Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
78 views

Is there any way to make the Government not find out geolocation from the hoster?

The government can find servers very quickly by contacting the hoster that hosts your VPN server, and the service provider might give your IP address. But what if I use torsocks ssh -d? I don't know ...
user avatar
  • 111
1 vote
1 answer
55 views

Defining scope of a software pen test

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
user avatar
0 votes
0 answers
37 views

Verify frontend source code authenticity

I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key. If implemented properly this ...
user avatar
  • 389
0 votes
0 answers
22 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
2 answers
60 views

Is an Ethernet FTP server on a local network safe if an attacker can't access the router?

I'm having trouble understanding certain security concepts and I was wondering if someone could help me out with some questions. Imagine this setup: A home router with a very strong password, that ...
user avatar
0 votes
1 answer
21 views

is client server model to do some root operations without asking everytime secure?

I'm writing a python application that will do some operations that will require root privileges.So instead of asking for user password every time i decided to use server client model. A python script ...
user avatar
0 votes
0 answers
12 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
user avatar
0 votes
1 answer
62 views

Secure file transfer between server

I have two servers (server1 & server2) Server1 needs to send a file to server2 for it to process. How can I make a secure connection between these two servers so I'm sure that the file is sent ...
user avatar
0 votes
0 answers
22 views

Is there any way I can verify that my app in not modified or tempered (code is changed or something) on clients phone? [duplicate]

I have created an App and made clients install it on there phone. When my app tries to connect to server or request data from my server I want to verify if that app is genuinely my app and not ...
user avatar
1 vote
1 answer
139 views

Does Re-Encryption make our data more secure?

We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also. iPhone and recent Androids are all encrypted. We know that changing the password will ...
user avatar
  • 111
2 votes
1 answer
83 views

Chatting server that doesn't know who the end clients are

I am thinking of creating a small chatting server. I want it to be as secure as possible so I found it to be very helpful if some expert could guide me a little bit. Has there been any research on or ...
user avatar
  • 121
0 votes
1 answer
79 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
user avatar
2 votes
2 answers
171 views

CAPTCHA w/o Server-Side Persistence

I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key. The ...
user avatar
1 vote
2 answers
144 views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
user avatar
  • 53
0 votes
2 answers
170 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
user avatar
1 vote
1 answer
135 views

Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?

I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
user avatar
0 votes
0 answers
93 views

What are my vulnerabilities with this multi-user ACL database approach?

I would like some expert insight. I want to know what my vulnerabilities for this model are. This is a demo project that I will be following in my production app if all works out securely. My ...
user avatar
  • 117
0 votes
1 answer
134 views

Can the hosting provider who has access to the email server machine, access the emails?

I am planning to use a self hosted (Linux based) email server. However, the server will be on hosting providers machine. The hosting providers will have access to the physical machine. In that case, ...
user avatar
0 votes
0 answers
116 views

A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority

I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS. My public web domain is ...
user avatar
0 votes
0 answers
88 views

Ad popups showing on personal website deployed on VPS

I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
user avatar
  • 1
0 votes
1 answer
111 views

Telling the backend where to go from client side

I have a system with three layers: two client web apps, one Backend, and two DBs. The two DB and client app instances represent prod and test environments. The backend has only one instance that ...
user avatar
  • 151
1 vote
1 answer
85 views

Multiple server fields in HTTP Response

Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow ...
user avatar
  • 606
1 vote
1 answer
1k views

Spam GET And POST Requests - Are They Dangerous?

I am getting a lot of spam GET and POST requests lately which some of them look like this: "GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user avatar
1 vote
1 answer
87 views

Dyanamic class load for server side application

Is there a problem to use reflection (specifically class.forName) in server side application? My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
user avatar
1 vote
1 answer
78 views

Is unrestricted query access to dedicated DNS server considered an insecurity?

Let's say hypothetically a business has a network and some respective infrastructure. Importantly, a VPN for giving remote secure access to work resources, and a (not so)private DNS server for DNS but ...
user avatar
2 votes
1 answer
115 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
user avatar
2 votes
2 answers
133 views

A customer support of where my company host a VPS on asked me login detail, is this standard procedure?

We host our web application on a VPS, I maintain LAMP environment there to fulfill our client needs (I work on relatively small SaaS service provider), I also set up a script to backup the system ...
user avatar
0 votes
2 answers
179 views

Is it possible to hack a database inside of local network by external attacker?

Can an attacker from global network hack a database located on office machine inside of local office network? For example after hacking a router, a gateway or the very machine? Or maybe there is ...
user avatar
  • 117
5 votes
1 answer
993 views

How to ensure identity for server-to-server communication over IP

How would one go about ensuring that a server at a given IP address is who it says it is? I need to send confidential data to another server at another IP address. If the server had a public domain it ...
user avatar
2 votes
1 answer
143 views

How to update large encrypted files on a server

I'm curious how large cloud computing services that might secure encrypted data would update an encrypted file. For example, let's consider a user is using RSA to encrypt a large file, maybe gigabytes ...
user avatar
1 vote
0 answers
21 views

How do I use SYN cookies to perform a DOS attack [duplicate]

I am taking a computer security course but I have a question I am stuck on. You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you ...
user avatar
0 votes
1 answer
211 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
user avatar
0 votes
1 answer
597 views

How hacker/ others get your SSH private key / stole your SSH private key?

