Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

0
votes
1answer
94 views

Would an Ubuntu server accessible from the internet be hacked within days?

I created an Ubuntu server on Digital Ocean to deploy my app on. Less then 24 hours later, I log in to the server and see this: 18 packages can be updated. 7 updates are security updates. I install ...
2
votes
1answer
42 views

Server certificate proving client identity

When we look at StackExchange's server certificate (by clicking on the Lock icon), it says: This certificate is intended for the following purposes: Ensures the identity of a remote computer. ...
0
votes
0answers
24 views

How to reach SSL file? [closed]

We have a standard domain with cloud based hosting account with free Lets Encrypt open source service. To use some services in our hosting securely, we need to install certificate file to those ...
-2
votes
0answers
16 views

{“message”:“no route and no API found with those values”}..can anymore can explain what does it mean? [closed]

!I'mgetting this massagewhile I'm searching for subdomain "apac.foodpanda.in"........can anyone explainit what does it mean.
0
votes
1answer
44 views

Compile foreign code and run it on a server, security problem

I would like to set up a server that can receive source code directly, compile/interpret it and execute it. The code could be C#, Java, C++, C, Javascript, PHP... There will obviously be security ...
0
votes
1answer
44 views

Unknown communications captured

I was capturing the communications on my system via wireshark. If found this out (something unusual). What could this mean? By the way, the communication was between my machine a server.
4
votes
2answers
236 views

Is is bad practice to use non-standard ports? (for example ssh from 22 to something different)

Background is that I am learning some technical stuff with the Enki App. In this case about security. The App states that it is a misuse of a port if I change for example the ssh port from 22 to ...
0
votes
2answers
91 views

Why should I bother having a firewall on servers?

In the case of a server, the only applications that are running there are the ones that I've setup, so you don't just have random users downloading & running malware. The only ports that are open ...
0
votes
1answer
73 views

Why should I leave a U2F device always plugged in to a computer?

Over at the Yubikey website they mention that the Nano or 5C Nano series is meant to be always inserted into a computer. I've seen some other sites mention the Nano is good for servers. But why would ...
0
votes
1answer
52 views

Security auditing - disabling IP forwarding and ICMP packets redirects

I've recently started working as a security auditor and my mentor gave me some homework to write an Ubuntu security audit script so that I'll get to learn to use batch scripting and understand ...
0
votes
0answers
44 views

Real time chat - is it possible to see messages from it again

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...
1
vote
1answer
42 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
21 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
1answer
71 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
0
votes
1answer
49 views

The main things a cloud data center could inject into its hardware

So some cloud service providers like Amazon use custom hardware to improve different characteristics of their servers. This also means they can control the security better, because there is nothing ...
2
votes
1answer
129 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
2answers
73 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
1
vote
0answers
36 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
1answer
27 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
0
votes
1answer
68 views

For servers that are not internet facing, do they need to be authenticated to each other and should their communication be over HTTPS? [duplicate]

My gut instinct is that best practice would be to ensure that all internal servers communicate over HTTPS and that all servers are authenticated to each other. That would indeed be dream case ...
1
vote
1answer
69 views

Manage Logs of Excessive Member and Server Authentication Failures

Currently, in our SIEM environment, we are attempting to reduce noise and any non-actionable items. One of the most frequent items we receive on a weekly basis is a report based on excessive member ...
2
votes
4answers
112 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
0
votes
1answer
47 views

samba server exposed to wan

I recently realized that my samba server was exposed for about 3 years to the wan (ports opened and smbd was listening). I made a mistake when I configured my firewall and failed to check it. This ...
1
vote
1answer
166 views

How to protect data in case of an unauthorized physical access to a server

I have some VMs on a hypervisor. They run linux with full disk encryption. In case of an unauthorized physical access to a running server, I know that the attacker can extract passcode out of RAM via ...
-1
votes
2answers
132 views

Testing RCE and SSRF using Python SimpleHTTPServer [closed]

Is it possible to test RCE and SSRF vulnerabilities using Python SimpleHTTPServer? Or should I use a VPS server?
0
votes
3answers
484 views

Is SQL injection still a thing? [duplicate]

I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
3
votes
2answers
49 views

When is an email rejected?

