duplicate]

In my organization I found servers running JBoss Web/7.0.13.Final and JBoss Web/7.0.12.Final. I could not find security vulnerabilities for this server's versions, but they seem old to me. How can I ...
1
vote
0answers
72 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
4
votes
1answer
82 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...
0
votes
0answers
90 views

Do NGINX/Apache allow URI (http/ldap) based CRL (revocation list)?

my client certificate provider has a low "validity" period for CRLs, which is of 7 days. AFAIK, that means that I will need to update the CRL file on my web server every 6 days if I want it to work, ...
0
votes
0answers
63 views

Browser Suddenly gets kicked out of client certificate authenticated site on Apache Windows Environment

I have a website in our development environment "Windows / Apache 2.4 server" that has client certificate authentication. When you initially visit the site, it works ok. Since I have multiple client ...
2
votes
1answer
51 views

Storing Apache logs in docroot

I have a client who hosts multiple sites in Apache. They're storing each site's access.log and error.log in the docroot under logs/, and they're publicly accessible via the web. To me, this seems ...
0
votes
0answers
60 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
4
votes
1answer
876 views

How do I decode this hacker payload?

A hacker submitted this via apache $_SERVER["HTTP_IF"]: http://localhost/aaaaaaa潨硣睡焳椶䝲稹䭷佰畓穏䡨噣浔桅㥓偬啧杣㍤䘰硅楒吱䱘橑牁䈱瀵塐㙤汇㔹呪倴呃睒偡㈲测水㉇扁㝍兡塢䝳剐㙰畄桪㍴乊硫䥶乳䱪坺潱塊㈰㝮䭉前䡣潌畖畵景癨䑍偰稶手敗畐橲穫睢癘扈攱ご汹偊呢倳㕷橷䅄㌴...
3
votes
0answers
152 views

Is setting the Apache's TimeOut directive to 3 hours risky?

In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
0
votes
1answer
187 views

Getting a suspicious error in apache error.log (DJANGO)

Using django, I get the following error showing up in my apache errorlog: Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS. But I do not ...
1
vote
0answers
61 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
1answer
465 views

Is there any way to bypass .htaccess PATH restriction (in URLs)?

We use .htaccess to deny direct access to specific file example.com/myfile.txt, by using this configuration: RewriteEngine on RewriteCond %{THE_REQUEST} myfile.txt RewriteRule ^ - [F,L] The ...
1
vote
1answer
1k views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
0
votes
1answer
1k views

How to block proxy servers to access HTTPS based sites [duplicate]

Is there any way to stop/block proxy servers to access https based sites ?. As I have enabled mod_geoip to allow certain countries traffic, to access our critical websites, but still open web ...
2
votes
1answer
340 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
0
votes
2answers
74 views

Is securing Apache with SSL certificates enough to protect all of the underlying applications? [duplicate]

I have a few applications that serve HTTP content on localhost. I have installed apache and configured reverse proxy so that apache routes all the traffic to the underlying applications based on URL ...
0
votes
1answer
70 views

Getting a PHISH/Zmate.omna detection by Avira when I refresh my page, but online website scanners are showing that the page is clean

I'm getting a PHISH/Zmate.omna detection by Avira when I refresh my page, showing that it was put in the chrome cache. But I tried several online website/url scanners, and they are all showing that ...
2
votes
1answer
121 views

How to prevent hackers from accessing .htpasswd & ssl protected areas? [closed]

In spite of precautions, hackers got files of mine. I have a password protected area on my server. I am using AuthType Basic AuthName "Title" AuthUserFile /var/www/vhosts.../.htpasswd Require valid-...
0
votes
2answers
245 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
-1
votes
2answers
3k views

How to bypass .htaccess protection? [closed]

Is there any way to bypass a directory that protected by .htaccess file? I played a challenge in CTF and I could not access the path where the flag is. I tried to access http://www.example.com/flag ...
1
vote
1answer
278 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
8
votes
1answer
1k views

Malformed HTTP requests with repeated protocol (GET /https://https://www.DOMAIN.com) in Apache logs - what vulnerability are they scanning for?

About once per day, I'm seeing the following series of requests in my Apache 2.4 httpd logs, and I'm trying to figure out what vulnerability is being scanned for. Each occurrence of these scans has an ...
3
votes
1answer
409 views

Is mod_reqtimeout a sufficient and safe technique to mitigate Slow HTTP DoS Attacks?

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options. mod_reqtimeout ...