Questions tagged [apache]

Questions about the security of Apache open source software, especially Apache HTTP Server

Filter by
Sorted by
Tagged with
1
vote
2answers
89 views

Using certificate on same server but different port for https

I have taken a working HTTPS certificate from a server that I want to use on the same server, just on a different port. The certificate has a Subject Alternative Name defined in it. Using keytool, I ...
1
vote
1answer
64 views

Is it possible to gain RCE from Arbitrary file write by an unprivileged user?

I am pentesting a PHP website running on Apache in a Ubuntu server. I found a vulnerability that allows me to write files to the target system. I know it's possible to write a php shell to the HTTP ...
0
votes
1answer
76 views

File extensions that should NOT be allowed to be uploaded

I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted? Running LAMP/WAMP the most obvious I'...
0
votes
0answers
13 views

Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]

I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
0
votes
0answers
39 views

SElinux blocks rotatelogs when called from an intermediate script

I need to intercept log messages from Apache (used as reverse proxy and authentication gateway). In order to do this reliably, I want to use a CustomLogs configuration to run a python script. This is ...
1
vote
1answer
59 views

Avoid cross site scripting in XML namespace

We have a legacy application on spring mvc and we have a web service exposed (SOAP protocol) for some reporting client app. This service was tested by a security team and the report indicates that the ...
0
votes
0answers
40 views

How to read SlowHTTPTest range attack when Nginx is the server?

I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
1
vote
0answers
48 views

apache struts 2 s2-057 does not return shell? [closed]

I do a pentest for a private server protected by Cloudflare. I bypassed the WAF and got the real IP for the server, then I scanned it with Acunetix and I found: Apache Struts2 Remote Command Execution ...
1
vote
1answer
162 views

Extracting openssl pre-master secret from apache2

I would like to be able to decrypt my server's https traffic for debugging and analysis. My server is a debian 9 Apache2 server running mod_wsgi and django. I have seen this post: Extract pre-master ...
0
votes
2answers
73 views

Is there any good reason to move files outside webserver document root?

Let's say I create a website (with apache for example) and my php pages get some sensitive information from a file on disk (a .ini file, a SQLite db or whatever). I thought two ways to prevent users ...
0
votes
2answers
161 views

Some bots are trying to locate files on server, how to protect?

In my apache error log I am getting these errors (there are 100s of these lines), most of these IPs are from China. I guess some bots are trying to find vulnerable files. Is there any way to protect ...
-1
votes
1answer
70 views

In my webserver I found may PHP with random strings [duplicate]

In one of my webserver, I found some new folders got created and many files are there, In access log I found many files access from that folder. Sample file: After this strings: But it I copy ...
0
votes
0answers
113 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
0
votes
2answers
129 views

TSA server with OpenSSL

From OpenSSL documentation of openssl-ts command: HTTP server support is provided in the form of a separate apache module Does anybody know which module is the one? I haven't found any module to ...
0
votes
1answer
51 views

How to access a shared webhosting webpage without the domainname?

I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally I need to access it since the ...
0
votes
1answer
102 views

Do URLs used in JavaScript AJAX GET calls need to be sanitized through Apache when there is no server side scripting or database involved?

I am aware that any data coming into a server from a client should be handled safely (as in sanitized, whitelisted, etc.) but I had slapped together a very simple system that pulled file contents ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
0
votes
1answer
58 views

Rule does not log X-Forwarded-For environment variable

The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far. Here's ...
2
votes
0answers
61 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
1
vote
1answer
55 views

Unusual Get/Connect requests to Apache [duplicate]

Not sure if that has been asked before but over the last week I am getting hundreds of CONNECT and GET requests to my Apache web server for domains that are not on my server. Some are for well known ...
2
votes
0answers
176 views

Does CVE-2019-0211 affect Apache w/ php-fpm?

