Questions tagged [webserver]
A system whose primary function is to deliver web pages on request to clients.
137
questions
6
votes
2
answers
4k
views
How does IP tracking work?
Excuse the naive question (I'm more of a dev than a web-sec person)
In the past I've had webservers hacked and usually i've traced it to some random machines which seem to have been compromised (i ...
- 305
4
votes
3
answers
3k
views
Google App Engine Security
I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is.
Does anyone know if there was ...
- 365
4
votes
1
answer
6k
views
Can closing port 80 lead to more security?
If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
- 147
4
votes
1
answer
2k
views
VPS Safety in the Cloud
Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
- 39.3k
3
votes
2
answers
5k
views
Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?
Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
- 2,968
3
votes
4
answers
5k
views
Determining the point of compromise on an infected web server?
Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
- 31
2
votes
1
answer
215
views
Server Detection Vectors
I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks).
My ideas:
change server header
customize 404 ...
- 163
2
votes
2
answers
776
views
Odd url showing up in my pubsub stream, should I be concerned?
Background: Yesterday I started working on a simple metrics dashboard. I have a VBScript on my internal network that queries a database over a VPN from our Vendor. I then do a simple HTTP post to a ...
user76064
2
votes
1
answer
3k
views
folder and file permission shared host advice
I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
- 257
1
vote
3
answers
698
views
Is this approach of securing cookie secure?
I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt)
Steps:
User logs in
Save user IP + randomstring in ...
- 195
0
votes
3
answers
668
views
Can my customer's ISP trace who visited my business website?
I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
59
votes
2
answers
56k
views
What are the main advantages of using LibreSSL versus OpenSSL
What are the main advantages of using LibreSSL vs OpenSSL?
As I understood LibreSSL is a fork of OpenSSL:
LibreSSL is a version of the TLS/crypto stack forked from OpenSSL in 2014, with goals of ...
- 893
51
votes
4
answers
13k
views
Do simple Linux servers really need a non-root user for security reasons?
Playing devil's advocate,
Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
user31679
45
votes
3
answers
7k
views
How do hosting providers prevent the compromise of one website from causing the compromise of another one?
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
39
votes
4
answers
53k
views
What website accepts only TLS 1.2 so I can verify client capability?
Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it?
Background:
I have an old VB....
- 659
30
votes
5
answers
9k
views
How do attackers find the IP addresses of recently deployed servers?
About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
- 441
28
votes
3
answers
9k
views
Is it practical to pre-blacklist certain GeoIP regions?
In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server.
The firewall has been set up properly to only allow connections through the ...
- 2,388
21
votes
4
answers
2k
views
If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?
We had an incident where some of our managers were given passwords for the people they supervise using a particular company website. Ostensibly it was done so the managers could check in on the users ...
- 393
18
votes
5
answers
6k
views
Hashcash, is this really used?
I just heard about this term, is it really used? The concept does not seem new, is it used and/or implemented in current technologies?
- 331
17
votes
5
answers
887
views
What are the most important security checks for new web applications?
I'm wondering what are the top priority security checks you should make befor launching a new webapp?
I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
- 2,423
16
votes
5
answers
4k
views
Are consumer-grade routers any more or less vulnerable? [closed]
I apologize if this is an obvious question, I'm not very familiar with hardware.
I am planning on hosting a few personal websites from my home, but I'm concerned about my security. I'm using a fairly ...
- 787
15
votes
5
answers
22k
views
Benefits of identifying clients based upon the "X-Forwarded-For" or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
- 50.9k
13
votes
3
answers
6k
views
Is "mini-httpd" a secure web server?
I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd?
Being a lesser known web server means that it's less likely ...
- 241
12
votes
4
answers
9k
views
Any way to browse OSVDB?
I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
- 301
11
votes
3
answers
2k
views
What security measures should be taken when running a Linux web server out of our office?
I am interested in running our company's web server from our local office. The office makes use of file sharing and NAS devices among other common office protocols. The worst case scenarios I've ...
- 211
10
votes
2
answers
6k
views
Are there any statistics about webservers and browsers TLS support?
From Hackers break SSL encryption used by millions of sites:
The vulnerability resides in versions 1.0 and earlier of TLS, or transport layer security, the successor to the secure sockets layer ...
