A system whose primary function is to deliver web pages on request to clients.

learn more… | top users | synonyms

2
votes
1answer
305 views

How does Windows/IIS keep a certificate protected or should I never run Apache Webserver on a Windows server?

If I follow the reasoning of a colleague it seems you should never run Apache Webserver or Tomcat on a Windows server if you want to keep the https certificate safe. Let me explain before this ...
7
votes
1answer
146 views

Why Apache runs as unprivileged user?

Apache Web server as a security measure relinquishes its system privileges and runs as a normal unprivileged user before accepting clients over a networks. My Question is How this measure prevents ...
1
vote
2answers
178 views

How to Check if my mail is classified as Spam

I think several of mails are classified as spam.But Gmail and other Public Email providers has no issues. It might be a false positive cases with the associated tools Is there a tool or a way by ...
1
vote
1answer
83 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
-1
votes
1answer
96 views

Would PGP/GPG have been a better choice than SSL for browsers and http servers to encrypt traffic? [closed]

I was curious recently when I heard that SSL had supposedly been broken by a certain rogue government agency, why SSL was chosen in the first place. Could it be that PGP would have been a more secure ...
0
votes
3answers
358 views

Can my customer's ISP trace who visited my business website?

I own a private business and a web site with a domain name hosted with Godaddy US. I live in Europe. I want to know if the various ISP of my customers in my country can find out who visited my web ...
0
votes
1answer
714 views

What methods are there of protecting a VPS from DDOS attacks? [duplicate]

I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
2
votes
1answer
1k views

Explanation of open ports

I've run metasploit against my web-server and it found several opened ports that I didn't know. Please note that I have a firewall and IPSec configured but they were disabled just for testing ...
1
vote
2answers
140 views

PCI Compliance Distibution

I run a small e-commerce website hosted on a dedicated server with Debian 6 Squeeze. I need to become PCI compliant (the card industry standard for security). Therefore I have registered with ...
1
vote
1answer
261 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
2
votes
3answers
142 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
2
votes
2answers
352 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
0
votes
1answer
174 views

Can query string command line exploits in older CGI implementations of PHP be protected against without updating PHP versions?

We recently received this from a security audit: PHP is a general purpose scripting language that can be embedded into HTML. A vulnerability exists in PHP versions prior to 5.3.12 and 5.4.2 due to ...
0
votes
1answer
93 views

How to investigate this anomaly?

According to the IT managers, this problem is neither at the server nor at the client but is suspected to be somewhere inbetween e.g. some DNS server that has been infected. Do you recognize this ...
20
votes
3answers
1k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
5
votes
1answer
5k views

Server attack attempts, what are they trying to achieve?

Recently, I have got a few 404 errors where the user has requested PHP pages. The URLs are range around the cgi-bin and php versions, eg, /cgi-bin/php4. There is also some query string as part of ...
0
votes
1answer
61 views

How reliable is virtual hosting?

Web servers such as Apache and nginx support virtual hosting. To the users of websites on a shared server, they will not know that another websites exists on the same server. I have been wondering for ...
-1
votes
1answer
112 views

Location of server affects the speed of page loading? [closed]

i live in a country but i make a website for another country's users. The web hosting company has server in both of the countries. So where should i buy? Does it affects where the server is depending ...
3
votes
1answer
225 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
2
votes
1answer
337 views

Expose web service in a secure manner

Requirement I have a web service I need to expose on the DMZ for external communication. The web service communicates directly with a critical database that sits on an internal net. Current ...
0
votes
1answer
79 views

How to track MAC policy violations back to HTTP request?

Suppose there is a web application under public load that runs under a very restrictive MAC (e.g., SELinux, TOMOYO, Grsecurity) policy. Suppose we detect and log a MAC policy violation like a file ...
2
votes
1answer
552 views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
-1
votes
1answer
98 views

Free Alternatives in Web-Application Mapping Software [closed]

Im new to hacking, i have reached a chapter in my book "the web applications hackers handbook" where im about to start bypassing client-side and actually attacking different technologies well before ...
2
votes
2answers
485 views

What is the most secure way to set up web server user permissions?

