Questions tagged [webserver]
A system whose primary function is to deliver web pages on request to clients.
935
questions
0
votes
1
answer
23
views
Parse a File on Client and Send to Server Without Client Manipulating Data
I have a desktop app that takes a file format and parses it to get some JSON data that is then send to a server.
My problem is figuring out if it is possible to somehow parse the data on the client ...
- 1
0
votes
1
answer
22
views
Server Side Template Injection (SSTI): Difference between plaintext context and code context?
I am learning pentesting, currently studying Server Side Template Injection. I understood there are two types of SSTI - plaintext context and code context - but struggle to understand what exactly is ...
- 125
0
votes
0
answers
40
views
Do I need https for a web server that will be used locally? [duplicate]
I have a web server that will be used to manage the stock of a warehouse in a factory. The web server will be accessed only locally so the clients can update and view the available stock. The server ...
- 1
0
votes
0
answers
25
views
How to configure server for client certificate authentication? [migrated]
I have seen some service providers that use certificates for client authentication, so that any browser without the certificate will be rejected. However, the browsers with trusted certificates could ...
- 113
3
votes
1
answer
99
views
Is there a reason for a server-side limit on the number of HTTP headers allowed for each request?
The security team at my company has set a limit on the number of headers a HTTP request can contain (not header size, but an actual hard count limit on the number of headers).
A vendor has added a few ...
- 133
1
vote
1
answer
128
views
What is <title>(.*?)<\/title> and how the attacker use that?
I had a log from my web server like this
[28/Aug/2022:12:57:02] "GET / HTTP/1.0" 200 1684 "" "<title>(.*?)<\/title>"
What is this meaning and what exactly ...
- 115
0
votes
1
answer
36
views
Is HTTP Request Smuggling domain/subdomain wide or directory wide?
I have a pretty good understanding of HTTP Request Smuggling vulnerabilities but one thing I still need some clarification on is if they are domain/subdomain wide or directory wide?
Here's what I mean:...
- 50
0
votes
1
answer
91
views
Site "can't" change username, why? [closed]
There's a website I have an account on, and I needed to change my username. They said they were unable to change that. I requested to just have my account deleted, and then I would create a new ...
- 1
1
vote
0
answers
44
views
Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?
I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
- 11
0
votes
1
answer
50
views
What is the effect of the "&x=" in a SSRF? Is it something related to encoding?
I'm learning SSRF. I learnt that typing "&x=" kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9)
Everything that comes after the ...
- 3
0
votes
1
answer
57
views
What is the intent behind these unknown HTTP Requests into my AWS Web Server?
I know about the usual port sniffers and mass scanners that just pop up on any web server, but this one looks interesting to me.
I figured out so far that those requests aren't really an issue for my ...
- 267
0
votes
1
answer
57
views
Can attacker gain access to my private network application through pivoting and/or lateral movement?
I am using a public wifi network.
When I start a nodejs express server at my local system at port 3000, I can access that website on another device (that is connected to the same public wifi network) ...
- 15
0
votes
1
answer
28
views
Do I need to set up super global SESSION for a web form?
I am building a web form in PHP, is just for the user to request information about my services or send comments, so I don‘t need the user to be logged with a username and a password, no databse. I ...
- 1
0
votes
0
answers
48
views
How to find a potential JSON Java deserialization code vulnerability with a whitebox approach in web server source code?
I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following ...
- 1
0
votes
1
answer
91
views
Why is Nessus report HTTP running a web server on port 80 when I'm sure that it isn't?
From a Nessus scan I have the following output regarding HTTP and the use of port 80:
Info N/A 43111 HTTP Methods Allowed (per directory)
Info N/A 24260 HyperText ...
- 23
1
vote
1
answer
91
views
Is it safe for website to generate fake profile pages?
Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a ...
- 11
0
votes
1
answer
122
views
Do WSGI servers connect to devices outside of the network?
I want to set up a plotly dashboard and view it from my browser.
Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
- 101
0
votes
1
answer
29
views
Recommended secure option for uploading files to web server from a dynamic IP?
I need the best way to access a webserver to upload/modify a PHP script. The website contains very sensitive information, gaining unauthorized access to this server and modifying files would lead to ...
- 111
0
votes
1
answer
197
views
Url only works from the browser it is generated from. Copying it into a Curl Command fails, and gives a 403 error. How can I fix this?
I am doing some web scraping for streaming files, .m3u8 mime type. In this particular instance, I can't create a functional request that does not end up with a 403 Forbidden error.
How to reproduce:
...
0
votes
1
answer
33
views
Multiple random requests for Non-Existent URLs from a single IP resulting in 404s
We sometimes get to see this behavior from a single IP address/logged in user -
There are a lot of hits on our server that have .png at the end of the URL which results in a 404 because we don't have ...
- 1
0
votes
0
answers
13
views
How to detect web account vulnerability [duplicate]
I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login.
...
- 101
1
vote
2
answers
71
views
Securely storing password and encryption key on AWS
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
- 121
4
votes
3
answers
862
views
Do we need to check for cross-origin on server side?
Modern browsers don't allow cross-origin requests - those must be explicitly allowed by CORS headers. But looking at Java back ends like Tomcat/Spring MVC I see that it's possible to reject requests ...
