Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

1
vote
1answer
112 views

Data on VPS is safe, or can accessed on rent VPS Virtual Server?

I rent a VPS server for two months to test a webapp. I insert data into SQL on this server and want to host web app to this virtual server for test. Can that server owner that rents a VPS to me or ...
-1
votes
1answer
541 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
3
votes
0answers
97 views

Why exactly are self hosted websites deemed that dangerous? [closed]

Up to now I'm using a raspberry pi as a local server for trying out things or hosting my own little projects (beginner level), but I want to make it publicly available (most likely only for people I ...
-1
votes
1answer
209 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
2k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
10
votes
1answer
1k views

How do I prevent users from modifying resources they do not own?

I am writing a server where I have an entity StoreOwner that "owns" or has a @OneToMany relationship to a Store entity (one store owner has 1 to N stores). Each Store has Offer and Item, each also ...
1
vote
1answer
68 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
-1
votes
1answer
285 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
-3
votes
1answer
109 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
1
vote
1answer
376 views

dangers of using WAMPServer on my home PC?

Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...
1
vote
2answers
84 views

Usage of same certificate for client and server authentication

Let's assume I have a device that has both client and server applications running on it at the same time. The client application for example connects to a remote secure webserver (HTTPS) that requires ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
1
vote
1answer
147 views

A secure connection with an application and a dedicated server

I'm wondering if this kind of technology is already exist (not VPN), I'm looking for a method to make secure internet connection within a dedicated server, where my laptop has a desktop application to ...
1
vote
2answers
1k views

List of sites that still dont support HSTS?

I'm working on an article for work and seeking a list of the top ~500 websites (ranked by Alexa) that still don't have support for HSTS. Does such a list exist? I'm not getting any interesting hits ...
28
votes
5answers
7k views

What are the dangers of advertising my MySQL-powered amateur site?

I recently started server-side programming, and wrote up a page containing a drawable-canvas that lets users publically draw and save a picture, and overwrite pictures made by others. For kicks, I ...
4
votes
2answers
417 views

Use mining to prevent DDOS attacks on websocket: Is this a viable solution?

I'm thinking whether the following way is a good way to completely and totally prevent ddos on my server. My idea is to use the same mechanism of cryptocurrency mining (bitcoin, with sha256 or any ...
1
vote
2answers
656 views

Identifying website attack type (Meuhy.php)

We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The ...
3
votes
3answers
778 views

Is using a sqlite with random name file secure?

As you know, SQLite have no security mechanism. My question is if i change the database file into some random name like '22OYIz23tmpyesTcMVFmw1tquFxzCIQD.sqlite' can someone exploit my database and ...
31
votes
5answers
14k views

Any reason NOT to set all cookies to use httponly and secure

Assuming a site is using all HTTPS all the time (LB redirects port 80 to 443), is there any reason not to force every cookie set by the application to use BOTH secure AND httponly? Currently, for ...
45
votes
3answers
6k views

How do hosting providers prevent the compromise of one website from causing the compromise of another one?

Could one create a vulnerable website on purpose to attack a server of a hosting provider? So in the question above which I recently asked we came to the conclusion that preventing one vulnerable ...
7
votes
2answers
508 views

Could one create a vulnerable website on purpose to attack a server of a hosting provider?

Is it possible for a vulnerability in one application to be exploited to attack another application on the same server? So according to the answer to the question above it is possible that when one ...
1
vote
1answer
1k views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...
2
votes
1answer
196 views

How secure IIS run together with XAMPP?

I'm using IIS for web server & run phpMyAdmin via IIS. But now, I saw someone use IIS and XAMPP. There is something I wanted to know. Usually they set : XAMPP to localhost:81 or localhost:...
1
vote
1answer
74 views

Do we need to have a private key on load balancer

We have the following scenario - 2 Load balancers serving traffic from multiple web servers We have installed SSL certificate with private key on the web servers Now, my question is, if we need to ...
47
votes
3answers
24k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
4
votes
1answer
86 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...
0
votes
1answer
1k views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
0
votes
1answer
106 views

Is Aria2 downloads detectable by web servers?

A couple of months ago I signed up for a paid online course. Their terms of service indicate that these video lectures are for streamed viewing and not to be downloaded. There's a 2 hour commute from ...
0
votes
1answer
134 views

Server encryption to prevent access by hoster

A friend told me one of their company servers got recently hacked. The server was super secured software side. It turned out the attacker called the hoster and used some social engineering skills to ...
0
votes
1answer
706 views

What web servers are affected by this user agent exploit?

I found this user agent logged in one of my websites: Array ( [IPaddress] => 115.89.123.121 [userAgent] => }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}...
-5
votes
1answer
115 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
0answers
33 views

Can a website run a malware on my computer? [duplicate]

Can a website install a malware on my computer and run it in the background without my knowing about it?
15
votes
5answers
21k views

Can I block based on MAC address?

If I block an IP, the attacker can work around the block by taking a new IP or use a proxy. Is it possible to make a ban based on MAC address? I want to block at the webserver level so that unwanted ...
3
votes
1answer
235 views

Why would an attacker authenticate to my Google Search Console?

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
0
votes
2answers
2k views

Self-signed certificates and internal cURL requests

I'm using an internal API for some commercial software we purchased and it recommends using SSL when utilizing the API; it uses cURL to achieve this and hence the user, pass and key will all be passed ...
2
votes
5answers
3k views

Protect against attack that modifies .htaccess?

I have a dedicated server. There is no code/site live now, only a coming soon page. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of ...
27
votes
8answers
8k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
1
vote
1answer
193 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
1
vote
0answers
642 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
2
votes
1answer
40 views

How to secure a web service that allows custom user defined paths?

I'm working on a website that will rebuild data as an RSS feed based on a custom path. For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
0
votes
1answer
313 views

Long handshake intolerance (SSL/TLS) - Command Line

How can one check Long handshake intolerance on terminal for a remote website? If anyone knows a openssl command or without use of openssl please suggest! Please do not suggest use of ssllabs.com.
3
votes
1answer
1k views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Some will have another firewall between the application server and the ...
57
votes
5answers
93k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
0
votes
2answers
91 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
1
vote
0answers
95 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
26
votes
9answers
2k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
1
vote
1answer
2k views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
2
votes
3answers
206 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
3
votes
2answers
600 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
-3
votes
1answer
169 views

Can a VPS provider see the IP address I use when connecting? [closed]

I recently purchased a VPS. Can the provider see the IP address I use when connecting to my VPS?