I know we must keep private keys secure, but as long as we don't share the private key, what can go wrong? How hackers/others can steal/get your private key? What is the possible way that can happen ...
user avatar
1 vote
1 answer
115 views

Denial of Service question

I am studying for an exam in computer security, and I got stuck on the following question from a past exam: A random program generator service S allows clients to generate random data. Each client Ci ...
user avatar
  • 23
1 vote
1 answer
98 views

What is the threat/risk difference in opening multiple ports on one physical NIC on a home server vs creating VLANs and opening ports on each VLAN?

I have a single home server with a single NIC. I intend to run numerous services -- some will be internet exposed, some will not. I don't know if I am going to run them as VMs or Docker container but ...
user avatar
1 vote
1 answer
142 views

Could the VPS host have access through WinSCP to the connecting computer's files?

I've been using someone else's VPS and connecting from my computer. I've been connecting via WinSCP and the server is hosted on OVH. Is it possible for the VPS host to have access or view the files on ...
user avatar
  • 33
1 vote
2 answers
253 views

I found an unknown UFW rule on my ubuntu server - have I been compromised?

The server is running the Kubuntu Desktop variant of Ubuntu (I transformed it into a server, I had things configured that would have been a pain to transfer to another installation.). One day I ...
user avatar
1 vote
1 answer
156 views

Virus scanning uploaded images to database

I have a database for a chat app to which users can upload images. These images get scanned before they are made available to other users in a conversation. But when the antivirus gets an update, ...
user avatar
1 vote
1 answer
516 views

How to make Squid Proxy undetectable by ip-check.net? [closed]

I have setup squid proxy on a CentOs server where I set forwarded_for to delete and denied request headers on the /etc/squid/squid.conf file. However, whilst connected to the proxy, if I visit http://...
user avatar
  • 11
1 vote
0 answers
121 views

Strange cyrus/imaps Logins without valid password

I found apparently successful logins from a foreign ip-address to our cyrus-imap server: Nov 24 08:16:20 server-1 cyrus/imaps[12101]: starttls: TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits ...
user avatar
  • 11
1 vote
0 answers
134 views

XSS on marketing websites like craigslist. How does this work on a technical level? [closed]

I was wondering how this works. We have a marketing site in Holland where people can sell second hand goods. Rumor goes that there is a lot of phishing going on there and XSS code is used in the ...
user avatar
0 votes
0 answers
87 views

Is SSL Always Required When Communicating With Internal Client/Servers?

I'm in the planning/design stages of a project which will incorporate an internal server that communicates with internal clients. A quick summary of how this server will behave is as follows: end-...
user avatar
  • 1
0 votes
1 answer
181 views

Server to server authentication

I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls. The current ...
user avatar
1 vote
1 answer
96 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
user avatar
  • 347
-1 votes
1 answer
173 views

Why do people, even programmers and geeks, seem to almost feel the urge to "give hackers a fair chance" at stealing their data? [closed]

I once heard that the author of the early NES emulator "Nesticle", clearly a very intelligent person, baffingly used some kind of exploitable "Samba" or "SMB" server ...
user avatar
  • 1
0 votes
1 answer
262 views

Is it safe to automatically parse text as markdown?

I have a server, which receives text mails from students and I plan to automatically collect their message bodys and parse them as markdown so that I can generate a nicely formatted output as pdf. Is ...
user avatar
  • 103
0 votes
1 answer
112 views

In what ways can you trust a third party server with your data? [closed]

What can you do that will make it easier for you to trust a third-party server? For example, using Intel sgx enclaves.
user avatar
2 votes
1 answer
530 views

how can I find all the websites on a particular IP? [duplicate]

When I try to find websites hosted on a specific IP using one of the online Reverse IP Lookup tools, I only get one website, but when I use Sub-domain enumeration, I find several websites on the same ...
user avatar
  • 23
0 votes
2 answers
377 views

How to decide to use, then how to use an http gofile.me url in an email, explained to a five year old?

I'm terrified of clicking on links in emails, and yet a colleague insists I do. When I receive an email in my gmail account that contains links of the form http://gofile.me/xxxxx/yyyyyyyyy along with ...
user avatar
  • 1,375
0 votes
1 answer
110 views

Laravel | Why create a public_html folder and link/move it?

I am using laravel on shared hosting. Under my domain in my folder is the laravel app. Now I see online that many people do weird stuff with the laravel public folder, they either move it to a ...
user avatar
  • 157

1
2 3 4 5
12