Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

Filter by
Sorted by
Tagged with
1 vote
0 answers
124 views

How to set requests rate limit using Mod Security Rule?

I tried to find a way to limit requests per minute (or other time) using mod security rule in apache, but didn't get success from anywhere. I think it needs more expertise to write such complex rules ...
Rahul Thakkar's user avatar
0 votes
1 answer
63 views

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover. Thus I can increase the impact and get more bounty then what they ...
oo7hacker's user avatar
2 votes
0 answers
89 views

How to retrieve TLS unique value from Apache?

TLS unique value is present in TLS 1.2 version. In Golang, I can get the value of the TLS unique value from the http response through the field TLS. I'd like know how I can get it from Apache. Is ...
MoBe's user avatar
  • 21
0 votes
1 answer
103 views

Does using Apache/nginx actually improve security of a webapp?

Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
BigMistake's user avatar
0 votes
1 answer
226 views

Secure Serving of File Uploads on PHP Server without Root Config Possibilities? (Apache)

To secure the file uploads to a PHP/Apache server, I have already implemented the following steps: Solid upload validation from PHP Framework Used own names for uploaded files Place uploaded files in ...
DevelJoe's user avatar
  • 141
0 votes
2 answers
302 views

How to create custom rules for fail2ban in Apache?

In the last few weeks I've been having some problems with some users who are scanning our server for files, and in those searches they generate a lot of errors. That's why I installed fail2ban, it ...
Tom's user avatar
  • 174
1 vote
1 answer
122 views

Problem Extracting SSL keys from Apache 2.4

I am trying to setup SSL key logging with Apache 2.4 on Ubuntu 22.04. I followed the very good Walkthrough provided by Lekensteyn in this post: Extracting openssl pre-master secret from apache2 What ...
Todd Hight's user avatar
0 votes
0 answers
197 views

Why does metasploit SSL scanner only show highest version available?

I'm trying to scan my server (Apache2 on Debian), which is configured to support only TLS1.2 (and 1.3, presumably?). The config line is: SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1 I scan it with: msf6 &...
Cal-linux's user avatar
  • 113
1 vote
0 answers
144 views

Malicious Mass Email Attack Occurred, Do I Still Have Problem?

I'm using Apache Airflow and I was troubleshooting built-in smtp setup. A mass email occurred on "[email protected]". It was used as a "From:" email in a mass email attack. ...
python_mainly's user avatar
1 vote
0 answers
116 views

Malicious httpd log entry

Besides some other hacking attempts, I am seeing the following kind of log entries in my Apache logs which I cannot fully understand. 5.188.x.x - - [10/Feb/2023:14:40:14 +0100] "GET http://5.188....
fuego's user avatar
  • 11
1 vote
1 answer
142 views

Need help deciphering these logs regarding YASSL attack on MySQL [closed]

I am getting the occasional message from our Fortigate Fortinet firewall, indicating that there is a yaSSL.Buffer.Overflow attack. The log from the Fortinet is: Description: Subject: attack:MySQL....
Zak's user avatar
  • 111
1 vote
1 answer
948 views

How do you disable the RSASSA-PSS cipher in Apache httpd servers linked to OpenSSL?

I have a Java v8 based client provided by an unresponsive vendor that still ships an old JDK where this bug is not yet fixed: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8226374 To work ...
Graham Leggett's user avatar
0 votes
1 answer
231 views

If I create multiple sockets on a single IP and create a connection with the server with each of them, can I do a DDoS?

So basically, if the server is let's say Apache or any other thread based server, so if I create multiple sockets on my machine and request the server until all of its threads get exhausted and try to ...
Eshu Manohare's user avatar
3 votes
1 answer
875 views

Docker Apache - safe to chown /usr/local/apache2 to non-root user?

I would like to run the official Docker Apache image as a non-root user. To make it work, it seems like it is necessary to chown the /usr/local/apache2 directory (see this and this): chown -hR appuser:...
Tando's user avatar
  • 163
1 vote
2 answers
123 views

Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?

