Questions tagged [server]
A server is a machine running a software daemon that is generally accessed over a network by other machines.
580
questions
0
votes
0
answers
47
views
Refresh-token rotation without additional frontend requests
I'm implementing a refresh-token rotation mechanism. For the sake of simplicity in implementing the frontend I would like to remove the need for requesting a new access token when an old one expires.
...
- 101
0
votes
0
answers
7
views
Vulnerable Windows DLL Not updating [migrated]
I have a Windows 2022 VM in Azure that vulnerability scanning is flagging because of an outdated Windows system DLL that has a vulnerability that was patched.
The dll in question is winmm.dll and the ...
- 1
0
votes
0
answers
51
views
Securing an Admin Network for IT Administrators
I look forward to your suggestions. We are concerned with the question of how to best and most easily implement a secure admin network for our IT administrators.
Our team consists of three groups - ...
0
votes
1
answer
134
views
Getting a couple of remote login and calls into Ubuntu server?
I have a ubuntu server (Ubuntu 22.10 x64) on Digital Ocean. And I am using fastapi, uvicorn, gunicorn and nginx as I used it for my backend api calls from my frontend and my frontend IP is dynamic.
...
- 1
0
votes
1
answer
97
views
HIPAA Compliance for Frontend Hosting
I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database ...
- 143
0
votes
0
answers
165
views
sql injection in Microsoft SQL Server 2017 problem retrieving db names
While I was pentesting, I came across a blind sql injection in a website that uses IIS. I tried this payload " AND 11=11 AND ('Hlua'='Hlua" and it works and it gives success page then i ...
- 1
0
votes
0
answers
6
views
Server directory bruteforcing [duplicate]
Recently I saw hundreds of strange requests from different ip addresses in my server logs.
These requests were trying to bruteforce directories for example:
GET /admin/admin.php 404
GET /admin/...
- 1
0
votes
1
answer
288
views
Does a DDoS Attack affect the internet connection apart from the service it's attacking?
Lately I've been experiencing some crashes related to my internet connection, I'm on the process of pin-pointing what is causing the issue and one of those possible causes might be a DDoS attack, ...
0
votes
1
answer
1k
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
0
votes
0
answers
28
views
Need of Transaction SIGnature (TSIG) record
Can't we simply send the shared secret key along with AXFR query?
A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
- 11
2
votes
2
answers
322
views
How can I prevent visitors from exposing their personal IP addresses to my server?
I'm running an Apache server on an Ubuntu EC2 instance for some online friends, but they don't want me to be able to identify them in real-life. The hosted webapps require login, so it'd be easy for ...
- 23
1
vote
1
answer
217
views
Is running PHP file_get_contents on random user-generated links safe?
In one of my PHP apps, I have a part where it scrapes the content of random links on the internet using file_get_contents, and then it runs a regex on this content to find all the email addresses in ...
- 296
1
vote
0
answers
86
views
Implement Replay attacks in python [closed]
For an assignment I have to implement a proof of concept and (optionally attack it). The part of OCSP is working so far. I have a client that sends the request to a server, the server verifies if the ...
- 11
1
vote
1
answer
151
views
Should old versions of TLS be disabled at the OS level and the server level?
My environment has a variety of operating systems (Windows, Linux, etc.), servers and applications. Infrastructure scans are showing old versions of TLS that need to be disabled at the OS level, while ...
- 143
1
vote
0
answers
100
views
Going about sharing 2FA key between multiple login methods on a Synology NAS + browser & SSH authentication
I've recently acquired a Synology server (DS720+) and have it accessible outside my LAN via a VPN. I have 2FA on for logins to the server via the web portal, but I have found many use cases for ...
- 11
2
votes
1
answer
628
views
How to remotely check if SSL 3.0 is enabled on server?
I would like to remotely verify whether SSL 3.0 is running on several servers.
Previously, this command:
openssl s_client -connect example.com:443 -ssl3
Would have worked but now I am getting the ...
- 23
16
votes
5
answers
7k
views
Is having the name of web server software in HTTP response header a serious problem?
How serious a security problem is it to have the name of the web server in the HTTP header (Apache, Nginx etc.)?
I am discussing this with a system administrator and he told me that deleting version ...
- 162
0
votes
1
answer
28
views
validating the authenticity of messages from public client without authentication
Say I have a game, when you finish playing you put your name in and your score is synched with a public scoreboard. Assume also that I own the server and its code. How can I verify that the scores ...
- 123
0
votes
2
answers
90
views
Dismissing 500 errors in logwatch
Logwatch shows those attacks giving a 500. Given that 500 is an internal server error, does that mean I need to examine further or dismiss?
421 (undefined)
/: 4 Time(s)
500 Internal Server Error
...
- 182
0
votes
0
answers
49
views
Using your own server as a proxy without having set it up as a proxy
In logwatch I got
Connection attempts using mod_proxy:
146.66.178.78 -> mkzaim.ru:443: 1 Time(s)
90.151.171.106 -> host64.ru:443: 1 Time(s)
Can this mean that they used my server as a ...
- 182
0
votes
0
answers
123
views
Path Traversal with rawurldecode and dots validation
I'm trying to check if it's possible to bypass a two dots verification to perform a Path Traversal, downloading files out of the allowed folder. The problem is that it uses rawurldecode when ...
- 121
0
votes
2
answers
214
views
What's so bad about including "backdoors" to a Website?
I have a fundamental question about the harm of leaving a backdoor in one of my public websites / plattforms. I do not want to discuss the details why I wanted to do that, I just want to understand ...
- 851
2
votes
1
answer
1k
views
Missing Linux Kernel mitigations for 'iTLB multihit' hardware vulnerabilities
I don't know how to mitigate iTLB multihit vulnerability.
