Questions tagged [webserver]
A system whose primary function is to deliver web pages on request to clients.
836
questions
0
votes
0answers
38 views
Western Digital My Cloud - Website GUI & Security
I am trying to figure out if using the Website "files.mycloud.com" is exposing my files to being intercepted at a central point.
I see that there is an HTTPS connection with valid cert for *.mycloud....
1
vote
1answer
72 views
Can someone perform DDoS on my VPS even if it is only accessible through SSH?
Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
0
votes
2answers
69 views
Is it possible to attack the main server through a reverse proxy server that only serves as a url rewrite?
I have a content site https://www.mysite.com
I'm asking a client to configure a reverse proxy server connection in their server so everything inside the subdirectory 'external-content' gets pulled ...
0
votes
0answers
85 views
SSRF to RCE or get it to print the out of file://?
Some site I am testing that retrieves data from some url, I could backconnect using ldaps://ip:port/
I tried wrappers like ldap://, dict:// but only ldaps seem to work.
Also expect:// seem disabled, ...
1
vote
1answer
156 views
Leaking details about the user in web application
Imagine a web application, which is used for getting og Open Graph tags from url. User can submit a form, which has single url input. Server opens the url in a headless browser, get og:title, og:...
-1
votes
1answer
44 views
How to protect my webserver from unauthorized client applications? [duplicate]
I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser).
any person (even without registering) shold be able to access the webservices but ...
0
votes
0answers
49 views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
3
votes
2answers
87 views
Are there potential risks to sending HEAD requests to user-supplied URLs?
I have an application that unshortens URLs by using the python requests library to send HEAD requests with allow_redirects=True. I don't do anything with the response except check the response URL. ...
2
votes
1answer
52 views
UUID as auth token [duplicate]
I am working on a small IOT device that basically is a status display, which includes data about my phone. That means that I have a simple web server running, which can be used to update the devices ...
38
votes
5answers
7k views
Why do some web servers still provide information on vendor and version in the HTTP response headers
I think in the security field it is a well-known fact that its not a good idea to let the web server vendor (e.g. Apache) and the version be visible to the outside as this can be used to launch ...
1
vote
1answer
144 views
For zero-deployment via GitLab Piplines - What kind of unix User?
I want to implement a zero-deployment strategy for my websever.
My first attempt was to create a specific user (deployer) for that:
# Create user deployer
sudo adduser deployer
# Give the read-write-...
0
votes
1answer
77 views
is sending SQL query operators in HTTP GET requests is some kind of security issue? [duplicate]
Our webserver is forwarding HTTP GET request to application server as below including a statement or condition like "AND 1=1", our Palo Alto Firewall detecting this traffic as SQL Injection alert.
...
0
votes
2answers
197 views
Does it really improve security to update PHP interpreter version without any code changes at all?
Our hosting provider wants to update our legacy application server (Plesk).
We usually place older PHP projects (PHP 5.3 - 5.6) there, so they can sit in a stable environment until their unknown EOL.
...
3
votes
1answer
169 views
Does Nextcloud installation gives passwordless access to all files by default?
I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
80 views
Where precisely are client X509 certificates stored?
Apologies for what might seem like a naive question, but there is a detail to PKI architecture between clients and servers, the answer to which I have so far not been able to come across no matter ...
-1
votes
3answers
258 views
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques?
During a conversation with a friend he said it is enough to use web ...
0
votes
0answers
38 views
Hacking attempts to our server - what does this code do? [duplicate]
Every so often I go back and check our server and find random files uploaded to the domain root directory. They are seemingly cryptic and have names like
css2.php db_model.php ....
1
vote
1answer
47 views
Reverse proxy isolation from insecure blog, are sessions vulnerable?
Hi I have a WebApp where security is important. E.g.
www.somewebapp.com
The app has a wordpress blog (hence not secure since wordpress). e.g.
www.somewebapp.com/blog
To protect the webapp from ...
1
vote
0answers
28 views
Securing multiple systems accessing the same data
I'm hitting a roadblock when it comes to security for managing scoped permissions for servers.
Right now I run a community which can create sub-servers. So community A can allow certain users to ...
0
votes
1answer
157 views
Passing user ID as parameter without any authentication, what are the security risks?
I've read that passing GUID as URL parameter isn't considered insecure because usually, an app has an authentication mechanism (checking against some session token).
However, how secure would an ...
0
votes
2answers
248 views
Why does localbattle.net point to localhost?
I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate ...