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
1
vote
1answer
594 views

Skype chat history and web browsing history CHECK

In an office work place, can a network admin have access to my Skype chat history and web browsing history without logging in to my pc since all pc's are connected with the same network? i am ...
0
votes
2answers
289 views

Is it illegal to use Fake User-agents? [closed]

Is it illegal to impersonate user-agents when you are crawling a website? If so, what and how a legal action can be taken against the faking requester? Is this law applies only for crawlers or a user ...
0
votes
1answer
93 views

SSL Auth to proxy using Certificate on Client-side

The question may need to be reworded. The server-side is set up with Squid3 acting as an Authenticating proxy by way of LDAP. I did this for testing purposes to make sure everything was working. I ...
1
vote
1answer
137 views

Security Standards for storing private customer data

A certain government regulation in my country mandates all non-resident donors to provide a copy of their identification (usually, the passport). So, we ask the donors to upload a copy of their ...
0
votes
1answer
174 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
2
votes
1answer
211 views

Where's the virus in this web site?

I made my friend go to this web site and it immediately infected his machine with malware (AntiVirus SecurityPro). It happened just by going to the front page. It seemed the malware started up, but ...
3
votes
3answers
649 views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. Exactly what kind of risk is there in doing so? From what I understand, the setup will not allow ...
2
votes
1answer
543 views

How to find the pharmacy hack in a Joomla website?

We've discovered today that our Joomla website has been hacked by a pharmacy trojan. It was difficult to discover because most users don't see it when visiting our website. One user reported about 2 ...
2
votes
1answer
71 views

Server Detection Vectors

I have a web server, and I would like to anonymise it as much as possible, to prevent unreported exploits directed at my web server (original cracks). My ideas: change server header customize 404 ...
0
votes
1answer
79 views

Is there any reason to allow Python fetches of my Web server's pages?

I keep seeing "python-requests/1.1.0 CPython/2.7.4 Linux/3.8.0-19-generic" requests e.g. from Amazon's servers of my website. It's kind of creepy. Who would set up an Amazon server to scan websites? ...
0
votes
2answers
89 views

SVG-Snippets in Access-Log: Probe or Error?

I get some hits every then and there from different IPs, always the same scheme: GET /blah/Resources/Public/Css/data:image/svg+xml;base64,... HTTP/1.1" 404 795 "http://some.referer/" "Mozilla/4.0 ...
0
votes
1answer
111 views

Protecting Website Static Resources

If I have a website that is only accessible by authenticating at a login page, is it possible for a non-authenticated person to get access to static assets (images, css, javascript, ...)? I imagine ...
0
votes
2answers
99 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
10
votes
3answers
13k views

Strange requests to web server

I have a Linode VPS running Nginx, which currently serves only static content. Once I was looking at the log and noticed some strange requests: XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET ...
0
votes
3answers
844 views

Security checklist for hosting a website on dedicated server - Linux [closed]

I have been searching for a while now. But i can't find a start-up and advanced sought-of checklist to understand the most important things to consider while going for dedicated hosting server for a ...
3
votes
1answer
114 views

Is using a WebServer as a proxy a secure solution

There are 2 machines - both running Windows Server. Machine1 can access the internet. Machine2 cannot access the internet, but can access Machine1. Machine2 needs to continuously access one external ...
-3
votes
2answers
202 views

How can i secure my web server [closed]

i want to secure my web-server from hackers. what are the ways for secure my web server? . I need tight security. without admin permission no one can not access or hack my web-server
0
votes
2answers
190 views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
2
votes
1answer
183 views

Possible to detect and log CORS and preflight requests in IIS?

I'd like to track and understand if CORS/cross site requests are hitting my website, and if they are succeeding or failing. My goal is to understand if clients are following our documentation ...
1
vote
1answer
325 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
2answers
1k views

Checking if TLS 1.1 and 1.2 implementation in a webserver is upto standards

I am testing a webserver[proprietary] which offers SSL support and they say it supports TLS 1.1 and 1.2 which i have verified by firing requests from IE with only the target protocol enabled . ...
8
votes
11answers
2k views

Besides IP addresses, how else could one be identified? [closed]

OP: I'm curious how else an actor seeking to identify someone online could accomplish this task besides just using an IP address. What methods would they employ? What knowledge must they have of the ...
0
votes
1answer
194 views

Response to script-kiddies “scanning” website for vulnerabilities? [duplicate]

I have a website and I have email reports when 500 errors occur. Many of these errors occur because "hackers" are running scripts to look for common vulnerabilities or access to admin interfaces - ...
5
votes
2answers
200 views

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks ...
0
votes
1answer
127 views

Allow read-only access to server-side pages for security review?

This answer: http://security.stackexchange.com/a/37319/10574 Mentions the issue of host-based security. To the end user, the web server is an untrustable black box. Would it provide to needed ...
1
vote
2answers
1k views

How secure is using a blank index.html / index.php? [duplicate]

When you put a blank index.html into a given directory on a web server, web browsers will not display a file listing for that directory. But is it secure enough for other purposes other than ...