Questions tagged [apache]
Questions about the security of Apache open source software, especially Apache HTTP Server
528
questions
0
votes
0
answers
4
views
Apache .htaccess rule to hide folders [migrated]
In .htaccess I'd like to have a rule to find out if a request is to a folder, before Apache redirects to the folder. If it is a forbidden folder, it should display my custom 404 page.
How can I do it?
...
0
votes
1
answer
36
views
Secure Serving of File Uploads on PHP Server without Root Config Possibilities? (Apache)
To secure the file uploads to a PHP/Apache server, I have already implemented the following steps:
Solid upload validation from PHP Framework
Used own names for uploaded files
Place uploaded files in ...
- 129
0
votes
2
answers
75
views
How to create custom rules for fail2ban in Apache?
In the last few weeks I've been having some problems with some users who are scanning our server for files, and in those searches they generate a lot of errors.
That's why I installed fail2ban, it ...
- 174
1
vote
1
answer
44
views
Problem Extracting SSL keys from Apache 2.4
I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04.
I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2
What ...
- 21
0
votes
0
answers
67
views
Why does metasploit SSL scanner only show highest version available?
I'm trying to scan my server (Apache2 on Debian), which is configured to support only TLS1.2 (and 1.3, presumably?). The config line is:
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
I scan it with:
msf6 &...
- 123
1
vote
0
answers
83
views
Malicious Mass Email Attack Occurred, Do I Still Have Problem?
I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack.
...
1
vote
0
answers
69
views
Malicious httpd log entry
Besides some other hacking attempts, I am seeing the following kind of log entries in my Apache logs which I cannot fully understand.
5.188.x.x - - [10/Feb/2023:14:40:14 +0100] "GET http://5.188....
- 11
1
vote
1
answer
73
views
Need help deciphering these logs regarding YASSL attack on MySQL [closed]
I am getting the occasional message from our Fortigate Fortinet firewall, indicating that there is a yaSSL.Buffer.Overflow attack. The log from the Fortinet is:
Description: Subject: attack:MySQL....
- 111
0
votes
1
answer
462
views
How do you disable the RSASSA-PSS cipher in Apache httpd servers linked to OpenSSL?
I have a Java v8 based client provided by an unresponsive vendor that still ships an old JDK where this bug is not yet fixed:
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8226374
To work ...
- 153
0
votes
1
answer
108
views
If I create multiple sockets on a single IP and create a connection with the server with each of them, can I do a DDoS?
So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to ...
3
votes
1
answer
561
views
Docker Apache - safe to chown /usr/local/apache2 to non-root user?
I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this):
chown -hR appuser:...
- 163
1
vote
2
answers
63
views
Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?
This is actually a general question about template engines.
If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
- 125
13
votes
3
answers
6k
views
Understanding suspicious HTTP GET Request
I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code:
"GET /?...
- 163
0
votes
0
answers
251
views
TLS certificate with private IP address [duplicate]
I am trying to get an Apache server running over HTTPS on a local network with an IP address 192.168..
And our requirement is to make this local server secure. (no outside network / internet ...
- 1
0
votes
1
answer
435
views
How do I prevent this PHP/Apache exploit?
I'm running:
Ubuntu 20.02
Apache/2.4.41
PHP 7.4.3
I am running a simple web server that will accept file uploads, store them and catalog them in a database.
When I check /var/log/apache2/error.log, ...
1
vote
3
answers
167
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 235
0
votes
1
answer
630
views
apache mod_write RewriteCond %{HTTP_USER_AGENT} Doesn't works
I am trying to redirecto to other machine by filtering the user agent in a apache web server. I have a web server in the machine with the ip 192.168.2.11, but this web server only should send the page ...
- 43
0
votes
1
answer
97
views
IP address in access.log is incorrect and likely hacked
I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
- 103
2
votes
2
answers
589
views
ModSecurity: Block all IPs except for a list of defined IPs
I have an apache server with ModSecurity. I need to block all IPs except for a few ones.
The list of IPs is like this:
194.83.128.0/21
191.143.32.0/19
145.126.72.0/21
101.28.248.0/22
40.64.64.0/22
180....
- 121
1
vote
1
answer
466
views
How to track which php file executed a malware binary
I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
- 111
1
vote
1
answer
102
views
Possible http information disclosure
We recently had a vulnerability scan that returned an information disclosure that I've never heard about before. The scanning company provided this information.
Our researcher used an open source ...
