Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

0
votes
1answer
48 views

Using DIRB against form authentication websites

I came across this tool named DIRB which is used to find directories or files on the server. I have a website which has login form authentication and every page will redirect to login page before you ...
0
votes
1answer
47 views

Do HIPAA compliant web server and database need to be on the same server?

I work for a small IT firm and we are creating a web application (MVP) for doctors (in the USA). The patients will register with the application. We will only save their name, email, password (hashed)...
2
votes
2answers
84 views

Using fail2ban for detecting suspicious activity whitin a webserver

I know that fail2ban is mostly used for blocking IPs trying to brute force an SSH endpoint and other stuff like that. However, I am wondering if you could also use fail2ban to detect (not necessarily ...
1
vote
0answers
30 views

Unusual Get/Connect requests to Apache

Not sure if that has been asked before but over the last week I am getting hundreds of CONNECT and GET requests to my Apache web server for domains that are not on my server. Some are for well known ...
-1
votes
0answers
46 views

How to store keys in a web app which I want to be able to edit via a web page?

In my web app I use various payment providers. I want to be able to edit sensitive data related of them, such as API keys, via a web page. Therefore, to be able to do this, I have to store that data ...
2
votes
1answer
316 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
4
votes
4answers
409 views

What security standards should be implemented in a simple web application [closed]

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
0
votes
0answers
63 views

Can XXE be exploited when disallow-doctype-decl is set to true (Apache)?

I found out that an endpoint of a website may be vulnerable to XXE. It is using Unmarshal as an XML parser. When I try to send a post request using common XXE payloads, I receive the following ...
0
votes
0answers
39 views

How can a Web Server be fingerprinted? [duplicate]

How can a Web Server such as nginx or Apache be fingerprinted, if only functional HTTP Headers are sent and error pages are replaced by custom ones?
1
vote
1answer
42 views

Tracking script creates vulnerability

I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
-1
votes
2answers
102 views

How does a hacker get access to my files if he got access to another user's files on a shared server? [closed]

I host files on a shared server with Ubuntu 14.04. How does a hacker get access to my files if he got access to another user's files and how do I prevent it?
1
vote
1answer
222 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
5
votes
1answer
120 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
0
votes
2answers
183 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
-2
votes
2answers
86 views

Burp Suite's keeps my ip safe?

I am starting to learn how to use Burp Suite, but since it is kind of (tho I know it does more) automatic way of plugging information into a website/form, should I still use proxychain/vpn to keep my ...
49
votes
5answers
11k views

What exploit are these user agents trying to use?

I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
1answer
106 views

How to hide webresource.axd and scriptresource.axd file?

I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?
0
votes
0answers
31 views

Apache - Adding Redirect to sub-directory V/S changing DocumentRoot

I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule. The reason I ask this, I have a website that is installed under /var/...
0
votes
1answer
73 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
1
vote
2answers
7k views

Cannot figure out how to bypass this function for lfi

I'm currently doing some practice about security and facing challenges provided in a website. One of them talks about LFI and I did figure out what to do, but I have no idea how to do this, so let's ...
6
votes
1answer
203 views

How can I find a web application's document root using a path traversal vulnerability?

I am performing a penetration testing on an application hosted on an Ubuntu environment. So using a path traversal vulnerability, I can download any file. The API web application runs as root (...
-2
votes
1answer
50 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
-1
votes
1answer
85 views

How to determine where an attack came from? [duplicate]

I've noticed sometimes that I'd receive very random requests coming to a live server that I'd be hosting in realtime through my log. It would usually look something like: [14/Mar/2019 02:05:36] "GET /...
-1
votes
1answer
88 views

how to check if remote host is running LDAP server?

I am currently pen-testing a remote website (its mine) I would like to know if its possible to test if the web-server is running LDAP server. I tried Nmap with no luck(it lists every port from 1 to ...
0
votes
0answers
37 views

Retrieve hostnames for IP addresses to connect to HTTP services, when no (reverse) DNS PTR records are available?

I'm conducting a penetration test, where I'm facing the following problem: After having retrieved a set of IP addresses through tools like whois, I cannot successfully connect to the HTTP-based ...
1
vote
2answers
132 views

Why are top-level wildcard bindings unsafe?

Microsoft has the following to say about configuring asp.net core with http.sys: Top-level wildcard bindings (http://*:80/ and http://+:80) should not be used. Top-level wildcard bindings create ...
1
vote
0answers
45 views

How to treat SSN passing through web server

I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
5
votes
1answer
209 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
0
votes
2answers
39k views

Browsing file/directory structure of a website

I want to know whether can we browse file/directory structure of any website. If yes, then how? If no, why can't we?
7
votes
2answers
5k views

How did hackers compromise my EC2 instance?

My EC2 instance was hacked recently. It doesn't really matter as I'm just starting my website and there was no sensitive information on my server yet, but I do plan for there to be in the future. I am ...
1
vote
0answers
58 views

Why is digital signature enforcement on webservers not common practice?

Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / ...
0
votes
0answers
28 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
0answers
60 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
5answers
99 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
0
votes
0answers
77 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
30
votes
6answers
38k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
1
vote
1answer
90 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
3
votes
1answer
139 views

My website got blacklisted as “phishing”. Any hints on how to avoid that?

I have a personal website hosted using my provider's DNS name (i.e. myname.provider.com) on my personal hardware at home. The web server (both HTTP and HTTPS) is Apache on Debian Wheezy (which is ...
0
votes
1answer
154 views

Does serving Tomcat via Apache Webserver improve security?

This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios: Tomcat serves ...
0
votes
0answers
59 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...
0
votes
1answer
35 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
1
vote
4answers
148 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
2
votes
1answer
99 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
0
votes
1answer
124 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
3
votes
2answers
3k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
91
votes
7answers
13k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
2
votes
3answers
3k views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
0
votes
1answer
26 views

Best practice for config files for ec2 instances

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have ...
1
vote
2answers
54 views

Is an open source web application server publishing it's version at a public endpoint a security issue? [duplicate]

If an open source web application is publishing the version via a public, non-access controlled API/Header, is it considered a security issue? The premise of the question is that, if a particular ...
1
vote
1answer
51 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...