- 6,279
10
votes
2
answers
3k
views
CloudFlare benefits or drawbacks
Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...
slatecaster
10
votes
3
answers
2k
views
Does hiding version numbers increase my security? [duplicate]
I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits.
As an ...
- 381
10
votes
3
answers
827
views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
9
votes
2
answers
585
views
Can other customers on shared hosting see requests from/to my site?
I installed a wiki on my shared webhosting (using Apache) account. This wiki is set to private (no read/edit/create rights for unauthorized users) and I'm the only one with an account.
The wiki ...
- 1,779
9
votes
2
answers
2k
views
Are there any sequences other than ../ which will be intepreted as directory traversal in *nix or Windows?
A common vulnerability is for web applications to accept a filesystem path as a request parameter, and then perform some action on the specified path. For example, retrieving a file and returning it ...
- 1,289
9
votes
1
answer
2k
views
Regenerating dhparam periodically
Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week?
What issues may arise from this?
Is there any benefit in doing ...
- 225
9
votes
5
answers
1k
views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
- 50.9k
8
votes
1
answer
11k
views
Server attack attempts, what are they trying to achieve?
Recently, I have got a few 404 errors where the user has requested PHP pages.
The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
- 325
8
votes
4
answers
27k
views
How to identify the HTTP methods supported by a web server?
How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.?
I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
- 2,047
8
votes
4
answers
2k
views
DNS spoofing of linux distribution repositories
Question(s)
Is it possible to "redirect" linux-update-repos via DNS spoofing (e.g. DNS cache poisoning) to a malicious website, so that harmful software (updates) will be installed, when ...
- 819
8
votes
5
answers
10k
views
Is it trivial to bypass IP blocking?
There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked.
I've heard about IP spoofing and similar attacks. ...
- 5,397
8
votes
4
answers
8k
views
How widely deployed is TLS with cipher ECDHE?
Microsoft deployed a patch for Windows 2012 R2 and Windows 8.1 that adds the following ciphers.
Cipher suite Exchange Encryption Hash
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DH ...
- 50.9k
8
votes
2
answers
9k
views
How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use
To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use.
-...
Andy
8
votes
3
answers
419
views
Does concealing server software versions have a notable effect on security?
Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
- 2,241
7
votes
2
answers
737
views
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
Is it possible for a vulnerability in one application to be exploited to attack another application on the same server?
So according to the answer to the question above it is possible that when one ...
7
votes
3
answers
5k
views
What's involved in taking over someone else's domain name?
I'm asking this for purely academic reasons.
I know that there are domain record lists and whatnot, but I'm trying to understand the exact structure of how DNS works and where someone can potentially ...
- 1,861
7
votes
2
answers
9k
views
How to display friendly notification about no TLS 1.0 support in browser [closed]
A browser that only has TLS 1.0 support won't be able to establish an HTTPS session with a server that has only TLS 1.1 and TLS 1.2 support.
This typically results in a cryptic (to a normal user) ...
- 211
7
votes
2
answers
5k
views
How helpful is rkhunter?
I have a software firewall implemented on my server, and I have closed all unnecessary ports. I have strong passwords, and I validate user input on my website.
With these things already in place, do ...
- 333
6
votes
2
answers
2k
views
Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP
I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers.
Most questions I see here about man-...
- 105
5
votes
3
answers
3k
views
Reverse Proxy Secure Configuration
I have a Forefront TMG 2010 acting as a reverse proxy:
I can force HTTP*S* between internet clients and TMG.
I can force HTTP*S* between TMG and my web servers.
From a security point of view, it is ...
- 1,988
5
votes
3
answers
19k
views
I want to host a server from my home computer; safe?
I am planning to make public a website I have been working on; it seems to me that the only way I can do this without needing to pay any extra money to external hosts etc. is by hosting the server ...
- 207
5
votes
2
answers
384
views
Configuring election website to prevent MITM attacks
Consider an election web site that will be used for voting over the Internet.
What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
- 99.6k
4
votes
4
answers
2k
views
Finding web application on webserver having only IP
I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100.
My approach was to check the existence of web ...
- 1,323
4
votes
2
answers
6k
views
How to check if a website is sending out a virus?
I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website.
3 out of 6 people in the office have gotten ...
- 167