Intro From version 2.4.17 (Oct 9, 2015) to version 2.4.38 (Apr 1, 2019), Apache HTTP suffers from a local root privilege escalation vulnerability due to an out-of-bounds array access leading ...
0
votes
0answers
35 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
2
votes
1answer
144 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
1
vote
0answers
122 views

127.0.0.1 host header injection

I would like to know if this configuration is vulnerable to host header injection. I think it isn't, because it's listening on localhost, but I'm not sure. <VirtualHost 127.0.0.1:[% port %]> ...
1
vote
0answers
60 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
-5
votes
2answers
125 views

How do you suppress SSL error messages? [closed]

I noticed that some SSL error messages that are returned back to my browser (firefox) reveals all SSL keys, including the private server keys for sites like Facebook, Google Hangouts, Amazon. How ...
2
votes
0answers
41 views

Drupal logs are reporting 404s from bot visits but I have apache basic auth set up

In the Drupal logs on my dev site there are "page not found" reports that are obviously from a bot trying out well known urls (e.g. /wp-login). But I have set up apache basic auth and I am the only ...
0
votes
0answers
36 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
2
votes
1answer
142 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
0
votes
4answers
422 views

Can my computer get hacked if I use a local server for development only? For example WAMP?

If I use software like WAMP to test and develop my PHP websites, can someone access my computer and steal data or view my in-development websites, or even hack my computer?
0
votes
0answers
70 views

mod security rule to send email on every trigger

I made a script that reads the log file of the modsec 3 module in apache. It sends an email every 5 minutes with new triggers. I discovered that it is also possible to execute a script (e.g. send ...
2
votes
2answers
104 views

What are the common features to identify CSRF attack from Apache log file?

I have tried CSRF attack on web vulnerability application known as DVWA at my localhost and on kali linux OS. I have changed password on this application by using CSRF. It has collected following log ...
2
votes
2answers
127 views

How do i know if my ubuntu apache version is secure?

I am running Ubuntu 16.04 LTS and checking dpkg -l apache2 gives me version 2.4.18-2ubuntu3.9. How do i know that 2ubuntu3.9 has the latest security patches listed here at https://httpd.apache.org/...
45
votes
5answers
15k views

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past). Whenever I establish ...
2
votes
1answer
118 views

Containerization vs. Chroot in shared hosting

Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup chroot to separate folders (which are discrete WP installations) in a /...
0
votes
1answer
332 views

AWS Load Balancer Response Header Apache Server Disclosure

I have a node.js environment deployed using AWS Elastic Beanstalk on an Apache server. I have run a PCI scan on the environment and I'm getting 2 failures: Apache ServerTokens Information Disclosure ...
1
vote
1answer
143 views

NGINX 444 response equivalent for Apache server

How can I configure Apache HTTPD server to send no response and close connection in case of DDoS or malicious request
0
votes
1answer
294 views

In apache, why www-data owner of a web application directory is safer than recursive 777?

I have ubuntu 16.04 LTS and I am running my php web application through Apache (php-fpm). I am little concerned about files and directory permissions. Many links are suggesting that I should keep ...
1
vote
0answers
88 views

SSL Certificates and Private Key passhprases

I'm trying to put together a new PKI program for my company, and I'm a little turned around on the concept of Private Keys and passphrases. We'd like to implement Microsoft Active Directory ...
2
votes
2answers
112 views

Is it okay to have your SSL cert showing when server is reached by IP?

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you ...
0
votes
1answer
83 views

Apache2 Logs, need help in identifying if it is an attack or not

Are this an example of an attack that had happened to my server? This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all ...
0
votes
1answer
300 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
1
vote
2answers
551 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
0
votes
1answer
2k views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
1
vote
2answers
195 views

apache http https redirect server still listenting on port 80

I have an application that is using Apache. I have install the mod_ssl module for Apache, configured an SSL certificate and because the application provides such function configured http to https ...
1
vote
1answer
1k views

X-Frame-Options header on redirect

I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
2
votes
1answer
247 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
2
votes
1answer
576 views

JBoss Web vulnerabilities [duplicate]

In my organization I found servers running JBoss Web/7.0.13.Final and JBoss Web/7.0.12.Final. I could not find security vulnerabilities for this server's versions, but they seem old to me. How can I ...
1
vote
1answer
130 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
4
votes
1answer
98 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...