This is actually a general question about template engines. If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
Drew's user avatar
  • 135
13 votes
3 answers
7k views

Understanding suspicious HTTP GET Request

I was looking through my Apache log files and besides other GET requests with response status codes of 4XX (error), I've found this one which has a 200 (success) response status code: "GET /?...
Tando's user avatar
  • 163
0 votes
0 answers
360 views

TLS certificate with private IP address [duplicate]

I am trying to get an Apache server running over HTTPS on a local network with an IP address 192.168.. And our requirement is to make this local server secure. (no outside network / internet ...
Jigar's user avatar
  • 1
0 votes
1 answer
612 views

How do I prevent this PHP/Apache exploit?

I'm running: Ubuntu 20.02 Apache/2.4.41 PHP 7.4.3 I am running a simple web server that will accept file uploads, store them and catalog them in a database. When I check /var/log/apache2/error.log, ...
Frank Zyna's user avatar
1 vote
3 answers
296 views

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
blank's user avatar
  • 235
0 votes
1 answer
1k views

apache mod_write RewriteCond %{HTTP_USER_AGENT} Doesn't works

I am trying to redirecto to other machine by filtering the user agent in a apache web server. I have a web server in the machine with the ip 192.168.2.11, but this web server only should send the page ...
P00's user avatar
  • 43
0 votes
1 answer
137 views

IP address in access.log is incorrect and likely hacked

I just noticed in my access.log several POST requests coming from a (hidden) registration sub page that is not accessible via any link. A 'hacker' seems to have posted a form from there (manually it ...
Majte's user avatar
  • 103
2 votes
2 answers
1k views

ModSecurity: Block all IPs except for a list of defined IPs

I have an apache server with ModSecurity. I need to block all IPs except for a few ones. The list of IPs is like this: 194.83.128.0/21 191.143.32.0/19 145.126.72.0/21 101.28.248.0/22 40.64.64.0/22 180....
Jacobo's user avatar
  • 121
1 vote
1 answer
601 views

How to track which php file executed a malware binary

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address ...
MOHAMMAD RASIM's user avatar
1 vote
1 answer
149 views

Possible http information disclosure

We recently had a vulnerability scan that returned an information disclosure that I've never heard about before. The scanning company provided this information. Our researcher used an open source ...
doneal24's user avatar
  • 280
0 votes
3 answers
298 views

successfull log4j exploitation, or just normal traffic?

First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :) I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
dalaix's user avatar
  • 1
0 votes
0 answers
734 views

Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?

From an article for the new Log4j vulnerability, it reads here: A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
Parking Master's user avatar
1 vote
1 answer
5k views

Payload uploaded but error : "no session was created"

I'm doing a capture-the-flag challenge (similar to HackTheBox) and I can't figure it out despite looking at many workarounds how to solve my issue. I did: nmap --> got port 8080 firefox -> 10....
J.erome's user avatar
  • 113
1 vote
1 answer
435 views

How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh. netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
myke's user avatar
  • 13
0 votes
0 answers
240 views

How common is Apache webserver Filesmatch configuration ".+\.ph(p([3457s]|\-s)?|t|tml)"

The OWASP website has a page about Insecure File Uploads which talks about an insecure Apache filesmatch directive: <FilesMatch ".+\.ph(p([3457s]|\-s)?|t|tml)"> SetHandler ...
greggles's user avatar
  • 560
1 vote
1 answer
826 views

Allow access to folder only from specific IP Address (or domain) and Port using .htaccess

I am trying to secure access to a PHP page in a folder and only allow access to it from a specific IP Address and domain name but only on a specific port. I have seen a number of questions here but ...
Tomás's user avatar
  • 111
0 votes
0 answers
126 views

Ad popups showing on personal website deployed on VPS

I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
P13's user avatar
  • 1
0 votes
1 answer
231 views

