Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

0
votes
0answers
52 views

JSON(blob?) to POST/GET request

First i want to say that i'm not sure if its called JSON blob, I found API endpoint on private program which i can convert from JSON to normal GET/POST request with parameters however i have found ...
-1
votes
2answers
100 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [on hold]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
5
votes
1answer
62 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
-1
votes
0answers
38 views

How to implement Browser Isolation? [closed]

I just recently found out about Web Isolation. I also found about the many vendors offering it but I could not find an open source project doing so. So I want to start one. How could a solution like ...
0
votes
0answers
40 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
-3
votes
2answers
118 views

Is pure client-side security better or worse (from a security point of view) than pure server-side security in client-server software?

I'd like to know in general which of the two types of security is the best in all aspects that may refer to security (we can use this the general aspects for security: integrity, availability, ...
0
votes
0answers
15 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
1
vote
1answer
47 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
1answer
36 views

What are the different security concerns associated with open ports on mobile vs open ports on servers?

I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case. Do ...
0
votes
1answer
64 views

How do I ensure a local Minecraft server (with admin wrapper) is inaccessible to the outside?

I'm running a Minecraft server on my local network for myself and my roommates. I would like to simplify some of the admin tasks by using an admin wrapper. Unlike most of the questions, tutorials, ...
2
votes
2answers
164 views

If two servers are in the same private network, is it better for them to talk to each other through HTTP or HTTPS?

Is anyone kind enough to tell me what actual companies do about the matter? This is assuming the company doesn't run the risk of having insiders sniffing the packets.
0
votes
1answer
26 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
2
votes
2answers
242 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
2
votes
2answers
96 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
2answers
113 views

Securely compile foreign code and run it on a server?

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
4
votes
2answers
269 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
2answers
100 views

Why should I bother having a firewall on servers?

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware. The only ports that are open ...
0
votes
1answer
105 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
0
votes
1answer
61 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
0answers
45 views

Real time chat - is it possible to see messages from it again

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...
1
vote
1answer
48 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
34 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
1answer
71 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
0
votes
1answer
51 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
2
votes
1answer
220 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
2answers
147 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
1
vote
0answers
37 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
1answer
28 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
0
votes
1answer
73 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
1
vote
1answer
130 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
2
votes
4answers
113 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
0
votes
1answer
47 views

samba server exposed to wan

I recently realized that my samba server was exposed for about 3 years to the wan (ports opened and smbd was listening). I made a mistake when I configured my firewall and failed to check it. This ...
1
vote
1answer
168 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
-1
votes
2answers
177 views

Testing RCE and SSRF using Python SimpleHTTPServer [closed]

Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
0
votes
3answers
714 views

Is SQL injection still a thing? [duplicate]

I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
3
votes
2answers
51 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
2answers
134 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
-1
votes
2answers
521 views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
1
vote
3answers
593 views

How to detect a DoS attack if today all use network address translation?

If a basic DoS attack can be handled by limiting the number of connections that occur in a interval of time with one IP and some enterprises and institutions use network address translation with many ...
1
vote
2answers
367 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
3
votes
0answers
137 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
0
votes
1answer
230 views

over 100 scanner requests 5 min after domain registration

First off, I am no security expert! Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...
1
vote
0answers
39 views

Secure Server start up [closed]

From the server implementations that I have seen, people normally use a properties file with all the passwords (that may be encrypted with hardcoded key(s)). I have therefore, created a server that ...
0
votes
0answers
102 views

event 4625 - log-in failures from an encrypted username

I am getting tons of these errors everyday for the past weeks, all having the same account name. I tried decoding the name using base64 but it seems that it uses another encryption. I really do not ...
0
votes
2answers
64 views

Internal Server to Server Authentication Using a Single Token

One of our security mandates require authentication between servers when transmitting data. These API endpoints are only accessible within the internal network and are never exposed. Our idea is to ...
3
votes
2answers
373 views

What is this SSH attack, am I hacked?

I see this in my Ubuntu server's log file: in my ssh my user is root but i see other user Disconnected like "teamspeak", what does that mean? auth.log Jul 3 21:39:01 vmi189193 CRON[25937]: ...
2
votes
2answers
93 views

How to verify server ownership by public IP (without associated domain)?

Company A has a set of servers with public IP address but not associated with any domain. The servers contain confidential information, so company A doesn't want to give access to 3rd party. Company ...
1
vote
0answers
1k views

can ping the server but not able to access [closed]

i am able to ping the server machine named "tallyserver" which is windows server 2003 machine configured with automatically IP address setting but when i am going to Network, sometimes it shows the ...
5
votes
3answers
2k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
4
votes
2answers
2k views

OpenVAS won't generate SCAP Database

To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...