A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

3
votes
3answers
168 views

Is web application connected to a database via an application server is more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
1
vote
0answers
29 views

What can go wrong when allowing file uploads on a web server? [on hold]

Some basics that are self-evident: Infected/harmful file can be uploaded for other users to download A bug in the web-site's code allowing code execution, thus allowing execution of the uploaded ...
-4
votes
0answers
44 views

What is most secure web framework for a secure website? [closed]

What is most secure web framework for a secure website? Give me the best tips for a server and framework configuration: OS name-version, webserver, database, php. And tips for securing it. Thank you ...
2
votes
1answer
63 views

What are the main advantages of using LibreSSL in favor of OpenSSL

What are the main advantages of using LibreSSL vs OpenSSL? As I understood LibreSSL is a fork of OpenSSL: LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
20
votes
5answers
2k views

Should I use a second/dedicated IP address for SSH?

When running a public web server (e.g., with Apache), I've heard it's recommended to bind SSH to a second IP address, different from the one Apache is listening to. But for me it seems like this is ...
-1
votes
1answer
43 views

Is this MITM attack possible? [closed]

I am wondering if this would be possible. Lets say that I have a server in my home and it is properly port forwarded and everything which means that the website can be accessed outside of the network. ...
1
vote
1answer
76 views

How secure and how to find if a website use Flexible SSL from Cloudflare?

How secure is that technology? Can someone tamper with your traffic between a server and Cloudflare in the first place? And if the answer is yes, how can you check if a website is using the ...
3
votes
1answer
22 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
2
votes
2answers
30 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database ...
-1
votes
2answers
59 views

need to hide server details using apache server whenever there is 404 or 403 error [closed]

I need need to hide server details using apache server whenever there is 404 or 403 error. I tried with the below two changes in httpd.conf file. ServerSignature Off ServerTokens Prod ...
3
votes
1answer
525 views

Is my server vulnerable to a perl exploit?

I have a few worrying entries in my web server logs and I'm wondering if this means that my server is vulnerable. Firstly, the following seems to fail, receiving a 404 response: ...
0
votes
1answer
43 views

Block web content authoring from internet

In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet? Configuring httpd.conf to restrict the content ...
0
votes
1answer
59 views

Is it a breach to have a ssh program into a tomcat server

I start to working in a project here and find something that at least seems odd to me. Since I'm not an specialist I came here to ask. It is a Java Web project that was made to run into a Tomcat ...
4
votes
3answers
88 views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
2
votes
2answers
67 views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
1
vote
1answer
64 views

How to trace someone's(hackers) IP who made a lot of request on my website? [duplicate]

Somebody made a lot of(unusual, like never before) http requests on my website, I checked this thing on google analytics and it shows that someone with no lang, no country has visited my website. My ...
-1
votes
1answer
42 views

Starting a server without SElinux or Apparmor [duplicate]

The Debian kernel that compiled for Beaglebone Black, doesn't support SElinux and Apparmor, AFAIK. I just want to know, is it safe to put a server on the internet without SElinux or Apparmor? However ...
3
votes
3answers
73 views

is g-zipping assets a security concern?

I recently noticed that the assets sent to clients aren't gzipped or minified on either my companies intranet or its public facing website. I brought this to the attention of the networking ...
0
votes
1answer
60 views

Does the server administrator see what sites I visit

I have seen a lot of answers but here is the peculiarity of mine. In the office we all have a login to the WiFi, First with that login, if I use Tor will my visited sites still be logged by the ...
0
votes
1answer
149 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
2
votes
0answers
36 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
4
votes
1answer
48 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
28
votes
5answers
5k views

How do attackers find the IP addresses of recently deployed servers?

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
3
votes
3answers
152 views

What should I be aware of when opening my home server to the internet?

I've built a home server (pretty much just a basic PC with a couple of big HDDs) which I would like to use as an FTP server and a minecraft server. Both would be for members of my gaming community. I ...
0
votes
1answer
46 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
3
votes
3answers
439 views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
4
votes
0answers
20 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
7
votes
3answers
931 views

Finding hidden page on webserver [duplicate]

I have a web server with 2 page: index.html and secret.php. The content of index.html is: <html><body><h1>It works!</h1></body></html> You can see the ...
3
votes
1answer
147 views

CVE-2015-4852: Infected traffic pattern

Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like? I'm assuming I would see HTTP requests attempting to make connections directly from ...
1
vote
3answers
123 views

Is it necessary to update JRE in an Apache Tomcat Server?

We have a Java web application contained in an apache tomcat instance. JRE version is 7.0.51 and Tomcat version is 7.0.42. Users have expressed their concerns about Java 7's support/updates being ...
3
votes
0answers
79 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
1
vote
2answers
38 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
1
vote
1answer
56 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
2
votes
1answer
81 views

How do hackers get into servers? [closed]

I am a web developer. I've checked How does hacking work? and I know all of the things described in the most upvoted post. However, I can't understand how do hackers get into servers when the website ...
7
votes
3answers
664 views

HSTS on sites available over HTTP and HTTPS

I'm wondering if it makes sense to enable HSTS on a site that is served over HTTPS as well as over HTTP. What I mean is to add HSTS-Header if the site is accessed over HTTPS. But there is no ...
12
votes
3answers
1k views

What security measures should be taken when running a Linux web server out of our office?

I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
1
vote
4answers
209 views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
2
votes
2answers
46 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
2
votes
1answer
151 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
2
votes
2answers
376 views

Odd url showing up in my pubsub stream, should I be concerned?

Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
6
votes
2answers
118 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
2
votes
1answer
29 views

How to go about password hashing when constrained to low work factor

I'm developing a social website as a side-project and seeing if it actually goes anywhere. I'm using bcrypt right now to store passwords and unfortunately I'm only able to get my webserver to do a ...
1
vote
2answers
74 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
12
votes
3answers
2k views

Is “mini-httpd” a secure web server?

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd? Being a lesser known web server means that it's less likely ...
0
votes
0answers
19 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
3
votes
0answers
998 views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
1
vote
2answers
2k views

What algorithm should I use to avoid the error “ERR_SSL_WEAK_SERVER_EPHEMERAL_DH_KEY”?

I got a CA cert by submitting my CSR from GoDaddy, after applying a certificate to my Tomcat web server. When I access my website using Chrome or Mozilla I face the error: ...
1
vote
2answers
42 views

ssh/scp from server to server — set permissions (no root)

I have access as a regular user (not as root) to two servers. Server A is accessible via ssh with a username and password, Server B can only be accessed using a keycard and pin. I need to set up a ...
4
votes
3answers
228 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
19
votes
1answer
2k views

The “.htaccess” file can be downloaded. Why? How to fix?

Maybe a noob question. I've tried searching but maybe my search terms were too specific. I've just conducted a pen test on a client's site. The site allowed me to download .htaccess just by simply ...