Questions tagged [webserver]
A system whose primary function is to deliver web pages on request to clients.
865
questions
0
votes
1answer
48 views
Securing application server for a single user
I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
0
votes
0answers
46 views
Hacking Attempt Requests Not showing Up on Webserver Logs But Google Analytics Shows it
Which hacking tool makes a request and does not show up on web-server logs?
/en/latest/ has been requested over 116, we don't have this URL on the website at all!
The request to that URL does not show ...
0
votes
0answers
49 views
Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?
I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...
0
votes
1answer
76 views
using Uuid for security
I read that uuid does not bring any security advantages
But I can't find why It doesn't bring a little bit of extra security in the scenario below ?:
Consider that right now the session id is ...
2
votes
2answers
81 views
Is it safe to run a flask server in a development environment?
I have a project that I have to present on a Zoom call for my AP Computer Science class. I have a flask site that I am running off of my laptop onto a port forward. When I run the server it says:
...
1
vote
1answer
43 views
Security risks by hosting a Nextcloud on home PC via virtual server
I found this question I want to host a server from my home computer; safe? that indicates that hosting anything connected to the open web on a private is a great security risk. As I am totally new to ...
2
votes
2answers
92 views
How to protect web server private keys on Ubuntu with Nginx without exposing any plain text credentials?
I'm developing a set of internal websites and services for a customer who has high levels of bureaucracy and strict formal rules about many things, one of them being "not storing passwords in plain ...
0
votes
1answer
75 views
What does the following lines of code mean? Can anyone explain step by step? [closed]
I'm still learning and this was a part of using systemctl for privilege escalation.
eop=$(mktemp).service
echo '[Service]
ExecStart=/bin/sh -c "cat /root/root.txt > /tmp/output"
[Install]
...
1
vote
1answer
26 views
What is the best file permission for .user.ini in hosting folder?
My hoster placed a .user.ini in my public_html. What is the recommended file permission be? Now it's 644.
0
votes
2answers
52 views
How to detect malicious files or web shell on a vps web server
How is it possible to detect malicious files or web shell on a vps web server?
I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
1
vote
2answers
60 views
Can DirBuster list all website links or information displayed on a static website?
I am in the process of looking for a specific keyword on a particularly large website with lots of pages. I'm thinking I'd have better luck if I have a way to see the links within the website. If I ...
1
vote
1answer
69 views
Help Prevent Videos From Being Downloaded or Hotlinked ~ OpenLiteSpeed Server
How do I protect videos on my server from being downloaded or hotlinked on a different site but accessible on/by one website only. I'm open to utilizing any integration either via .HTACCESS or CORS
...
0
votes
0answers
34 views
How does authentication and certificate exchange occur when connecting to a website and how is the trust verification performed? [duplicate]
I'm learning PKI infrastructure but i have some questions that my teacher don't respond.
Thank you for the possible answers.
1
vote
1answer
121 views
Why is my web site being scanned for license.txt, and should I be worried?
Lately I am seeing multiple daily 404s for variations of "license.txt", e.g., "wordpress/license.txt", "blog/license.txt", "old/license.txt", "new/license.txt". Here's a little snippet of slightly ...
0
votes
3answers
112 views
shifting PHP files to .TXT output
Is it theoretically possible to transform PHP files to raw plaintext?
I can add the .txt after the server-side programming language extension, but if it is rendered in the wrong content-type, is it ...
1
vote
1answer
256 views
There seems to have been an attempt to attack my website [duplicate]
I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious.
I wonder what kind of attack the attacker attempted.
The attacker ...
0
votes
0answers
53 views
Can you use a domain to forward web traffic at DNS to another domain but still use the MX record for this domain
What I am attempting to do is ensure all ingress web traffic [http(s)] to exampledomain1.com forwards to exampledomain2.com but I still want to use the MX record of exampledomain1.com to point to at ...
1
vote
2answers
79 views
is iptable whitelisting secure enough in AWS
Suppose my app is hosted on multiple servers, within the same data center (say in AWS or DigitalOcean). To secure communication between these servers, I use iptable to whitelist each other's IP.
...
1
vote
0answers
100 views
Unknown website tries to connect to my website [duplicate]
A few minutes ago an error popped up on my error tracing app. I'm hosting a Django app which has login system.
The error says:
Invalid HTTP_HOST header: 'www.moxing.one'. You may need to add 'www....
0
votes
1answer
94 views
What are the risks of using non-ssl connection between server and (externally hosted) database?
I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
1
vote
2answers
90 views
VPN service - change of ip
Imagine I connect to example.com, change my IP address using my VPN service, and then remain on example.com in my browser. Meanwhile I open some other sites and eventually switch off my VPN service. ...
2
votes
1answer
61 views
PDF Server Side 2020
I have been gathering information on handling PDF files for web applications. Much of my research has been on displaying the files to the user.
What I want to learn here is how to properly handle the ...
1
vote
1answer
74 views
Which has to handle certificate, a website, a web server or a web application?
In web, what is a certificate issued to, a website, a web server or a web application?
