A system whose primary function is to deliver web pages on request to clients.
1
vote
1answer
12 views
Cross Domain Javascript security
I used a web vulnerability scanner to scan my web site. It indicates several links with "Cross domain Java script source file inclusion."
May I know how would an attacker exploit this type of ...
1
vote
1answer
22 views
How to know an Apache web server mod_cgi module is enabled?
I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
-2
votes
0answers
15 views
How to host email server From Windows server 2012 [on hold]
Hello I want to add unlimited email id with my domain.com and This to be done from my home server which is running on windows server 2012
Is it Possible to run email server from home or give some ...
1
vote
1answer
57 views
What are the traces of a mysql attack on a server when the attacker has full permissions?
I just turned my server off yesterday, after it began to distribute comment spam across the internet, at an astounding rate over 70 "spams"/min, bottom of the line 1/2 gig ram VPS. I'm still trying to ...
1
vote
0answers
18 views
Vega Scanner Took Website offline? [on hold]
I used the Subgraph Vega scanner to scan a website, I wanted to get any linked social media pages from their site. Anyway soon into the scan the page went offline with a 404. I checked with different ...
1
vote
3answers
45 views
Is it good practice to let Node/Go/… act as a frontend webserver?
I'm used to writing web stuff in PHP and let Apache or nginx handle the actual HTTP handling and load my code via whatever means (mod_php, fcgi, fpm, ...). I'm under the impression that this is a ...
28
votes
4answers
3k views
Why am I getting strange HTTP requests for non-existing pages?
I am running a web server and watching what people request. I have been getting frequent traffic like:
GET /phph/php/ph.php HTTP/1.1
or
GET /mrmr/mrm/mr.php HTTP/1.1
Are these scans? Are the ...
1
vote
1answer
30 views
add another layer of protection on top of oauth 2
My Rest API is protected using Oauth2. My main client is a native app.
it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
1
vote
1answer
44 views
Best practice for https Private Key Generation
I am working with a security person that baffles me a bit with the practices he performs. Besides the issue of this person insisting on bypassing every security measure in place we have got into it ...
10
votes
4answers
1k views
What is Net-Worm.PHP.Mongiko trying to do?
I found several lines of this request in my web server access log:
Source IP Dest IP Request Stat User agent
217.172.190.19 ...
2
votes
1answer
63 views
Whitelist for HTTP request
Malicious request can come in the form of user agent string, referrer or cookie. To prevent being pawned by zero day attacks such as Shellshock, I have created a whitelist of characters for user agent ...
3
votes
3answers
87 views
PHP | Security for allowing user uploads
My Sittuation:
I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
-1
votes
0answers
29 views
What are the specifics on non-compliance for a US Financial Institution (CU) that has a website using shared hosting, and apache HTTP authentication [closed]
Take for example, a US Credit Union that has a web site/application with extremely poor security.
The example website is hosted on a large shared host, with hundreds and hundreds of employees from ...
3
votes
1answer
32 views
Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?
If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA.
The use case is that some clients have ...
2
votes
1answer
85 views
Root server hacked via httpd - consequences and future prevention
Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started ...
0
votes
2answers
112 views
Google Analytics: Hacked or Ghost Referers?
I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior.
I've got a web application ...
3
votes
1answer
97 views
Why does my web server receive so many TCP resets from some clients?
I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this:
Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 ...
2
votes
0answers
34 views
Securing elasticsearch behind a reverse proxy
I intend to run an Elasticsearch index to store a persistent copy of data retrieved from an external service. My plan is to host the Elasticsearch index on AWS, and have it listen on 127.0.0.1 only. I ...
1
vote
2answers
31 views
Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?
When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)?
If differences ...
1
vote
1answer
72 views
How do I know if root account has been compromised?
My server was hacked with some files being overwritten to generate spam links on the index page. All my previous backups contain the same modified files, making the nuking from orbit option a puke. If ...
0
votes
1answer
54 views
Web app and database on same server, what is benefit of encrypting database data?
If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way.
I assume that if an attacker can ...
0
votes
0answers
13 views
Problems using HSTS header at top level domain with includeSubdomains [migrated]
Let's say I run a company "Example Inc" and have a website at:
https://www.example.com
Now because I'm security conscience I'm using https and would like to set the HSTS header to force its use. I'd ...
0
votes
0answers
34 views
Is Apache enough to prevent unauthorized access? [migrated]
I've just been assigned to finish the development of an application which has user restricted access. The original developer was a co-op student, as am I.
After looking over his code it seems that ...
0
votes
1answer
50 views
How secure is internal data on the internet with IP authentication?
