Questions tagged [cms]
A Content Management System (CMS) is a platform used to build websites that are easily edited by multiple users.
23
questions
1
vote
2answers
74 views
How to encode a CMS or S/MIME PEM file with OpenSSL not encrypted or digitally signed?
We developed an application that reads a CMS encoded PEM file with this command:
$ openssl cms -verify -in filepath -inform PEM -noverify
The file is digitally signed, but we don't care about it, as ...
0
votes
1answer
51 views
what can you do in sql login details and encryption key is available
I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml.
In this file there is information such as:...
2
votes
2answers
78 views
does vBulletin and similar discussion forum CMS store previous email address and password hash in database?
I am in the process of De-Googling myself and use complex passwords.
I change my registered Gmail to an alternative mail provider
I change my password to a complex one
I use mostly vbulletin and ...
3
votes
1answer
166 views
How to protect a website from DDoS without a CDN? [closed]
I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website.
I ...
4
votes
1answer
83 views
Potential risks of a single codebase for multiple CMSes
We are currently in the process of converting our multiple codebases (which are exactly the same, except for a configuration file and 2 stylesheets).
We have been thinking about this for a while, and ...
6
votes
2answers
785 views
How to ensure that our production environment deployment process is PCI-compliant when we need to perform live code updates?
In planning the next phase of our platform, I am trying to ensure that the production deployment process is PCI compliant.
We have a central platform which acts as a CMS, serving custom content based ...
1
vote
0answers
57 views
Magento site hacked by unknown vulnerability [duplicate]
Home page of my Magento site is hacked. A hacker put his javascript and html code in design/head/includes of table core_config_data. Somehow he updated value of design/head/includes from NULL to his ...
2
votes
1answer
34 views
Can a CMS generated HTML Document from an admin be considered trusted, and not vulnerable to XSS?
Currently, I am working on a CMS/Framework I developed that is similar to Wordpress, in that it is a platform for admins to create/post content for users.
I am saving the HTML that is generated by ...
0
votes
2answers
267 views
Full protection from shell-script injections (like a “Bash injection”) - Is it even possible?
Assume there's a website built with some FOSS CMS (like Drupal) and the websites' directory is owned and grouped by root (instead www-data as common in Apache in Nginx) and a friend of the site's ...
0
votes
2answers
1k views
Prestashop + mod_security concerns
Running a shared hosting service, a client contacted me if I could disable mod_security for their webapp. The thing is, there is this patchwork webshop CMS called Prestashop with some hair-raising ...
1
vote
1answer
179 views
What are the only possible cases for DB injection?
After reading a bit on DB injections (injecting malicious query code written in SQL, NoSQL, or of any DB querying language), I understand that there are only 3 possible cases for this kind of attack:
...
1
vote
1answer
1k views
Having http site load https content - Approach
My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data and no user sessions\logins.
The content on my http ...
1
vote
1answer
422 views
Logout CSRF Protection [duplicate]
I am making a CMS and I have a CSRF protection in settings, new article. Should I also put this protection in the logout ?
4
votes
0answers
102 views
Detect malicious content on enourmous multi-site CMS [closed]
My Goal:
My hope is to catch pages and content that would be flagged by Google Safe Browsing or others like it, except more proactive than waiting for a crawl by Google or being added to a ...
1
vote
1answer
58 views
Trying to get a grasp of approximate risk level of CMS admin logins over http
Forgive me for a potentially obvious question--and I know the safe answer is "Always use https!"--but I'm trying to get a grasp on how necessary it is to use https for anyone accessing the backend on ...
1
vote
1answer
119 views
Ghost CMS abnormal access
I have a blog hosted with Ghost CMS. I created a new blog post (say "My New Blog") and correspondingly there was a url generated (mysite.com/mynewblog/)
The weird part is that I saw an access to this ...
2
votes
3answers
689 views
Where is the most secure location to host an admin panel?
I have an admin panel on my site, that enables me to control the content on my website. In order for the admin panel to achieve this, I must have a connection to the site's database.
I have two ...
4
votes
1answer
1k views
Root server hacked via httpd - consequences and future prevention
Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started investigating....
1
vote
0answers
57 views
How to anonymize contributors while still keeping attribution?
Imagine a CMS with authentication where the author of each article has to be stored in the database. Now I want to make it harder to analyze (by crawling or stealing the database) who has written ...
4
votes
2answers
305 views
Does HTTP Digest Auth provide any increased security in this scenario?
Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
5
votes
1answer
4k views
Using client certificates for website authentication
I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
1
vote
1answer
664 views
Detecting SMIME type using OpenSSL CMS
Is it possible to detect S/MIME content types (enveloped or signed) using OpenSSL CMS API? I would prefer to avoid pre-parsing S/MIME headers and let OpenSSL to detect whether message is signed or ...
4
votes
3answers
2k views
Techniques for fingerprinting a web based content management system (CMS)
Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...
