Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

0
votes
0answers
44 views

What hardware can I put in my network to prevent DoS attacks occurring through a private VPN? [closed]

Suppose I allow a friend to remotely connect to my web server through VPN. However, a DoS attack is occurring on my web server. My friend told me he is not the one doing the DoS attack. What can I add ...
-1
votes
1answer
58 views

Using DIRB to find directories behind authentication [on hold]

I came across DIRB which is used to find directories or files on the server. I have a website which has a login and every page will redirect to login page before you sign in. How do I run dirb on ...
0
votes
1answer
48 views

Do HIPAA compliant web server and database need to be on the same server?

I work for a small IT firm and we are creating a web application (MVP) for doctors (in the USA). The patients will register with the application. We will only save their name, email, password (hashed)...
2
votes
2answers
90 views

Using fail2ban for detecting suspicious activity whitin a webserver

I know that fail2ban is mostly used for blocking IPs trying to brute force an SSH endpoint and other stuff like that. However, I am wondering if you could also use fail2ban to detect (not necessarily ...
1
vote
0answers
30 views

Unusual Get/Connect requests to Apache

Not sure if that has been asked before but over the last week I am getting hundreds of CONNECT and GET requests to my Apache web server for domains that are not on my server. Some are for well known ...
-1
votes
0answers
47 views

How to store keys in a web app which I want to be able to edit via a web page?

In my web app I use various payment providers. I want to be able to edit sensitive data related of them, such as API keys, via a web page. Therefore, to be able to do this, I have to store that data ...
0
votes
0answers
39 views

How can a Web Server be fingerprinted? [duplicate]

How can a Web Server such as nginx or Apache be fingerprinted, if only functional HTTP Headers are sent and error pages are replaced by custom ones?
1
vote
1answer
42 views

Tracking script creates vulnerability

I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
-1
votes
2answers
102 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
-2
votes
2answers
86 views

Burp Suite's keeps my ip safe?

I am starting to learn how to use Burp Suite, but since it is kind of (tho I know it does more) automatic way of plugging information into a website/form, should I still use proxychain/vpn to keep my ...
0
votes
0answers
66 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
49
votes
5answers
11k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
1answer
114 views

How to hide webresource.axd and scriptresource.axd file?

I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?
0
votes
0answers
31 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
0
votes
1answer
76 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
5
votes
1answer
214 views

How can I find a web application's document root using a path traversal vulnerability?

I am performing a penetration testing on an application hosted on an Ubuntu environment. So using a path traversal vulnerability, I can download any file. The API web application runs as root (...
-1
votes
1answer
85 views

How to determine where an attack came from? [duplicate]

I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like: [14/Mar/2019 02:05:36] "GET /...
-2
votes
1answer
50 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
-1
votes
1answer
96 views

how to check if remote host is running LDAP server?

I am currently pen-testing a remote website (its mine) I would like to know if its possible to test if the web-server is running LDAP server. I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
0answers
38 views

Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?

I'm conducting a penetration test, where I'm facing the following problem: After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
1
vote
0answers
45 views

How to treat SSN passing through web server

I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
5
votes
1answer
210 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
1
vote
2answers
134 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
1
vote
0answers
59 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
0answers
28 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
0answers
68 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
5answers
99 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
0
votes
0answers
78 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
1
vote
1answer
90 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
2
votes
1answer
140 views

My website got blacklisted as “phishing”. Any hints on how to avoid that?

I have a personal website hosted using my provider's DNS name (i.e. myname.provider.com) on my personal hardware at home. The web server (both HTTP and HTTPS) is Apache on Debian Wheezy (which is ...
0
votes
0answers
60 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...
0
votes
1answer
35 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
2
votes
1answer
101 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
0
votes
1answer
127 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
2
votes
3answers
3k views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
1
vote
2answers
54 views

Is an open source web application server publishing it's version at a public endpoint a security issue? [duplicate]

If an open source web application is publishing the version via a public, non-access controlled API/Header, is it considered a security issue? The premise of the question is that, if a particular ...
0
votes
1answer
28 views

Best practice for config files for ec2 instances

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have ...
1
vote
1answer
52 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
39 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
0
votes
2answers
183 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
3
votes
3answers
223 views

A protocol for encrypting the data on the server, but with a password on a mobile device

I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
2
votes
2answers
145 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
0
votes
1answer
73 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
1
vote
2answers
93 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
1
vote
1answer
26 views

What are the drawbacks to automatically deleting web server access logs?

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days? I'd like to limit how long I store personally-identifiable data (IP ...
1
vote
1answer
83 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
2
votes
1answer
332 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
44
votes
8answers
12k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
-1
votes
1answer
38 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
3
votes
1answer
204 views

Is it safe to open ports 80 and 443 in a home network

The intention behind this is that I'll be able to host a website from a home server (another pc with ECC ram etc.), but what worries me is that the network I'm using is also the same network which I ...