- 280
0
votes
3
answers
204
views
successfull log4j exploitation, or just normal traffic?
First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :)
I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
- 1
0
votes
0
answers
684
views
Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?
From an article for the new Log4j vulnerability, it reads here:
A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
- 269
1
vote
1
answer
2k
views
Payload uploaded but error : "no session was created"
I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue.
I did:
nmap --> got port 8080
firefox -> 10....
- 113
1
vote
1
answer
250
views
How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs
I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh.
netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
- 13
0
votes
0
answers
185
views
How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"
The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive:
<FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)">
SetHandler ...
- 570
1
vote
1
answer
707
views
Allow access to folder only from specific IP Address (or domain) and Port using .htaccess
I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
- 111
0
votes
0
answers
94
views
Ad popups showing on personal website deployed on VPS
I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
- 1
0
votes
1
answer
170
views
Suspicious visits to one URL from same user-agent but from unique IPs
For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
- 107
47
votes
3
answers
6k
views
Security implications of stolen .git/objects/ files
As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files.
I already modified .htaccess to make .git and ...
3
votes
1
answer
1k
views
- Exploit aborted due to failure: not-found: Can't find base64 decode on target
So. I am having some issues at metasploit.
I am trying to exploit
exploit/multi/http/wp_crop_rce.
I am using Docker, in order to install wordpress version: 4.8.9.
PHP 7.2.12 (cli) (built: Nov 28 2018 ...
- 31
1
vote
1
answer
154
views
CGI-BIN - suspicious activity (unknown IP made request)
I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data.
This scraping script is placed in cgi-bin folder so ...
- 113
0
votes
1
answer
174
views
What exploit is trying to be leveraged here? (Apache access.log)
I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al.
I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
- 1
1
vote
0
answers
150
views
apache2 server online, but cannot access it on an Android device [closed]
I am trying to learn Metasploit using Kali Linux on a Virtual Machine. I learned that payloads can be "carried" through an Apache server. But the problem is, when I try to access the Apache ...
- 11
3
votes
1
answer
284
views
If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?
I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them.
Everything ...
- 131
2
votes
0
answers
588
views
Storing Apache web server's SSL certificate in HashiCorp Vault
This could be basic question as I'm new to this area. I have an apache web server which load balances to a set of servers to provide a web site. The apache server has SSL enabled and we terminate TLS ...
- 121
0
votes
1
answer
170
views
How to trace script injection/infection in php app
This is about a PHP7.4 based shopping platform (opencart (v3.0)).
For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
- 423
1
vote
2
answers
369
views
How are hidden private URLs being "leaked" to third parties?
We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
- 21
1
vote
1
answer
460
views
Is using only secp384r1 and up named groups considered okay?
I found that secp384r1 is supported in almost all web browsers and it is considered secure.
My question is:
Is it okay if i use only secp384r1 and up named groups?
Are there any disadvantages ...
0
votes
0
answers
220
views
Handling file uploads securely in phpmailer/php
I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
- 1
1
vote
1
answer
127
views
Apache Settings to Secure Files
In the past I have used two methods for securing files for web apps.
Put them outside of webroot (which is usually {www || http}/app). So files would usually be stored outside apache altogether.
OR
...
- 137
0
votes
1
answer
2k
views
Very Strange Access Request to my website [duplicate]
Recently I got a very odd request to my website. This is from the log file:
20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
- 36
1
vote
0
answers
283
views
Explanation for maldetect advice
I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
- 593
2
votes
0
answers
135
views
Force Apache Server/Tomcat to ignore Transfer-Encoding
I am trying to reproduce HTTP request smuggling using an Apache HTTP Server as a reverse proxy (using mod_proxy) and a Tomcat Server in the back-end.
Is it possible to force either Apache Server or ...
- 153
0
votes
1
answer
320
views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
- 105
3
votes
2
answers
894
views
User authentication: In HTTP Server vs. in Web Application
Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
- 140
0
votes
1
answer
325
views
How to secure user folders on the server from the scripts running in other user folder on the same server?
I have a VPS. There is a web-application running on this VPS.
A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
- 13
1
vote
3
answers
613
views
Prevent SQL injections on the old PHP website using software
A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
- 113
1
vote
1
answer
494
views
Why is my web site being scanned for license.txt, and should I be worried?
Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
- 113
0
votes
0
answers
595
views
Vulnerable Apache Tomcat server
I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617.
Any Apache Tomcat ...
