Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
0
votes
1answer
60 views

Unclear attack(?) on web server: GET requests for tar files

I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and ...
0
votes
0answers
49 views

what is web server attack methodology? [closed]

What exactly is web server attack methodology? I found that the webserver attack methodology is as follows: Information Gathering Web server Footprinting Website Mirroring Session Hijacking Web ...
0
votes
0answers
43 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
0
votes
0answers
88 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
0
votes
0answers
15 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
1
vote
1answer
58 views

Blocking reflected XSS on common web servers

How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx? The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
1
vote
1answer
57 views

Best methods to mitigate DDOS with changing IP sources

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
1
vote
1answer
56 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
1
vote
1answer
64 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
0
votes
1answer
458 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
1
vote
1answer
76 views

Docker container exposed port vulnerabilities on Debian server?

I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
1
vote
1answer
38 views

Private keys with or without password for webservices?

What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc. If I create private keys without password they will be 100% compromised if one ...
0
votes
1answer
55 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
1
vote
0answers
43 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
3
votes
1answer
124 views

What are these long hexadecimal HTTP requests? [closed]

I'm receiving long hexadecimal requests on my webserver, such as: /...
0
votes
1answer
64 views

TLS integration of webapplications

Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own ...
4
votes
0answers
104 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
1
vote
1answer
67 views

sudo systemctl running a webserver a security risk?

On linux ami the only way to easily run systemctl for my server is by running sudo systemctl start node In the service: /etc/systemd/system/node.service sudo seems to be mandatory for the 'enable',...
0
votes
1answer
62 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
0
votes
0answers
46 views

Is it possible to know the keep-alive time supported by a web server?

I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
0
votes
0answers
225 views

Strange get request to my web server [duplicate]

I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
16
votes
1answer
6k views

Does a log entry with “SPT=81” despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
0
votes
2answers
138 views

Hijacking of my site

I have my site xyz.mysite.com this is sitting on Cloudflare. I was reviewing my Apache logs and I saw a website as a referrer I did not recognise. I went to the site and it redirected to my site xyz....
0
votes
1answer
84 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
1
vote
1answer
60 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
1
vote
2answers
167 views

How are hidden private URLs being “leaked” to third parties?

We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
0
votes
0answers
44 views

Dreamhost hosted wordpress site attacked - SSH password was changed - Need help assesing attack vector

My client had his wordpress site attacked, his site is not a juici target, the attack consisted in redirecting the site to another site. That in itself is no surprise, the weird thing is that both the ...
1
vote
1answer
50 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
0
votes
1answer
150 views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
0
votes
0answers
8 views

Is there a utility that identifies attack footprints in HTTPD log files? [duplicate]

We're manually reading HTTPD log files and taking note of service abuse. Example: 10.0.0.1 - - [01/Jan/1970:00:01:01 -0100] "GET /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media ...
0
votes
0answers
39 views

How to perform encryption/decryption in a RESTful system? [duplicate]

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
-2
votes
1answer
474 views

How can I fuzz a http server? [closed]

I was researching fuzzing using AFL and hongofuzz and they mainly support applications that run in the terminal. After that I came across a list of resources for network fuzzers, and found afl-net ...
0
votes
0answers
37 views

E2EE through a browser for multiple users and devices in a many-to-many scenario

I've multiple IoT devices that read and write streams of data (audio/video signals, sensory data, ecc...) and multiple users that can do the same, I should be able to interchange informations from one ...
3
votes
2answers
256 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
0
votes
0answers
31 views

What are these access requests? [duplicate]

So I have a series of these requests in my log and was wondering what they were? It appears malicious but no harm has been done. Can anyone confirm? - Any insight or reading material etc that would ...
0
votes
1answer
418 views

Understanding sqlite3 sanitization in python

I use sqlite3 for my database and get data from untrusted source with flask.request.get() I insert all data with such syntax c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2)) ...
0
votes
1answer
68 views

CDN vs server-level GeoIP

Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare. Because the GeoIP read block is at server level, it never ...
2
votes
2answers
91 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
0
votes
1answer
79 views

Where is the best way to filter user input? [duplicate]

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...
0
votes
2answers
152 views

Is it safe to open a server application on the internal network to the public internet

I am a programmer but I am currently learning about web development in general. I'm creating a server on my local host using nodejs and express. It's available on my local host but I want to test it ...
0
votes
1answer
65 views

Securing application server for a single user

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
0
votes
0answers
51 views

Hacking Attempt Requests Not showing Up on Webserver Logs But Google Analytics Shows it

Which hacking tool makes a request and does not show up on web-server logs? /en/latest/ has been requested over 116, we don't have this URL on the website at all! The request to that URL does not show ...
0
votes
0answers
344 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
0
votes
1answer
268 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
2
votes
2answers
498 views

Is it safe to run a flask server in a development environment?

I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site that I am running off of my laptop onto a port forward. When I run the server it says: ...
1
vote
1answer
109 views

Security risks by hosting a Nextcloud on home PC via virtual server

I found this question I want to host a server from my home computer; safe? that indicates that hosting anything connected to the open web on a private is a great security risk. As I am totally new to ...
2
votes
2answers
231 views

How to protect web server private keys on Ubuntu with Nginx without exposing any plain text credentials?

I'm developing a set of internal websites and services for a customer who has high levels of bureaucracy and strict formal rules about many things, one of them being "not storing passwords in plain ...
1
vote
1answer
110 views

What does the following lines of code mean? Can anyone explain step by step? [closed]

I'm still learning and this was a part of using systemctl for privilege escalation. eop=$(mktemp).service echo '[Service] ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output" [Install] ...
1
vote
1answer
402 views

What is the best file permission for .user.ini in hosting folder?

My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
0
votes
2answers
376 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...

1
2 3 4 5
19