Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Chain apache web server acting like reverse proxys using proxychains

I've configure multiple apache web servers so they filter the request and if they have a specific request_uri the request would be redirect to a c2 server. I do that with the next line in the apache ...
user avatar
  • 5
0 votes
0 answers
11 views

ProxyPassMatch redirect to the same request uri

I am doing a reverse proxy with apache to redirect https traffic filtering by the uri request. Right now I have the next ProxyPassMatch "^/thisisthepath$" "https:192.168.1.40/...
user avatar
  • 5
0 votes
0 answers
6 views

Redirect to other ip but the same query whit Apache mod_rewrite [migrated]

I have to redirect the request that a Apache web server receives, using the user_agent to filter. The idea is that if the user_agent is "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/...
user avatar
  • 5
0 votes
1 answer
30 views

apache mod_write RewriteCond %{HTTP_USER_AGENT} Doesn't works

I am trying to redirecto to other machine by filtering the user agent in a apache web server. I have a web server in the machine with the ip 192.168.2.11, but this web server only should send the page ...
user avatar
  • 5
0 votes
1 answer
75 views

IP address in access.log is incorrect and likely hacked

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
user avatar
  • 103
2 votes
0 answers
108 views

How do I remove/disable the CBC cipher suites in Apache server? [migrated]

I tried the settings below to remove the CBC cipher suites in Apache server, SSLProtocol -all +TLSv1.2 +TLSv1.3 SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-...
user avatar
1 vote
1 answer
41 views

ModSecurity: Block all IPs except for a list of defined IPs

I have an apache server with ModSecurity. I need to block all IPs except for a few ones. The list of IPs is like this: 194.83.128.0/21 191.143.32.0/19 145.126.72.0/21 101.28.248.0/22 40.64.64.0/22 180....
user avatar
  • 111
0 votes
0 answers
24 views

Information Disclosure issue in WildFly and Apache Web Server

We are working in an environment where UI Requests flow to a WildFly Server (where the WAR is deployed) version 10.1.0 via an Apache Web Server version 2.4 We were running Security tests and when ...
user avatar
2 votes
1 answer
120 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
user avatar
0 votes
0 answers
8 views

FreeRadius and Apache Mutual authentication

I set EAP-TLS on my FreeRadius server, and i want to try the certificate-based authentication for a testing. I set up an Apache as a webservice and enabled ssl on it. I could redirect the basic ...
user avatar
1 vote
1 answer
65 views

Possible http information disclosure

We recently had a vulnerability scan that returned an information disclosure that I've never heard about before. The scanning company provided this information. Our researcher used an open source ...
user avatar
  • 281
0 votes
3 answers
161 views

successfull log4j exploitation, or just normal traffic?

First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :) I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
user avatar
  • 1
0 votes
0 answers
573 views

Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?

From an article for the new Log4j vulnerability, it reads here: A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
user avatar
1 vote
1 answer
155 views

Payload uploaded but error : "no session was created"

I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue. I did: nmap --> got port 8080 firefox -> 10....
user avatar
  • 113
1 vote
1 answer
79 views

How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh. netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
user avatar
  • 13
1 vote
0 answers
100 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler ...
user avatar
  • 570
1 vote
1 answer
250 views

Allow access to folder only from specific IP Address (or domain) and Port using .htaccess

I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
user avatar
  • 111
0 votes
0 answers
88 views

Ad popups showing on personal website deployed on VPS

I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
user avatar
  • 1
0 votes
1 answer
154 views

Suspicious visits to one URL from same user-agent but from unique IPs

For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
user avatar
  • 107
47 votes
3 answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
user avatar
3 votes
1 answer
514 views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
user avatar
  • 31
1 vote
1 answer
140 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
user avatar
  • 113
0 votes
1 answer
136 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
user avatar
  • 1
1 vote
0 answers
104 views

apache2 server online, but cannot access it on an Android device [closed]

I am trying to learn Metasploit using Kali Linux on a Virtual Machine. I learned that payloads can be "carried" through an Apache server. But the problem is, when I try to access the Apache ...
user avatar
  • 11
3 votes
1 answer
205 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
user avatar
2 votes
0 answers
395 views

Storing Apache web server's SSL certificate in HashiCorp Vault

This could be basic question as I'm new to this area. I have an apache web server which load balances to a set of servers to provide a web site. The apache server has SSL enabled and we terminate TLS ...
user avatar
  • 121
0 votes
1 answer
144 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
user avatar
  • 413
1 vote
2 answers
230 views

How are hidden private URLs being "leaked" to third parties?