/sys/devices/system/cpu/vulnerabilities/itlb_multihit | KVM:
Vulnerable
Found this: iTLB multihit,
But i have no access to the host machine ...
- 41
0
votes
1
answer
73
views
Ways to inject malicious content during a HTTP file transfer
Assume an Apache server (http, no authentication just hosting static files) is running in my local network which is hosting some zip files. Assume User A is requesting a zip file from the Apache ...
0
votes
1
answer
106
views
Site "can't" change username, why? [closed]
There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
- 1
0
votes
1
answer
103
views
Big old project getting hacked
My website is being hacked for the last 2 days. I'm an amateur who built it back in 2007ish and it still has some poor code. Was a hobby project that suddenly became very popular and lived to this day ...
0
votes
1
answer
702
views
Gzip only request body of HTTPS request security BREACH?
I'm not an expert of security.
I heard it's not recommended to enable GZIP compression for HTTPS requests, that would open a security issue (see SO answer: https://stackoverflow.com/a/4063496/17307650 ...
- 135
1
vote
3
answers
167
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 235
-2
votes
1
answer
92
views
Is there any way to make the Government not find out geolocation from the hoster? [closed]
The government can find servers very quickly by contacting the hoster that hosts your VPN server, and the service provider might give your IP address.
But what if I use torsocks ssh -d? I don't know ...
- 109
2
votes
1
answer
108
views
Defining scope of a software pen test
If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
1
vote
1
answer
146
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
- 11
1
vote
2
answers
785
views
Is an Ethernet FTP server on a local network safe if an attacker can't access the router?
I'm having trouble understanding certain security concepts and I was wondering if someone could help me out with some questions.
Imagine this setup:
A home router with a very strong password, that ...
- 13
3
votes
1
answer
80
views
Is a client server model to do root operations without asking for password everytime secure?
I'm writing a python application that will do some operations that will require root privileges. Instead of asking for user password every time i decided to use server client model.
A python script ...
0
votes
1
answer
104
views
Secure file transfer between server
I have two servers (server1 & server2)
Server1 needs to send a file to server2 for it to process.
How can I make a secure connection between these two servers so I'm sure that the file is sent ...
1
vote
1
answer
189
views
Does Re-Encryption make our data more secure?
We are focusing on mobile phone and hard drive encryptions. This idea can be extended to any data encryption also.
iPhone and recent Androids are all encrypted. We know that changing the password will ...
- 111
2
votes
1
answer
91
views
Chatting server that doesn't know who the end clients are
I am thinking of creating a small chatting server. I want it to be as secure as possible so I found it to be very helpful if some expert could guide me a little bit.
Has there been any research on or ...
- 121
0
votes
1
answer
158
views
Is it secure to send messages between a WS Server and the client?
Is it secure to send messages between a WebSocket Server and the Client?
An example of sending messages between a (Socket.io) server, is in Node.js:
socket.on("myMessage", function(msg) {
// ...
- 269
2
votes
2
answers
457
views
CAPTCHA w/o Server-Side Persistence
I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key.
The ...
1
vote
2
answers
613
views
Multiple Established TCP Connections on Port 3389 - Is my server compromised?
If i run
netstat -an
on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP)
The first IP Adress is mine, however i cant explain the other two connections. They both ...
- 41
2
votes
2
answers
431
views
Is it bad practice or major security risk to cache decoded auth tokens in my backend?
I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
- 121
1
vote
1
answer
168
views
Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?
I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
- 145
0
votes
0
answers
109
views
What are my vulnerabilities with this multi-user ACL database approach?
I would like some expert insight. I want to know what my vulnerabilities for this model are.
This is a demo project that I will be following in my production app if all works out securely. My ...
- 261
0
votes
1
answer
223
views
Can the hosting provider who has access to the email server machine, access the emails?
I am planning to use a self hosted (Linux based) email server. However, the server will be on hosting providers machine. The hosting providers will have access to the physical machine. In that case, ...
- 137
0
votes
0
answers
170
views
A way to provide a TLS certificate that is not self-signed or using AWS private certificate authority
I need to secure the communications between my frontend and backend. My frontend resides in a PHP server owned by DonDominio (web hosting) and my backend in an instance in AWS.
My public web domain is ...
0
votes
0
answers
94
views
Ad popups showing on personal website deployed on VPS
I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
- 1
0
votes
1
answer
127
views
Telling the backend where to go from client side
I have a system with three layers: two client web apps, one Backend, and two DBs.
The two DB and client app instances represent prod and test environments.
The backend has only one instance that ...
- 151
1
vote
1
answer
124
views
Multiple server fields in HTTP Response
Recently, during a pen-testing exercise, I noticed that the target server responded with multiple "Server" fields in the header. I was wondering what it could mean and if oddity is somehow ...
- 646
1
vote
1
answer
2k
views
Spam GET And POST Requests - Are They Dangerous?
I am getting a lot of spam GET and POST requests lately which some of them look like this:
"GET /config/getuser?index=0 HTTP/1.1" 404 143 "-" "Mozilla/5.0 (X11; Ubuntu; Linux ...
user257368
1
vote
1
answer
133
views
Dyanamic class load for server side application
Is there a problem to use reflection (specifically class.forName) in server side application?
My main thread about this is someone to inject a code dumping memory in JVM and adding commands in ...
- 11
1
vote
1
answer
102
views
Is unrestricted query access to dedicated DNS server considered an insecurity?
Let's say hypothetically a business has a network and some respective infrastructure. Importantly, a VPN for giving remote secure access to work resources, and a (not so)private DNS server for DNS but ...
- 82