Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

Filter by
Sorted by
Tagged with
0
votes
1answer
71 views

How can I create a secure auto-login? (java)

I am writing a server-client program. When a new user installs the program and opens it for the first time, he has to enter a password. The password in combination with an email address is needed to ...
0
votes
0answers
38 views

What’s a great way to escalate privileges on a Linux server? [closed]

What’s a great way to escalate privileges when you have a meterpreter session on a Linux system? The exploits I use to try to escalate privileges don't work and when I use the upload command to try to ...
0
votes
0answers
11 views

Can attackers see which IPs a server is connected to? [duplicate]

can an attacker know without being in my area which clients my server is handling? How do I protect against others remotely sniffing my servers network?
0
votes
0answers
44 views

Apache site down after getting AH02032 error [closed]

Apache site down after getting AH02032 error, and automatically up if I restart apache or after some time(maybe 1-3 hours). The Server setup is Xampp in Windows Server 2012 Many sites are hosted on ...
0
votes
1answer
55 views

If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure?

If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure? And what if I ...
0
votes
1answer
72 views

How to prove that some action was taken by client in the presence of a malicious server?

Suppose a client places an order on an eCommerce platform. And then claims that they did not place the order. How can we prove that the order was in fact placed by the customer assuming that we ...
0
votes
4answers
130 views

How to identify IP from a UDP-based DoS

I'm running a Counterstrike server on UDP port 27015. I'm using Amazon AWS to host the game server. I have added only my friends' IPs (about 50 of them) into a security group so the rest of the ...
0
votes
0answers
74 views

Webserver blocking other servers but not clients

I am currently pentesting a webserver and found out that its subdomain is blocked when pinged from another server (I tried pinging it w/ my Digital Ocean server and other ping tools from websites). ...
0
votes
0answers
33 views

TCPView showed strange ip

Hey so I run a server and was just checking through " TCPView ". TCPView brief explination of prog, TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on ...
0
votes
2answers
111 views

Security of port forwarding when the target is turned off

I recently set up a server from an old computer case. I use docker to install and use different services on different ports and I would like to access some services from outside of my house. I have a ...
0
votes
0answers
33 views

Secure mount options in Ubuntu CIS benchmarks too narrow?

this is the first of a series of questions on hardening Linux servers at the filesystem level. At work I'm hardening an Ubuntu 18.04 Server following the CIS benchmark 2.0.1. Instead of just running ...
1
vote
1answer
114 views

Should repositories with server-code and client-code be separate?

I have a project that runs a website with a frontend SPA and REST API backend. Currently the code is split into /client and /server folders and they run independently. However, they are currently in ...
1
vote
1answer
97 views

Is HTTPS sufficient to protect app/server communication?

Scenario: Adam has designed an iPad app that will be publicly distributed. The app will communicate with Adam's server via https. While the fact that this app communicates with this server isn't ...
0
votes
1answer
76 views

How to make VPS more secure with UFW?

I have 3 VPS based on Ubuntu 18.04 server OS and would like to open particular ports on each servers. The ports, that I would like to open are: Then let's take a look on the environment: As you ...
2
votes
1answer
148 views

Smart Lightbulb Using Common IRC port found in NMAP - anything to worry about?

UPDATE: Looking at the product again, I don't think this even has built in Wi-Fi (it uses bluetooth for the connection). I don't know what I am looking for here in Wireshark, but I added the host ...
0
votes
3answers
209 views

How do I immediately block IPs once they do a single malicious act?

I get this in logwatch A total of 21 sites probed the server 1.144.111.208 123.31.43.40 174.216.5.13 185.156.177.234 188.175.196.105 188.71.236.121 197.229.2.33 197....
1
vote
1answer
206 views

Is someone trying to hack into my server?

I'm a cyber security student and don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked ...
0
votes
1answer
34 views

How to protect Server running on Windows 10 with Node Ngrok against attackers?

I'm running https://ngrok.com/ on Windows 10 pro with a custom app made on Node server running locally (can't be Linux) for a test suite that uses both web and desktop integrated. So I'm basically ...
1
vote
0answers
153 views

Custom IPv6 network and security risks

I draw a custom network (I would use that for developing and testing, my ISP does not support IPv6), there IPv4 and IPv6 are present. 'A' device has firewall: incoming blocked, only accept access (SSH)...
3
votes
1answer
361 views

Is it safe to transfer location data by using TLS?

Is it safe to transfer location data by using TLS with self-signed certificates? I read a lot of varied discussions on the web which makes me to ask about the subject.
2
votes
2answers
174 views

FarCry 1 Server Security Risks?

Some friends and I want to play FarCry version 1.40 on PC over the internet on our own private server but we have some security concerns. Since the game was released 15 years ago and we'll be running ...
2
votes
2answers
103 views

Can someone perform DDoS on my VPS even if it is only accessible through SSH?

Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
0
votes
2answers
84 views

Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?