We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
user avatar
1 vote
1 answer
217 views

Is using only secp384r1 and up named groups considered okay?

I found that secp384r1 is supported in almost all web browsers and it is considered secure. My question is: Is it okay if i use only secp384r1 and up named groups? Are there any disadvantages ...
user avatar
0 votes
0 answers
148 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
user avatar
1 vote
1 answer
113 views

Apache Settings to Secure Files

In the past I have used two methods for securing files for web apps. Put them outside of webroot (which is usually {www || http}/app). So files would usually be stored outside apache altogether. OR ...
user avatar
0 votes
1 answer
2k views

Very Strange Access Request to my website [duplicate]

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
user avatar
1 vote
0 answers
196 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
user avatar
  • 593
2 votes
0 answers
103 views

Force Apache Server/Tomcat to ignore Transfer-Encoding

I am trying to reproduce HTTP request smuggling using an Apache HTTP Server as a reverse proxy (using mod_proxy) and a Tomcat Server in the back-end. Is it possible to force either Apache Server or ...
user avatar
  • 143
0 votes
1 answer
211 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
user avatar
  • 105
3 votes
2 answers
541 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
user avatar
  • 140
0 votes
1 answer
173 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
user avatar
  • 13
1 vote
3 answers
472 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
user avatar
1 vote
1 answer
223 views

Why is my web site being scanned for license.txt, and should I be worried?

Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
user avatar
  • 113
0 votes
0 answers
271 views

Vulnerable Apache Tomcat server

I am a bug bounty hunter. When doing some research, I found a subdomain that is using Apache Tomcat. Talk about Tomcat, there was a vulnerability found in 2017: CVE-2017-12617. Any Apache Tomcat ...
user avatar
1 vote
2 answers
295 views

Does Apache Tomcat 9 meet PCI compliance?

Does Apache Tomcat 9 meet PCI compliance? From where I should start reading and gather some information about that topic?
user avatar
  • 11
1 vote
1 answer
332 views

On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
user avatar
  • 11
0 votes
0 answers
220 views

How to use Burp Suite together with The BodgeIt Store?

The BodgeIt Store is a vulnerable web application for studying web development security. It can be downloaded from the internet and installed locally on your computer as a docket container. This web ...
user avatar
  • 101
0 votes
1 answer
191 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
user avatar
24 votes
6 answers
14k views

Is HTTPS required for local network server to server communication

I am building web applications for my customer's company. At the server side, there will be 2 kinds of server to server network communication. Separated REST API servers making requests among each ...
user avatar
1 vote
0 answers
441 views

Is it possible to bypass .htacess protection?

So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
user avatar
0 votes
1 answer
72 views

can one obtain a file listing from a protected directory when one has not authenticated

I am monitoring a webdav service that has been probed repeatedly since the beginning of February. The Apache 2.4 httpd server hosts just this one application. Access to the application is only ...
user avatar
1 vote
0 answers
119 views

Left port 80 exposed, several IPs accessed phpmyadmin

A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
user avatar
  • 111
1 vote
2 answers
267 views

Patching session fixation issue on Apache server

I recently ran a Nessus scan on my network, and one of the issues that it revealed is a possible avenue for cookie injection (session fixation) through Javascript. The related Nessus issue can be ...
user avatar
2 votes
1 answer
2k views

Can a user hack a server running apache from a website

Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host ...
user avatar

1
2 3 4 5
11