A system whose primary function is to deliver web pages on request to clients.
11
votes
5answers
643 views
PHP files browsable: is this a vulnerability?
I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files).
Do you think this is a security hole ?
...
0
votes
1answer
29 views
Allow loopback in Iptables?
I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary.
...
2
votes
4answers
418 views
How to prevent users from downloading information from our search engine?
We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
0
votes
2answers
129 views
Does the Heartbleed vulnerability affect signed java applets [closed]
I have a Windows based server that serves a signed JAVA applet. The website isn't secured (HTTP), but all JAVA applets have to be signed now, so the site serves a signed JAVA applet as part of a web ...
41
votes
1answer
6k views
What should end-users do about Heartbleed?
What should one do about the Heartbleed OpenSSL exploit? mainly talks about what people running websites should do about Heartbleed.
What should end-users of websites be doing?
Do they need to ...
0
votes
2answers
111 views
Was I a victim of an “Apache PHP Remote Exploit” attack?
I have a server in my computer for testing purposes, accessible from the outside.
I was reviewing the access.log file, and I saw
89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 -
...
3
votes
0answers
63 views
Cascaded Sudo for privilege elevation
I intend to use the least privileged user to do a given task.
The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
1
vote
4answers
79 views
What needs to be focused on when hardening a LAMP stack? [closed]
I have a site running on a VPS. I set up the LAMP stack and a few other programs personally. This is only the second time I have set up a VPS and I am a bit worried about security. Are there things ...
11
votes
4answers
383 views
How to react when under attack
Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
7
votes
3answers
605 views
Does hiding version numbers increase my security? [duplicate]
I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits.
As an ...
-1
votes
1answer
89 views
How bad is to buy domain name with .ext from another country even if they allow non citizens to own one?
I'd like to purchase a domain name from a country that does not require citizenship, since they can make nice urls, they are more available and sometimes not too expensive too!
But few things annoys ...
8
votes
1answer
138 views
How to force “expensive calculation” when clients connect to my server?
Page 183 of Secrets & Lies on countering denial-of-service attacks:
Some researchers have proposed defenses that force the client to
perform an expensive calculation to make a connection. ...
0
votes
1answer
111 views
oracle weblogic vulnerability
I searched for Oracle Web logic vulnerabilities and found this vulnerability:
Oracle WebLogic Server Cross-Site Scripting and Manipulation of Data Vulnerabilities ...
0
votes
4answers
100 views
How to secure my website's FTP?
When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable.
connected to mydomain.com.
220----- Welcome to Pure-FTPd ...
1
vote
0answers
55 views
Checklist for securing JBoss
Is there a security checklist for auditing JBoss configuration files ?
CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
4
votes
2answers
152 views
Retention periods for web logs
I work for an ASP that provides banking solutions
Card
Services
Payments
ACH
Online Banking
And others
Back Story: Our company provides an "all in one" solution or parts thereof, we are ...
0
votes
1answer
46 views
Virtual private server security [closed]
I want to move from a shared hosting to VPS. I never used VPS or dedicated server, so I wanted to know if there are some security precautions that I should have in mind. Say, I create a ftp account ...
4
votes
3answers
51 views
Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?
Will sabotaging a shared web hosting account threaten the security of sibling accounts being that they are shared on the same server?
Whether it it be through htaccess setups, posting login ...
3
votes
4answers
101 views
What things should I check for when giving a client control of the filename parameter to C's open() function?
I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
1
vote
2answers
50 views
Preventing interaction among web application on a shared hosting account
I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too.
So, My ...
0
votes
1answer
41 views
Security implications of putting virtual hosts source code in /var/www/[domain]
A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS)
I see that it's possible to reach the virtual hosts ...
0
votes
2answers
92 views
Directory traversal & default filesystem permissions (755) for web server
I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
0
votes
2answers
62 views
Is it possible to sabotage google bots? [closed]
Consider the following theoretical webserver:
On any request, produce an html response that consists of 2 links,
which are each randomly chosen strings followed by ".html".
When the google bot ...
5
votes
3answers
505 views
First steps in preventing DOS attacks
My server is currently being attacked from another server. This is my log:
root@my-server:/var/log# tail -f auth.log
Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
0
votes
0answers
23 views
Why is it not advisable to have the database and web server on the same machine? [duplicate]
I'm bringing this across from a question on stackoverflow, but I'd like to focus specifically on the security aspects of it (and not the performance, etc..).
