A system whose primary function is to deliver web pages on request to clients.
7
votes
3answers
583 views
Does hiding version numbers increase my security? [duplicate]
I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits.
As an ...
-1
votes
1answer
65 views
How bad is to buy domain name with .ext from another country even if they allow non citizens to own one?
I'd like to purchase a domain name from a country that does not require citizenship, since they can make nice urls, they are more available and sometimes not too expensive too!
But few things annoys ...
7
votes
1answer
122 views
How to force “expensive calculation” when clients connect to my server?
Page 183 of Secrets & Lies on countering denial-of-service attacks:
Some researchers have proposed defenses that force the client to
perform an expensive calculation to make a connection. ...
0
votes
1answer
25 views
oracle weblogic vulnerability
I searched for Oracle Web logic vulnerabilities and found this vulnerability:
Oracle WebLogic Server Cross-Site Scripting and Manipulation of Data Vulnerabilities ...
0
votes
1answer
81 views
Best practices / tips to secure Tomcat 7 in Linux? [closed]
We are going to deploy a web application on Tomcat 7 in Linux os and open a port on the firewall to make the application available to the public.
We do not have any expertise in securing applications ...
0
votes
0answers
44 views
Best practices / tips to secure Jetty 7 in Linux? [closed]
We are going to deploy a web application on Jetty 7 in Linux os and open a port on the firewall to make the application available to the public.
We do not have any expertise in securing applications ...
0
votes
4answers
75 views
How to secure my website's FTP?
When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable.
connected to mydomain.com.
220----- Welcome to Pure-FTPd ...
0
votes
0answers
39 views
Checklist for securing JBoss
Is there a security checklist for auditing JBoss configuration files ?
CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
4
votes
2answers
136 views
Retention periods for web logs
I work for an ASP that provides banking solutions
Card
Services
Payments
ACH
Online Banking
And others
Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
0
votes
1answer
36 views
Virtual private server security [closed]
I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
4
votes
3answers
46 views
Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?
Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?
Whether it it be through htaccess setups, posting login ...
3
votes
4answers
96 views
What things should I check for when giving a client control of the filename parameter to C's open() function?
I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
1
vote
2answers
47 views
Preventing interaction among web application on a shared hosting account
I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too.
So, My ...
0
votes
1answer
35 views
Security implications of putting virtual hosts source code in /var/www/[domain]
A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS)
I see that it's possible to reach the virtual hosts ...
0
votes
2answers
57 views
Directory traversal & default filesystem permissions (755) for web server
I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
0
votes
2answers
57 views
Is it possible to sabotage google bots? [closed]
Consider the following theoretical webserver:
On any request, produce an html response that consists of 2 links,
which are each randomly chosen strings followed by ".html".
When the google bot ...
5
votes
3answers
405 views
First steps in preventing DOS attacks
My server is currently being attacked from another server. This is my log:
root@my-server:/var/log# tail -f auth.log
Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
0
votes
0answers
22 views
Why is it not advisable to have the database and web server on the same machine? [duplicate]
I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..).
My hypothesis is that the cost of ...
13
votes
3answers
318 views
“Optimal” Web Server SSL Cipher Suite Configuration
Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4)
My ...
0
votes
1answer
144 views
Can closing port 80 lead to more security?
If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
0
votes
1answer
25 views
How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?
was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
3answers
61 views
Why pull upgrade from production server rather pushing them from development server?
I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
1answer
137 views
Authenticating Users from Android with PHP Webservice
Im creating a simple Android Application,which requires reading and writing values to the cloud.I intent to use PHP for the webservice.
But im little confused over the authentication scheme.I intent ...
1
vote
1answer
82 views
Is authentication through proxy sites safer?
usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
2
votes
2answers
58 views
Does reverse proxy between two web servers impact security of both?
Situation:
Consider the site: example.com, hosted at web server A.
A WordPress blog is to be installed on a different web server, B.
In order to route a WordPress installation to a subdirectory on ...
4
votes
1answer
56 views
Dangerous to open a unix socket within www root?
My web server is chrooted into /var/www, and its contents are available over the network.
One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
1
vote
2answers
83 views
PCI DSS - only one primary function per server
The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function'
we have a webserver with database - web pages and email
is ...
0
votes
1answer
50 views
Different certificate information for the same website?
Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
0
votes
1answer
61 views
Possible ways of exploiting PHP register_globals [closed]
I have a PHP script that executes a bunch of commands to verify that a user is logged.
if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
0
votes
0answers
27 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
2
votes
1answer
124 views
How to run a tor hidden service from home securely?
Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught?
Assume I am running the server from home, over a ...
-1
votes
1answer
40 views
What features boost security for a home edge router?
I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
1
vote
1answer
60 views
What is LFI vulnerability
LFI: Local file inclusion.
After going through many tutorials I have two things I can/t figure out:
checking the vulnerability: I don't understand what makes a website vulnerable or not. For ...
1
vote
1answer
114 views
How to deny shell execution in all sub-directories?
I want nginx to deny users who have folders inside /webroot/uploads
e.g.
/webroot/uploads/user1
/webroot/uploads/user2
/webroot/uploads/user999
to execute any shell (php, pl, py, binary).
The ...
3
votes
1answer
295 views
Why does Directory traversal attack %C0%AF work?
Introduction: I am trying to learn the basics of Directory Traversal.
Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
2
votes
2answers
429 views
What is the ultimate goal of hacking a webserver? [closed]
Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
3
votes
2answers
337 views
Identify and disable weak cipher suites
i'm asking a question on a subject that is pure chinese to me..sorry in advance
A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
0
votes
3answers
176 views
How to detect anomalous activity in web server traffic?
I'm wondering how to successfully detect malicious activity in my web server traffic?
Could you point me out some popular solutions which can help me to detect attacks on my web application?
I ...
0
votes
1answer
48 views
What security exposure (if any) can result from lots of apparently odd referrers in server log
I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one.
8 3 http://tiandeural.ru/
19 ...
1
vote
1answer
60 views
How to Minimize Apache Loadable Modules (serving MediaWiki)
According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy:
"In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
19
votes
2answers
796 views
Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
4
votes
1answer
110 views
Increased HEAD traffic to my website
In the last few weeks I have been getting an increased HEAD traffic to my website of the form
HEAD / HTTP/1.0" 200 0 "-" "-"
This just returns the details of my web server, right?
The IPs are from ...
3
votes
2answers
196 views
Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?
Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
2
votes
1answer
202 views
How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?
If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe.
Let me explain before this ...
7
votes
1answer
136 views
Why Apache runs as unprivileged user?
Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is
How this measure prevents ...
1
vote
2answers
136 views
How to Check if my mail is classified as Spam
I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues.
It might be a false positive cases with the associated tools
Is there a tool or a way by ...
1
vote
1answer
65 views
Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?
Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
-2
votes
1answer
86 views
Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]
I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
0
votes
3answers
334 views
Can my customer's ISP trace who visited my business website?
I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
0
votes
1answer
540 views
What methods are there of protecting a VPS from DDOS attacks? [duplicate]
I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