I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
1
vote
1answer
41 views
Secure (P2P) Client/Company File Sharing
my small web design company currently uses a cloud storage service to collaborate with our clients and I would like an easier (and more secure) way for files to be transferred-in and stored.
The ...
2
votes
2answers
77 views
If I set up a home web server, will computers that use my wi-fi be vulnerable?
I'm interested in setting up a web server on an old laptop L1. My plan is to connect that laptop to an Ethernet port on my router. I also have another laptop L2 accessing the router via wi-fi. L2 ...
2
votes
2answers
173 views
Website infected with unwanted “redirections”, apparently via javascript code
I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
0
votes
2answers
52 views
Unpublished server
Is it possible to setup my web server such that only certain sources can access and the public from internet has no access? i am thinking that we could just not publish our web server URL/IP to our ...
0
votes
3answers
89 views
htaccess - protect php file execution in specific directory
How can I protect php execution in specific upload directory?
Mostly, people put .htaccess in upload folder to protect php execution. But someone says it can be replaced by attackers.
So how can I ...
2
votes
1answer
36 views
Website Implementing https site w/ self signed certs and CA
Q: How best to handle the issue of security warnings for a website using certificates from its own CA (ie, selfsigned)?
I am some what torn on how to do this - I have a number of implementaiton ...
0
votes
1answer
61 views
Have i been phished? [closed]
I recently opened a link from a "friend", while I was on my workplace. It was some really simple stupid game "Super Mario" type. I opened it, played for 10 seconds and closed the link. What felt ...
1
vote
1answer
101 views
Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?
We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test
Specifically we're losing points for the following reasons:
Forward ...
1
vote
1answer
47 views
How safe are networking ACLs based on IP-address?
As far as I know, a determined attacker would have no major issues in hacking the IP address of the packets contained by his (web) request.
Therefore, I cannot see how an Access Control List (such as ...
1
vote
2answers
115 views
Security of php code on webserver - obfuscate?
Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft?
I think my question boils down to 'Is there a ...
0
votes
2answers
77 views
Scan all possible files on server (Brute force Filenames)
I'm not sure if I'm right here, but I just wanted to know if there is a tool that scans all possible filename combinations on a server and tells you what filenames the server responded to. So it would ...
1
vote
2answers
88 views
Path traversal exploit
I have an Apache server which seems to be vulnerable to Path traversal, because when I test This url : http://localhost/ati/../test.txt
it will be changed to the this: http://localhost/test.txt
and ...
0
votes
2answers
58 views
Security risk of using virtual hosts for public and internal sites
I have an Apache server which hosts a public website and an internal website. However, since Apache denotes virtual hosts based on the Host HTTP header, couldn't someone on the Internet request my ...
0
votes
2answers
104 views
Secure android and server calls
I plan on adding an authentication system on my android app using web services.
When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
2
votes
1answer
42 views
Spoofing of Server Sent Events
In the spec for Server Sent Events, it says
Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
1
vote
3answers
155 views
Beyond SQL injections and XSS
I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question.
I did all the major things to secure my website. I ...
-6
votes
2answers
61 views
Large web application security challenges [closed]
What are the biggest challenges of security in web applications?
I want to do a search in the area but I'm not sure what I want to look, I want something that people think it is impossible to serve ...
3
votes
2answers
118 views
Web server interaction with a database server
It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
2
votes
2answers
389 views
How to display friendly notification about no TLS 1.0 support in browser [closed]
A browser that only has SSL 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support.
This typically results in a cryptic (to a normal user) ...
2
votes
1answer
56 views
For PCI compliance, does every request need to be logged regardless of how it affects system performance?
Our cloud based service is currently undergoing changes with a view towards PCI compliance.
It is a high throughput service, and there are concerns that enabling the right amount of logging on our ...
8
votes
3answers
130 views
What are the risks to a network if a single computer is compromised?
If I open up a dedicated server on my home network to accept incoming connections (HTTP, SSH, etc) and that machine is compromised by an outside attacker, what are the risks to other devices on the ...
2
votes
1answer
77 views
Redeploying multiple Secure sites on a single server
This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
1
vote
0answers
35 views
Does standard configuration in Tomcat pose any security risk?
I have a simple test website on Tomcat running on RaspberryPi. Pi is behind a router. Port forwarding is on and I can access the website from the Internet.
What are the security risks of standard out ...
-1
votes
0answers
69 views
firewall zones for private web server
How can I configure the zones of a firewall to provide maximal security for a private web application?
Here is the use case:
1.) Twenty known users will have http/https access to the web
...
0
votes
1answer
56 views
Application-Server connection security
I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
98 views
How can this web server be compromised?
A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html.
An interesting characteristic of ...