0
votes
3
answers
170
views
successfull log4j exploitation, or just normal traffic?
First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :)
I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
- 1
0
votes
0
answers
188
views
What should I do after an attempted Mozi attack?
I was testing a small webpage using Django's built-in server. The webpage simply shows the IP of the visitor of the webpage, and prints the IP address in the terminal. The server is hosted on a Ubuntu ...
- 101
0
votes
1
answer
87
views
How can 2FA help prevent formjacking?
This article by Avira (part of NortonLifeLock) claims that 2FA (2-Factor Authentication) may be sufficient to protect against formjacking:
Enable 2-Factor Authentication: Create strong and complex ...
0
votes
0
answers
115
views
Is it possible to hide a servers location on the internet?
Can you make a server appear to be in another country and how would you do it?
- 1
3
votes
3
answers
396
views
Someone found an obfuscated path on my website. Is this possible without hacking my site?
I am running a server with Django and Nginx. I tried to hide the admin panel by assigning it a 50digit random string as URL (something like https://mydomain/asidfhifuerbdsi...). Now someone found this ...
- 131
2
votes
0
answers
66
views
What does this potentially malicious php code do? [duplicate]
Somebody hacked my webserver and uploaded many of the following files with random names in different subdirectories of my webroot. The file looks something like this and - even though I managed to ...
- 121
1
vote
1
answer
130
views
Does it make sense to configure the web server to deny obviously malicious requests?
I have a Ruby on Rails app behind Nginx. Every once in a while I see requests like GET /phpmyadmin or GET /wp-login.php. Since I don't have those tools installed, it's obvious that those are from ...
- 113
1
vote
2
answers
148
views
Is there way to know what headers can be accepted by HTTP server?
Imagine that there is server required authentication for getting an access to some endpoint.
And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
- 13
0
votes
1
answer
158
views
Restrict web access with whitelists
Can I secure a website using a simple whitelist system?
My idea is to port forward a website www.example.com on my pc.
To secure it, I want to add a whitelist system. It will work like this:
When the ...
- 1
0
votes
1
answer
88
views
How strict should I be in rejecting unexpected HTTP request parameters redux?
I read this: How strict should I be in rejecting unexpected query parameters?
Answer: No, do not error out on unexpected query string parameters.
But I just got a requirement from our security guy ...
- 5,617
1
vote
1
answer
142
views
What is the most up-to-date secure method for storing .ENV variables?
I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this ...
- 11
1
vote
1
answer
569
views
Changing $_SERVER['REMOTE_ADDR'] remotely
On a nginx web-server running the following config is to possible to change $_SERVER['REMOTE_ADDR'] remotely?:
user www;
pid /run/nginx.pid;
error_log /dev/stderr info;
events {
...
- 45
1
vote
1
answer
115
views
Is this HSTS HTTP Response Header Misconfigured?
I recently discovered during a penetration test that the HSTS was returned by the application but in this format:
"Strict-TransportSecurity"
Instead of:
"Strict-Transport-Security"
...
0
votes
0
answers
31
views
How to recover a hacked site with WSO Shell [duplicate]
Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded.
Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed.
...
- 1
0
votes
1
answer
161
views
How reverse proxy works?
I know that forward proxy can enhance security by replacing client IP's address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who's requesting a ...
0
votes
1
answer
125
views
Unclear attack(?) on web server: GET requests for tar files
I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and ...
- 103
0
votes
0
answers
83
views
Confidentially seperating web content under single IP address
I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..).
This content I wish to reside on the same web server under which personal web content resides.
(None of this ...
- 1
0
votes
0
answers
91
views
Backendly preventing database injections on simple web forms [duplicate]
I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
0
votes
0
answers
16
views
What does this obfuscated PHP script do? [duplicate]
I found an obfuscated PHP-script in a log directory on a shared hosting, which had been given chmod 0777 by mistake.
The script in it's original form looks like this:
$zowyb = 'i#7uH0_ls5y4m*bcrovaptf-...
- 213
1
vote
1
answer
175
views
Blocking reflected XSS on common web servers
How is it possible to block reflected XSS on common web servers, such as IIS, Apache HTTP Server and Nginx?
The Content-Security-Policy: reflected-xss filter doesn't work on latest Chrome and X-XSS-...
- 33
1
vote
1
answer
113
views
Best methods to mitigate DDOS with changing IP sources
Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
- 149
1
vote
1
answer
170
views
Can I use my HTTP/SSL certificate for mysql?
I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate.
My ...
0
votes
1
answer
137
views
What exploit is trying to be leveraged here? (Apache access.log)
I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al.
I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
- 1
0
votes
1
answer
559
views
How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]
Are there any ways to serve a webpage locally without revealing IP to end users?
2
votes
1
answer
256
views
Docker container exposed port vulnerabilities on Debian server?
I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
- 23
1
vote
1
answer
112
views
Private keys with or without password for webservices?
What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc.
If I create private keys without password they will be 100% compromised if one ...
- 61
0
votes
1
answer
149
views
why the website cant understand my request in http smuggling?
hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website.
i send
GET / HTTP/1.1
Transfer-Encoding: chunked
Host: subdomain.domain.com
User-Agent: Mozilla/...
- 73