My hypothesis is that the cost of ...
14
votes
3answers
1k views
“Optimal” Web Server SSL Cipher Suite Configuration
Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4)
My ...
0
votes
1answer
155 views
Can closing port 80 lead to more security?
If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
0
votes
1answer
39 views
How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?
was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
1
vote
3answers
62 views
Why pull upgrade from production server rather pushing them from development server?
I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
1answer
559 views
Authenticating Users from Android with PHP Webservice
Im creating a simple Android Application,which requires reading and writing values to the cloud.I intent to use PHP for the webservice.
But im little confused over the authentication scheme.I intent ...
1
vote
1answer
103 views
Is authentication through proxy sites safer?
usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
2
votes
2answers
78 views
Does reverse proxy between two web servers impact security of both?
Situation:
Consider the site: example.com, hosted at web server A.
A WordPress blog is to be installed on a different web server, B.
In order to route a WordPress installation to a subdirectory on ...
4
votes
1answer
63 views
Dangerous to open a unix socket within www root?
My web server is chrooted into /var/www, and its contents are available over the network.
One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
1
vote
2answers
130 views
PCI DSS - only one primary function per server
The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function'
we have a webserver with database - web pages and email
is ...
0
votes
1answer
58 views
Different certificate information for the same website?
Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
0
votes
1answer
67 views
Possible ways of exploiting PHP register_globals [closed]
I have a PHP script that executes a bunch of commands to verify that a user is logged.
if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
1
vote
0answers
30 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
2
votes
1answer
167 views
How to run a tor hidden service from home securely?
Another theoretical question about Tor: Imagine I am running a dissident web site as a hidden service. How can I reduce the chances that I get caught?
Assume I am running the server from home, over a ...
1
vote
1answer
68 views
What features boost security for a home edge router?
I want to hide my home network behind a router and not worry about firewalls on internet-facing devices. Furthermore, one PC is going to be hosting some services, so I guess I need port forwarding as ...
1
vote
1answer
66 views
What is LFI vulnerability
LFI: Local file inclusion.
After going through many tutorials I have two things I can/t figure out:
checking the vulnerability: I don't understand what makes a website vulnerable or not. For ...
1
vote
1answer
154 views
How to deny shell execution in all sub-directories?
I want nginx to deny users who have folders inside /webroot/uploads
e.g.
/webroot/uploads/user1
/webroot/uploads/user2
/webroot/uploads/user999
to execute any shell (php, pl, py, binary).
The ...
4
votes
1answer
397 views
Why does Directory traversal attack %C0%AF work?
Introduction: I am trying to learn the basics of Directory Traversal.
Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
2
votes
2answers
537 views
What is the ultimate goal of hacking a webserver? [closed]
Recently I noticed a lot of traffic generated by automated bots that were checking for vulnerabilities in my web server. They were mainly looking for ways to hack into plesk/wordpress which I don't ...
3
votes
2answers
941 views
Identify and disable weak cipher suites
i'm asking a question on a subject that is pure chinese to me..sorry in advance
A security scan result prior to the deployment of a web application on windows server 2008 R2 has raised the below ...
1
vote
3answers
215 views
How to detect anomalous activity in web server traffic?
I'm wondering how to successfully detect malicious activity in my web server traffic?
Could you point me out some popular solutions which can help me to detect attacks on my web application?
I ...
0
votes
1answer
55 views
What security exposure (if any) can result from lots of apparently odd referrers in server log
I see relatively many referrers such as the following (as reported by Webalizer) in a web server log. The server is located outside Russia and it's a small one.
8 3 http://tiandeural.ru/
19 ...
1
vote
1answer
65 views
How to Minimize Apache Loadable Modules (serving MediaWiki)
According to Guide to the Secure Configuration of Red Hat Enterprise Linux 6, there is this policy:
"In certain scenarios, it is beneficial to remove certain httpd modules to limit the functionality ...
19
votes
2answers
1k views
Do Simple Linux Servers Really Need a Non-Root User For Security Reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
4
votes
1answer
122 views
Increased HEAD traffic to my website
In the last few weeks I have been getting an increased HEAD traffic to my website of the form
HEAD / HTTP/1.0" 200 0 "-" "-"
This just returns the details of my web server, right?
The IPs are from ...
3
votes
2answers
235 views
Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?
Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?
