A system whose primary function is to deliver web pages on request to clients.
11
votes
3answers
960 views
Why do clients request .php files my server does not host?
I am running a web server and watching what people request. I have been getting frequent traffic like:
GET /phph/php/ph.php HTTP/1.1
or
GET /mrmr/mrm/mr.php HTTP/1.1
Are these scans? Are the ...
1
vote
1answer
25 views
add another layer of protection on top of oauth 2
My Rest API is protected using Oauth2. My main client is a native app.
it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
1
vote
1answer
39 views
Best practice for https Private Key Generation
I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
10
votes
4answers
806 views
What is Net-Worm.PHP.Mongiko trying to do?
I found several lines of this request in my web server access log:
Source IP Dest IP Request Stat User agent
217.172.190.19 ...
2
votes
1answer
58 views
Whitelist for HTTP request
Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
3
votes
3answers
75 views
PHP | Security for allowing user uploads
My Sittuation:
I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
-1
votes
0answers
29 views
What are the specifics on non-compliance for a US Financial Institution (CU) that has a website using shared hosting, and apache HTTP authentication [on hold]
Take for example, a US Credit Union that has a web site/application with extremely poor security.
The example website is hosted on a large shared host, with hundreds and hundreds of employees from ...
3
votes
1answer
31 views
Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?
If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA.
The use case is that some clients have ...
2
votes
1answer
82 views
Root server hacked via httpd - consequences and future prevention
Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
0
votes
2answers
102 views
Google Analytics: Hacked or Ghost Referers?
I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior.
I've got a web application ...
3
votes
1answer
92 views
Why does my web server receive so many TCP resets from some clients?
I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this:
Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
2
votes
0answers
29 views
Securing elasticsearch behind a reverse proxy
I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on 127.0.0.1 only. I ...
1
vote
2answers
29 views
Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?
When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)?
If differences ...
1
vote
1answer
71 views
How do I know if root account has been compromised?
My server was hacked with some files being overwritten to generate spam links on the index page. All my previous backups contain the same modified files, making the nuking from orbit option a puke. If ...
0
votes
1answer
53 views
Web app and database on same server, what is benefit of encrypting database data?
If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way.
I assume that if an attacker can ...
0
votes
0answers
13 views
Problems using HSTS header at top level domain with includeSubdomains [migrated]
Let's say I run a company "Example Inc" and have a website at:
https://www.example.com
Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
34 views
Is Apache enough to prevent unauthorized access? [migrated]
I've just been assigned to finish the development of an application which has user restricted access. The original developer was a co-op student, as am I.
After looking over his code it seems that ...
0
votes
1answer
50 views
How secure is internal data on the internet with IP authentication?
I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
1
vote
1answer
39 views
Secure (P2P) Client/Company File Sharing
my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored.
The ...
2
votes
2answers
76 views
If I set up a home web server, will computers that use my wi-fi be vulnerable?
I'm interested in setting up a web server on an old laptop L1. My plan is to connect that laptop to an Ethernet port on my router. I also have another laptop L2 accessing the router via wi-fi. L2 ...
2
votes
2answers
171 views
Website infected with unwanted “redirections”, apparently via javascript code
I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
0
votes
2answers
52 views
Unpublished server
Is it possible to setup my web server such that only certain sources can access and the public from internet has no access? i am thinking that we could just not publish our web server URL/IP to our ...
0
votes
3answers
77 views
htaccess - protect php file execution in specific directory
How can I protect php execution in specific upload directory?
Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers.
So how can I ...
2
votes
1answer
35 views
Website Implementing https site w/ self signed certs and CA
Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)?
I am some what torn on how to do this - I have a number of implementaiton ...
0
votes
1answer
61 views
Have i been phished? [closed]
I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
1
vote
1answer
95 views
Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?
We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test
Specifically we're losing points for the following reasons:
Forward ...
1
vote
1answer
46 views
How safe are networking ACLs based on IP-address?
As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request.
Therefore, I cannot see how an Access Control List (such as ...
1
vote
2answers
115 views
Security of php code on webserver - obfuscate?
Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft?
I think my question boils down to 'Is there a ...
0
votes
2answers
72 views
Scan all possible files on server (Brute force Filenames)
I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
1
vote
2answers
87 views
Path traversal exploit
I have an Apache server which seems to be vulnerable to Path traversal, because when I test This url : http://localhost/ati/../test.txt
it will be changed to the this: http://localhost/test.txt
and ...
0
votes
2answers
52 views
Security risk of using virtual hosts for public and internal sites
I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
2answers
96 views
Secure android and server calls
I plan on adding an authentication system on my android app using web services.
When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
2
votes
1answer
42 views
Spoofing of Server Sent Events
In the spec for Server Sent Events, it says
Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
1
vote
3answers
154 views
Beyond SQL injections and XSS
I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question.
I did all the major things to secure my website. I ...
-6
votes
2answers
61 views
Large web application security challenges [closed]
What are the biggest challenges of security in web applications?
I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
3
votes
2answers
116 views
Web server interaction with a database server
It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
2
votes
2answers
351 views
How to display friendly notification about no TLS 1.0 support in browser [closed]
A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support.
This typically results in a cryptic (to a normal user) ...
2
votes
1answer
56 views
For PCI compliance, does every request need to be logged regardless of how it affects system performance?
Our cloud based service is currently undergoing changes with a view towards PCI compliance.
It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
8
votes
3answers
130 views
What are the risks to a network if a single computer is compromised?
If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
2
votes
1answer
77 views
Redeploying multiple Secure sites on a single server
This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
1
vote
0answers
34 views
Does standard configuration in Tomcat pose any security risk?
I have a simple test website on Tomcat running on RaspberryPi. Pi is behind a router. Port forwarding is on and I can access the website from the Internet.
What are the security risks of standard out ...
0
votes
0answers
58 views
firewall zones for private web server
How can I configure the zones of a firewall to provide maximal security for a private web application?
Here is the use case:
1.) Twenty known users will have http/https access to the web
...
0
votes
1answer
56 views
Application-Server connection security
I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
98 views
How can this web server be compromised?
A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html.
An interesting characteristic of ...
0
votes
0answers
62 views
Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos
Hello
I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server.
I wanna do this using Netsh advfirewall, In Linux I use IPTables:
iptables -I INPUT -p tcp --dport ...
-5
votes
1answer
113 views
How to avoid DDoS Attack [closed]
I buy my train ticket from our railway local web site. When ticket open for sale on web site then web site original traffic remain 50 (Just an example). Our railway web site is attacked by DDoS for ...
2
votes
4answers
72 views
Find the destination script of an inbound TCP connection on our shared webserver
We have a shared webserver which is being monitored constantly by our ZABBIX agent.
On some hours of day we have unusual TCP traffic on port 80. Lets say we have over 400 connections from IP address ...
1
vote
1answer
104 views
How does a browser choose which certificate to use if my web server has multiple certificates?
I'm using Apache 2.4, with two certificates, one RSA signed by CACert, and one ECC self-signed. Neither of these certificates provide a path to a broswer-trusted root certificate. My question is ...
2
votes
1answer
99 views
Best practice in securing a web server and an offsite worker
Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
1
vote
4answers
90 views
employing SSL even on non critical web server [duplicate]
I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