Currently, I am working on a web application and wanted to let users send emails to others through a web form. So, they just should submit their email address and my web app would then send mails to ...
1
vote
2answers
119 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
-1
votes
2answers
352 views

how to check if my server has been hacked [closed]

I have a couple of Ubuntu 16.04 servers. I want my server to be secure and ensure they can only be accessible by me and things. I check the auth.log and last. But I heard that hackers can change the ...
1
vote
3answers
368 views

How to detect a DoS attack if today all use network address translation?

If a basic DoS attack can be handled by limiting the number of connections that occur in a interval of time with one IP and some enterprises and institutions use network address translation with many ...
1
vote
2answers
317 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
3
votes
0answers
131 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
0
votes
1answer
209 views

over 100 scanner requests 5 min after domain registration

First off, I am no security expert! Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...
1
vote
0answers
39 views

Secure Server start up [closed]

From the server implementations that I have seen, people normally use a properties file with all the passwords (that may be encrypted with hardcoded key(s)). I have therefore, created a server that ...
0
votes
0answers
73 views

event 4625 - log-in failures from an encrypted username

I am getting tons of these errors everyday for the past weeks, all having the same account name. I tried decoding the name using base64 but it seems that it uses another encryption. I really do not ...
0
votes
2answers
56 views

Internal Server to Server Authentication Using a Single Token

One of our security mandates require authentication between servers when transmitting data. These API endpoints are only accessible within the internal network and are never exposed. Our idea is to ...
3
votes
2answers
346 views

What is this SSH attack, am I hacked?

I see this in my Ubuntu server's log file: in my ssh my user is root but i see other user Disconnected like "teamspeak", what does that mean? auth.log Jul 3 21:39:01 vmi189193 CRON[25937]: ...
2
votes
2answers
92 views

How to verify server ownership by public IP (without associated domain)?

Company A has a set of servers with public IP address but not associated with any domain. The servers contain confidential information, so company A doesn't want to give access to 3rd party. Company ...
1
vote
0answers
855 views

can ping the server but not able to access [closed]

i am able to ping the server machine named "tallyserver" which is windows server 2003 machine configured with automatically IP address setting but when i am going to Network, sometimes it shows the ...
5
votes
3answers
2k views

How to protect our server from brute force attack? [closed]

One of the most common cyber attack is Bruteforce , what are the mechanisms available to protect this attack and how industry apply these mechanisms to mitigate the attacks (best practices)?
4
votes
2answers
1k views

OpenVAS won't generate SCAP Database

To deploy OpenVAS to Virtual machines I've been using Ansible for a while and it worked pretty well. Now today I wanted to deploy it to another machine but the openvas-check-setup script keeps telling ...
44
votes
3answers
6k views

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
7
votes
2answers
498 views

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server? So according to the answer to the question above it is possible that when one ...
4
votes
2answers
323 views

Use mining to prevent DDOS attacks on websocket: Is this a viable solution?

I'm thinking whether the following way is a good way to completely and totally prevent ddos on my server. My idea is to use the same mechanism of cryptocurrency mining (bitcoin, with sha256 or any ...
0
votes
2answers
155 views

Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?

As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a ...
-2
votes
1answer
183 views

Authentication process between the server and the browser [duplicate]

How the browser ensures that it is communicating to the right server?
-5
votes
1answer
112 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
1answer
177 views

TLS 1.3 server_handshake_traffic_secret calculation

I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3. In section 4.3.1 (Encrypted Extensions) it says In all handshakes, the server MUST send the EncryptedExtensions ...
0
votes
0answers
25 views

How to improve the authorization and client-server interaction scheme?

I'm creating a Qt-server which uses SSL via TCP. Clients can authorize themselves on the server using login and password and become users. Only users can perform any actions with their accounts. ...
4
votes
1answer
214 views

What can I do with physical access to a server?

I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them. Each team is set up with 4 VMs, and we have a few days to ...