2022 Developer Survey is open! Take survey.

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?

From a Nessus scan I have the following output regarding HTTP and the use of port 80: Info N/A 43111 HTTP Methods Allowed (per directory) Info N/A 24260 HyperText ...
user avatar
  • 23
1 vote
1 answer
60 views

Is it safe for website to generate fake profile pages?

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
user avatar
0 votes
1 answer
46 views

Do WSGI servers connect to devices outside of the network?

I want to set up a plotly dashboard and view it from my browser. Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
user avatar
  • 101
0 votes
1 answer
29 views

Recommended secure option for uploading files to web server from a dynamic IP?

I need the best way to access a webserver to upload/modify a PHP script. The website contains very sensitive information, gaining unauthorized access to this server and modifying files would lead to ...
user avatar
0 votes
1 answer
94 views

Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?

I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error. How to reproduce: ...
user avatar
0 votes
1 answer
30 views

Multiple random requests for Non-Existent URLs from a single IP resulting in 404s

We sometimes get to see this behavior from a single IP address/logged in user - There are a lot of hits on our server that have .png at the end of the URL which results in a 404 because we don't have ...
user avatar
  • 1
0 votes
0 answers
13 views

How to detect web account vulnerability [duplicate]

I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login. ...
user avatar
1 vote
2 answers
65 views

Securely storing password and encryption key on AWS

I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
user avatar
3 votes
2 answers
534 views

Do we need to check for cross-origin on server side?

Modern browsers don't allow cross-origin requests - those must be explicitly allowed by CORS headers. But looking at Java back ends like Tomcat/Spring MVC I see that it's possible to reject requests ...
user avatar
0 votes
3 answers
162 views

successfull log4j exploitation, or just normal traffic?

First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :) I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
user avatar
  • 1
0 votes
0 answers
87 views

What should I do after an attempted Mozi attack?

I was testing a small webpage using Django's built-in server. The webpage simply shows the IP of the visitor of the webpage, and prints the IP address in the terminal. The server is hosted on a Ubuntu ...
user avatar
0 votes
1 answer
72 views

How can 2FA help prevent formjacking?

This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking: Enable 2-Factor Authentication: Create strong and complex ...
user avatar
0 votes
0 answers
95 views

Is it possible to hide a servers location on the internet?

Can you make a server appear to be in another country and how would you do it?
user avatar
  • 1
3 votes
3 answers
387 views

Someone found an obfuscated path on my website. Is this possible without hacking my site?

I am running a server with Django and Nginx. I tried to hide the admin panel by assigning it a 50digit random string as URL (something like https://mydomain/asidfhifuerbdsi...). Now someone found this ...
user avatar
  • 131
2 votes
0 answers
66 views

What does this potentially malicious php code do? [duplicate]

Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
user avatar
0 votes
0 answers
96 views

Confirm User Account Without Exposing IP of Server?

Right now, when a user signs up for a new account on my site, the server sends the user a email verification link. When the user clicks the verification link, the link redirects to my server to ...
user avatar
1 vote
1 answer
129 views

Does it make sense to configure the web server to deny obviously malicious requests?

I have a Ruby on Rails app behind Nginx. Every once in a while I see requests like GET /phpmyadmin or GET /wp-login.php. Since I don't have those tools installed, it's obvious that those are from ...
user avatar
1 vote
2 answers
143 views

Is there way to know what headers can be accepted by HTTP server?

Imagine that there is server required authentication for getting an access to some endpoint. And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
user avatar
0 votes
1 answer
143 views

Restrict web access with whitelists

Can I secure a website using a simple whitelist system? My idea is to port forward a website www.example.com on my pc. To secure it, I want to add a whitelist system. It will work like this: When the ...
user avatar
  • 1
0 votes
1 answer
78 views

How strict should I be in rejecting unexpected HTTP request parameters redux?

I read this: How strict should I be in rejecting unexpected query parameters? Answer: No, do not error out on unexpected query string parameters. But I just got a requirement from our security guy ...
user avatar
  • 5,587
1 vote
1 answer
121 views

What is the most up-to-date secure method for storing .ENV variables?

I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this ...
user avatar
  • 11
0 votes
1 answer
346 views

Changing $_SERVER['REMOTE_ADDR'] remotely

On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?: user www; pid /run/nginx.pid; error_log /dev/stderr info; events { ...
user avatar
  • 35
1 vote
1 answer
102 views

Is this HSTS HTTP Response Header Misconfigured?

I recently discovered during a penetration test that the HSTS was returned by the application but in this format: "Strict-TransportSecurity" Instead of: "Strict-Transport-Security" ...
user avatar
0 votes
0 answers
31 views

How to recover a hacked site with WSO Shell [duplicate]

Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded. Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed. ...
user avatar
0 votes
1 answer
144 views

How reverse proxy works?

I know that forward proxy can enhance security by replacing client IP's address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who's requesting a ...
user avatar
0 votes
1 answer
118 views

Unclear attack(?) on web server: GET requests for tar files

I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and ...
user avatar
  • 103
0 votes
0 answers
83 views

Confidentially seperating web content under single IP address

I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..). This content I wish to reside on the same web server under which personal web content resides. (None of this ...
user avatar
  • 1
0 votes
0 answers
91 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
user avatar
0 votes
0 answers
16 views

What does this obfuscated PHP script do? [duplicate]

I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake. The script in it's original form looks like this: $zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
user avatar
  • 223
1 vote
1 answer
154 views

Blocking reflected XSS on common web servers

How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx? The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
user avatar
  • 33
1 vote
1 answer
109 views

Best methods to mitigate DDOS with changing IP sources

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
user avatar
1 vote
1 answer
155 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
user avatar
0 votes
1 answer
136 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
user avatar
  • 1
0 votes
1 answer
523 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
user avatar
2 votes
1 answer
216 views

Docker container exposed port vulnerabilities on Debian server?

I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
user avatar
1 vote
1 answer
100 views

Private keys with or without password for webservices?

What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc. If I create private keys without password they will be 100% compromised if one ...
user avatar
  • 61
0 votes
1 answer
128 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
user avatar
  • 73
1 vote
0 answers
81 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
user avatar
  • 111
3 votes
1 answer
291 views

What are these long hexadecimal HTTP requests? [closed]

I'm receiving long hexadecimal requests on my webserver, such as: /...
user avatar
  • 31
0 votes
1 answer
99 views

TLS integration of webapplications

Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own ...
user avatar
  • 1,013
4 votes
0 answers
372 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
user avatar
1 vote
1 answer
196 views

sudo systemctl running a webserver a security risk?

On linux ami the only way to easily run systemctl for my server is by running sudo systemctl start node In the service: /etc/systemd/system/node.service sudo seems to be mandatory for the 'enable',...
user avatar
0 votes
1 answer
135 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
user avatar
0 votes
0 answers
279 views

Strange get request to my web server [duplicate]

I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
user avatar
16 votes
1 answer
6k views

Does a log entry with "SPT=81" despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
user avatar
0 votes
2 answers
187 views

Hijacking of my site

I have my site xyz.mysite.com this is sitting on Cloudflare. I was reviewing my Apache logs and I saw a website as a referrer I did not recognise. I went to the site and it redirected to my site xyz....
user avatar
0 votes
1 answer
117 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
user avatar
  • 101
1 vote
1 answer
110 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
user avatar
1 vote
2 answers
231 views

How are hidden private URLs being "leaked" to third parties?

We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
user avatar
1 vote
1 answer
96 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
user avatar
  • 347

1
2 3 4 5
19