0
votes
4answers
151 views
Generate Fake Encrypted Data
I want to create a file server that will be serving encrypted files without permissions. It would be really awesome if it were impossible for a hacker to tell if a file exists or not, so I am thinking ...
0
votes
1answer
163 views
When should you give up on attempting a xss on part of a website? [closed]
I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
2
votes
1answer
103 views
File upload security with PHP - Header to text/plain
I am using PHP to create a small script that uploads images to a server.
While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how ...
0
votes
0answers
40 views
“GET //libs/js/iframe.js HTTP/1.1” 200 2305 “-” "python-requests/2.6.0 is it a try to hack into my server [duplicate]
Just Received a request in my nginx log
77.247.110.141 - - [16/Jun/2019:14:03:58 +0000] "GET //libs/js/iframe.js HTTP/1.1" 200 2305 "-" "python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-957.12.2.el7....
0
votes
2answers
124 views
Identifying a script used for vulnerability scan
The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
2
votes
2answers
221 views
Using fail2ban for detecting suspicious activity whitin a webserver
I know that fail2ban is mostly used for blocking IPs trying to brute force an SSH endpoint and other stuff like that.
However, I am wondering if you could also use fail2ban to detect (not necessarily ...
1
vote
1answer
55 views
Unusual Get/Connect requests to Apache [duplicate]
Not sure if that has been asked before but over the last week I am getting hundreds of CONNECT and GET requests to my Apache web server for domains that are not on my server. Some are for well known ...
1
vote
1answer
72 views
Tracking script creates vulnerability
I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
-1
votes
2answers
105 views
How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]
I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
-2
votes
2answers
147 views
Burp Suite's keeps my ip safe?
I am starting to learn how to use Burp Suite, but since it is kind of (tho I know it does more) automatic way of plugging information into a website/form, should I still use proxychain/vpn to keep my ...
0
votes
0answers
222 views
Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?
I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
50
votes
5answers
11k views
What exploit are these user agents trying to use?
I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
1answer
970 views
How to hide webresource.axd and scriptresource.axd file?
I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?
0
votes
0answers
35 views
Apache - Adding Redirect to sub-directory V/S changing DocumentRoot
I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule.
The reason I ask this, I have a website that is installed under /var/...
0
votes
1answer
112 views
Two Factor Authentication Secret Storage
I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites.
In the README there is a section ...
5
votes
1answer
355 views
How can I find a web application's document root using a path traversal vulnerability?
I am performing a penetration testing on an application hosted on an Ubuntu environment.
So using a path traversal vulnerability, I can download any file.
The API web application runs as root (...
-1
votes
1answer
91 views
How to determine where an attack came from? [duplicate]
I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like:
[14/Mar/2019 02:05:36] "GET /...
-2
votes
1answer
93 views
Pure-ftpd connections from unknown IPs
I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine?
Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
-1
votes
1answer
312 views
how to check if remote host is running LDAP server?
I am currently pen-testing a remote website (its mine)
I would like to know if its possible to test if the web-server is running LDAP server.
I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
0answers
38 views
Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?
I'm conducting a penetration test, where I'm facing the following problem:
After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
1
vote
0answers
58 views
How to treat SSN passing through web server
I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
5
votes
1answer
221 views
a mysterious & pointless long-term hacking attempt?
It seems that I am the target of a mysterious ongoing hacking attempt.
I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
1
vote
2answers
211 views
Why are top-level wildcard bindings unsafe?
Microsoft has the following to say about configuring asp.net core with http.sys:
Top-level wildcard bindings (http://*:80/ and http://+:80) should not
be used. Top-level wildcard bindings create ...
1
vote
0answers
60 views
Why is digital signature enforcement on webservers not common practice?
Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
0answers
30 views
How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?
This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
1
vote
5answers
105 views
How to stop a request for an external image from exposing my IP to the server hosting the image?
Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains:
<img src=https://www.domainD.com/testT.jpg>
Then I have a computer C, that accesses W.
Will ...
1
vote
1answer
137 views
Is my server under some kind of reconnaisance/attack?
Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server.
I don't have those ...
1
vote
1answer
108 views
Should I treat my SSH username like a secret?
I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
...
1
vote
1answer
148 views
My website got blacklisted as “phishing”. Any hints on how to avoid that?
I have a personal website hosted using my provider's DNS name (i.e. myname.provider.com) on my personal hardware at home. The web server (both HTTP and HTTPS) is Apache on Debian Wheezy (which is ...
