Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
0
votes
1answer
380 views

Long handshake intolerance (SSL/TLS) - Command Line

How can one check Long handshake intolerance on terminal for a remote website? If anyone knows a openssl command or without use of openssl please suggest! Please do not suggest use of ssllabs.com.
3
votes
1answer
1k views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Some will have another firewall between the application server and the ...
58
votes
5answers
97k views

Why is passing the session id as url parameter insecure?

I recently followed a discussion, where one person was stating that passing the session id as url parameter is insecure and that cookies should be used instead. The other person said the opposite and ...
0
votes
2answers
92 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
1
vote
0answers
98 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
27
votes
9answers
2k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
1
vote
1answer
3k views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
2
votes
3answers
206 views

What was done to gain a list of home directory accounts?

Today some sites were defaced in our WHM/cpanel VPS. I understand that the common cause of this is outdated scripts/plugins/etc. However as I was checking the file manager of one of the accounts I saw ...
3
votes
2answers
628 views

Regular Expressions for common exploits

I patched for shellshock and was barraged a few days later. However, I would not have known any attempts were made at all if not for a regular expression I found on the internet. This has inspired me ...
-3
votes
1answer
175 views

Can a VPS provider see the IP address I use when connecting? [closed]

I recently purchased a VPS. Can the provider see the IP address I use when connecting to my VPS?
12
votes
2answers
6k views

Is server hardening with grsecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
2
votes
2answers
70 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
43
votes
3answers
55k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
8
votes
6answers
8k views

What are the best ways to fake a web server

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
0
votes
1answer
68 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
2
votes
1answer
845 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
2
votes
2answers
52 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
1
vote
1answer
57 views

HTTPS flow clarification [duplicate]

I have done a small test and result is as expected, but I am trying to understand more. I have configured a fake DNS server to resolve all names to the IP of my VPS. On my VPS, I installed a web ...
19
votes
4answers
24k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
3
votes
2answers
126 views

SSL for external micro-services for Tor hidden service

I building a Tor hidden service for educational purposes, and I'm trying to make it as secure as I can. The main app is in Rails, and I'll communicate with multiple micro-services. Due to bandwidth ...
4
votes
3answers
2k views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
1
vote
1answer
293 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
3
votes
2answers
381 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
1
vote
3answers
238 views

Does Windows “System Volume Information” folder pose a security risk in servers?

I have a Windows 10 WAMP server running, and Windows by default has a hidden folder in every partition called "System Volume Information". I can't access it because Windows denies it, but I noticed ...
2
votes
1answer
38 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
1
vote
1answer
48 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
6
votes
1answer
298 views

Multiple SSL certificates on load balancer

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of ...
2
votes
1answer
3k views

What makes servers vulnerable to Return Of Bleichenbacher's Oracle Threat (ROBOT) attack?

Is server vulnerable if it supports RSA key exchange ciphers? Can server be still vulnerable if it is running on unpatched vendor software but does not support RSA key exchange ciphers? After applying ...
0
votes
2answers
390 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
4
votes
3answers
4k views

Is web application connected to a database via an application server more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
14
votes
4answers
27k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
2
votes
2answers
3k views

Most efficient way to scan for webservers

Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example). What would be the most efficient way ...
3
votes
1answer
313 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
1
vote
2answers
87 views

How to verify if SSH Client is not recording my login information?

there are lots of SSH Clients one can use with Android, for example JuiceSSH client, so i have a security concern, that is, how can i know or verify, that this app is not recording my credentials to ...
3
votes
1answer
175 views

Security implications of a missing SCSV, but with only TLS 1.2 allowed

Similar to this security stackexchange question, I was wondering if there's any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite ...
3
votes
1answer
530 views

Is mod_reqtimeout a sufficient and safe technique to mitigate Slow HTTP DoS Attacks?

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options. mod_reqtimeout ...
1
vote
3answers
2k views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I didn'...
4
votes
2answers
302 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
2
votes
3answers
213 views

Am I exposing myself to attacks when running my test server while connected to a commercial VPN?

I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming ...
2
votes
1answer
155 views

Why wouldn't you institute Strict-Transport-Security headers?

I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
104
votes
11answers
28k views

Best practices for Apache Server hardening?

What are some best practices, recommendations, required reading for securing an Apache Server?
7
votes
3answers
2k views

PHP | Security for allowing user uploads

My Situation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I have ...
1
vote
0answers
77 views

How to list user and group access on an unfamiliar Linux system? [closed]

Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow ...
0
votes
1answer
1k views

Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific ...
1
vote
1answer
2k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
4
votes
4answers
136 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
2
votes
1answer
362 views

Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?

I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
2
votes
1answer
682 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
1answer
82 views

Apache 2.4 log question

Documentation for Apache 2.4 states that: Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, ...
0
votes
1answer
66 views

New files appearing on my web server (I did not create)

I recently had a keylogger on my computer recording usernames and passwords including their respective web addresses. I have changed all my passwords however on my web hosting account, in the FTP, ...