Suspicious visits to one URL from same user-agent but from unique IPs

For the past few weeks, I am observing a lots of visits from a specific user-agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36 ...
Kannan's user avatar
  • 107
47 votes
3 answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
Rudrakshya Barman's user avatar
3 votes
1 answer
1k views

- Exploit aborted due to failure: not-found: Can't find base64 decode on target

So. I am having some issues at metasploit. I am trying to exploit exploit/multi/http/wp_crop_rce. I am using Docker, in order to install wordpress version: 4.8.9. PHP 7.2.12 (cli) (built: Nov 28 2018 ...
Paul's user avatar
  • 31
1 vote
1 answer
207 views

CGI-BIN - suspicious activity (unknown IP made request)

I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data. This scraping script is placed in cgi-bin folder so ...
java's user avatar
  • 113
0 votes
1 answer
212 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
Corey's user avatar
  • 1
1 vote
0 answers
223 views

apache2 server online, but cannot access it on an Android device [closed]

I am trying to learn Metasploit using Kali Linux on a Virtual Machine. I learned that payloads can be "carried" through an Apache server. But the problem is, when I try to access the Apache ...
euneum's user avatar
  • 11
3 votes
1 answer
327 views

If a malicious PHP file never appears in the Apache log is it safe to assume it never executed?

I've found a couple of suspicious-looking PHP files on my webserver obfuscated by a substantial block of eval. Ideally, I'd like to know what they do, but I'm struggling to decrypt them. Everything ...
somnolentsurfer's user avatar
2 votes
0 answers
696 views

Storing Apache web server's SSL certificate in HashiCorp Vault

This could be basic question as I'm new to this area. I have an apache web server which load balances to a set of servers to provide a web site. The apache server has SSL enabled and we terminate TLS ...
Viraj's user avatar
  • 121
0 votes
1 answer
218 views

How to trace script injection/infection in php app

This is about a PHP7.4 based shopping platform (opencart (v3.0)). For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the ...
ahron's user avatar
  • 423
2 votes
2 answers
478 views

How are hidden private URLs being "leaked" to third parties?

We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
St Flipper's user avatar
1 vote
1 answer
660 views

Is using only secp384r1 and up named groups considered okay?

I found that secp384r1 is supported in almost all web browsers and it is considered secure. My question is: Is it okay if i use only secp384r1 and up named groups? Are there any disadvantages ...
Dimitris Toulis's user avatar
0 votes
0 answers
287 views

Handling file uploads securely in phpmailer/php

I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to ...
Sarcasm's user avatar
1 vote
1 answer
157 views

Apache Settings to Secure Files

In the past I have used two methods for securing files for web apps. Put them outside of webroot (which is usually {www || http}/app). So files would usually be stored outside apache altogether. OR ...
Newb 4 You BB's user avatar
0 votes
1 answer
2k views

Very Strange Access Request to my website [duplicate]

Recently I got a very odd request to my website. This is from the log file: 20.42.89.182 - - [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%...
rich's user avatar
  • 36
1 vote
0 answers
352 views

Explanation for maldetect advice

I received a notice from maldetect on an Apache machine I'm running, and I've not seen an advice like this before. I'd like to get a better understanding of exactly what I am looking at. I received ...
davidgo's user avatar
  • 611
2 votes
0 answers
184 views

Force Apache Server/Tomcat to ignore Transfer-Encoding

I am trying to reproduce HTTP request smuggling using an Apache HTTP Server as a reverse proxy (using mod_proxy) and a Tomcat Server in the back-end. Is it possible to force either Apache Server or ...
Druckles's user avatar
  • 153
0 votes
1 answer
393 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
MeSo2's user avatar
  • 105
3 votes
2 answers
1k views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
Hermann's user avatar
  • 140
0 votes
1 answer
426 views

How to secure user folders on the server from the scripts running in other user folder on the same server?

I have a VPS. There is a web-application running on this VPS. A user can log into his account, create a project (the system automatically creates a folder for this project) and then, he can create and ...
Mee's user avatar
  • 13

1
2 3 4 5
11