I have a content site https://www.mysite.com I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
0
votes
1answer
87 views

Why should I use firewall to block ports with no running services? [duplicate]

A firewall is for blocking / limiting access to specific service / port. I know that it can be useful for allowing only certain IPs to a port (for example I don't want to have SSH open for the whole ...
0
votes
1answer
73 views

Gradle daemon listens on all interfaces by default

Was messing around with a project today that uses the build tool Gradle and I noticed that by default, it's running a daemon server process that listens on all interfaces. Output of ss below. State ...
0
votes
0answers
48 views

What is impersonation?

I'm looking for the definition of impersonation but for main - the reason of using servers this method. I don't understand why servers are running sometimes as client. And also I don't understand how ...
0
votes
1answer
169 views

How to make it harder for a VPS provider to access my data?

I know it is impossible to completely prevent a host from accessing the data of a virtual machine (as noted here, here and here), but I think there is value in making it harder to do so. Bare metal ...
3
votes
1answer
91 views

/var got mysteriously renamed in /var.1 on CentOS6 server [closed]

On one of our CentOS6 servers, /var got renamed to /var.1 tonight (around 3.24 am) and a new empty /var folder was created. Not surprisingly, it crashed soon after that. Circumstances: Over the ...
0
votes
0answers
34 views

Security bug in wildfly-security-manager

I have a question to this Common Vulnerabilities and Exposures about wildfly-security-manager: CVE-2019-14843 Does this security flaw imply an attacker could break into the wildfly server, or does it ...
0
votes
1answer
71 views

Detect vulnerability based on IIS log [closed]

Is there any tools to detect website vulnerability/suspicious request from IIS log? I was asked to do log review. The logs include IIS Log and Event Log. Is there any tools to detect if there's any ...
0
votes
0answers
88 views

Port scanning - Idle scan 2.0?

I have some server applications and from time to time I'm being victim of some attacks which might be of interest and I'm going to describe in the following. The most recent attack originated from ...
2
votes
2answers
284 views

How to log passwords tried for login?

I was just watching Michal Hrušecký's presentation about their open source routers. In the presentation he showed their "Honeypot as a Service" offering and how it allows you to see the passwords that ...
1
vote
1answer
283 views

Does Google Chrome store browsing history on their servers?

Does Google Chrome store browsing history on their servers? I think, if for example I use private browsing, Chrome can still log my activity.
2
votes
0answers
88 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
0
votes
0answers
38 views

Hacking attempts to our server - what does this code do? [duplicate]

Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like css2.php db_model.php ....
4
votes
1answer
138 views

How can I challenge an attacker to reliably identify their hardware? [closed]

I distribute a client application where I would like to identify a user's hardware specifications when they begin interacting with my server. I am specifically interested in identifying the user's GPU ...
1
vote
1answer
203 views

How to send authentication token via SMS for a REST API

I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need ...
6
votes
1answer
112 views

Should I create a JWT on one server, and verify it on a different server?

So lets say I have 2 microservices: 1). A serverless / lambda function, triggered by some hardware event 2). A websocket server, to handle some data I want to ensure that only authenticated ...
1
vote
1answer
284 views

Is there a “no-spy, no-backdoors standard” for telecom hardware manufacturing?

The BBC News article Huawei says willing to sign 'no-spy' agreements reports the following: Huawei has also said it is independent from the Chinese government, but some countries have blocked it ...
0
votes
0answers
52 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
0
votes
2answers
72 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
0
votes
1answer
221 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
2
votes
4answers
673 views

What are the benefits of using IP whitelists to secure cloud servers/resources?

Consider the following scenario: There is a "server" (e.g. database, API, etc) that is "in the cloud" (i.e. hosted on physical hardware that is physically distant from the clients and reachable only ...
0
votes
1answer
124 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
-1
votes
1answer
126 views

setting up ssl for cname only subdomain [closed]

I've looked on for an answer on google and other forums for this question but couldn't get a solution or a hint for the scenario that I have. I've a domain, say abc.com, which is live with ssl on ...
3
votes
1answer
137 views

Plausible way to hack website keeping [username / hashed password] pairs?

I was reading that a lot of authentication systems use cryptographic hash functions, whereby instead of keeping the username and password of their users they just keep the username and a hash of the ...
2
votes
0answers
61 views

Is “active defense” against attackers a real thing, or an invention of movies? [closed]

In movies hacking is depicted as a weird sort of game. When you detect someone attacking your server, you face them head on. To me, it sounds like your best bet would be to just shut down the server ...
0
votes
2answers
315 views

Does HTTP:// to HTTPS:// redirection means strict HTTPS from server

when I try to connect to some websites using http:// (notice the absence of s) , my client end up with https://. I use python requests for this purpose, which simulate a client behavior. It performs ...
-1
votes
2answers
108 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
5
votes
1answer
134 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...

1
2 3 4 5
10