Which has to handle certificate, a website, a web server or a web application?
For example, when I run a web ...
2
votes
2answers
184 views
Does Cloudflare masking my IP make my server more secure?
I've heard in a conversation and read in some forum posts that Cloudflare will proxy your IP, hiding it from the public, and this mitigates the risk of an attacker finding your server in the first ...
2
votes
1answer
393 views
Can a user hack a server running apache from a website
Is it possible that a user can hack a server running Apache httpd from the website it hosts? Let's say I have a PHP web application running under Apache with explicit user www-data in the virtual host ...
0
votes
2answers
87 views
Is it safe to publish a REST API client on npm even though the API is not intended for public use?
I am build a website in Angular which communicates over my REST API on my backend server.
I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
0
votes
1answer
459 views
Strange HTTP request from binaryedge.ninja
I found the following strange HTTP request apparently emanating from binaryedge.ninja:
min-li-ustx-12-13-65991-x-prod.binaryedge.ninja - - [05/Jan/2020:07:18:48 -0500] "GET / HTTP/1.0" 302 212 "-" "-...
17
votes
3answers
4k views
What use would a privacy browser, such as Firefox Focus for iPhone, have for an internal web server?
The Mozilla Foundation has a "privacy browser" called Firefox Focus that is available for example iPhone (here). This browser has an always-on ad blocking function.
I was checking the third-party ...
0
votes
1answer
70 views
Is it a security issue that underlying infrastructure (like e.g. Kubernetes cluster) can easily be revealed?
I have recently found out that a very common setup of Kubernetes for some use cases of access over TLS returns an invalid certificate with name Kubernetes Ingress Controller Fake Certificate. I.e. ...
0
votes
2answers
197 views
Is it a security issue that Nginx returns server name in errors?
I have recently sat up an Nginx in a way that makes it not return a Server header and hide the version information from the error pages.
The error page looks like that now (and anyone can provoke it ...
1
vote
2answers
126 views
Locking server ‘root’ to IP whitelist, But prevent my lockout
To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file. But getting locked out of my server is even worse than getting ...
0
votes
0answers
78 views
Western Digital My Cloud - Website GUI & Security
I am trying to figure out if using the Website "files.mycloud.com" is exposing my files to being intercepted at a central point.
I see that there is an HTTPS connection with valid cert for *.mycloud....
2
votes
1answer
107 views
Can someone perform DDoS on my VPS even if it is only accessible through SSH?
Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
0
votes
2answers
111 views
Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?
I have a content site https://www.mysite.com
I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
1
vote
1answer
167 views
Leaking details about the user in web application
Imagine a web application, which is used for getting og Open Graph tags from url. User can submit a form, which has single url input. Server opens the url in a headless browser, get og:title, og:...
-1
votes
1answer
50 views
How to protect my webserver from unauthorized client applications? [duplicate]
I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser).
any person (even without registering) shold be able to access the webservices but ...
0
votes
0answers
57 views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
3
votes
2answers
92 views
Are there potential risks to sending HEAD requests to user-supplied URLs?
I have an application that unshortens URLs by using the python requests library to send HEAD requests with allow_redirects=True. I don't do anything with the response except check the response URL. ...
3
votes
1answer
192 views
UUID as auth token [duplicate]
I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
38
votes
5answers
7k views
Why do some web servers still provide information on vendor and version in the HTTP response headers
I think in the security field it is a well-known fact that its not a good idea to let the web server vendor (e.g. Apache) and the version be visible to the outside as this can be used to launch ...
1
vote
1answer
145 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
0
votes
1answer
79 views
is sending SQL query operators in HTTP GET requests is some kind of security issue? [duplicate]
Our webserver is forwarding HTTP GET request to application server as below including a statement or condition like "AND 1=1", our Palo Alto Firewall detecting this traffic as SQL Injection alert.
...
1
vote
2answers
207 views
Does it really improve security to update PHP interpreter version without any code changes at all?
Our hosting provider wants to update our legacy application server (Plesk).
We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.
...
3
votes
1answer
226 views
Does Nextcloud installation gives passwordless access to all files by default?
I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
242 views
Where precisely are client X509 certificates stored?
Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
-1
votes
3answers
278 views
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques?
During a conversation with a friend he said it is enough to use web ...
0
votes
0answers
38 views
Hacking attempts to our server - what does this code do? [duplicate]
Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like
css2.php db_model.php ....
1
vote
1answer
66 views
Reverse proxy isolation from insecure blog, are sessions vulnerable?
Hi I have a WebApp where security is important. E.g.
www.somewebapp.com
The app has a wordpress blog (hence not secure since wordpress). e.g.
www.somewebapp.com/blog
To protect the webapp from ...
1
vote
0answers
28 views
Securing multiple systems accessing the same data
I'm hitting a roadblock when it comes to security for managing scoped permissions for servers.
Right now I run a community which can create sub-servers. So community A can allow certain users to ...
0
votes
1answer
183 views
Passing user ID as parameter without any authentication, what are the security risks?
I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).
However, how secure would an ...
