Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

0
votes
0answers
13 views

How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?

This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
0
votes
0answers
8 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
1
vote
5answers
92 views

How to stop a request for an external image from exposing my IP to the server hosting the image?

Suppose I have a server A, and that there is a website W hosted on A. The HTML of W contains: <img src=https://www.domainD.com/testT.jpg> Then I have a computer C, that accesses W. Will ...
0
votes
0answers
72 views

Is my server under some kind of reconnaisance/attack?

Recently, I started up nginx on an Amazon EC2 instance. After a day, I started seeing these messages in my log. Some client keeps trying to call /add and /health.html on my server. I don't have those ...
0
votes
0answers
21 views

Crypto Miners injected into Non-SSL JS files [closed]

A number of months ago, I had the urge to clean up a few of my old servers. One of them had a particular number of domains with expired SSL certs. Since I don't maintain those sites, I never bothered ...
-2
votes
0answers
16 views

{“message”:“no route and no API found with those values”}..can anymore can explain what does it mean? [closed]

!I'mgetting this massagewhile I'm searching for subdomain "apac.foodpanda.in"........can anyone explainit what does it mean.
30
votes
6answers
37k views

What ciphers should I use in my web server after I configure my SSL certificate?

There are many great questions that ask what is the best certificate to use for a website; but once the certificate is purchased, there is also the possibility to choose or edit the Cipher list. ...
1
vote
1answer
69 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
0
votes
1answer
123 views

My website got blacklisted as “phishing”. Any hints on how to avoid that?

I have a personal website hosted using my provider's DNS name (i.e. myname.provider.com) on my personal hardware at home. The web server (both HTTP and HTTPS) is Apache on Debian Wheezy (which is ...
0
votes
1answer
151 views

Does serving Tomcat via Apache Webserver improve security?

This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios: Tomcat serves ...
0
votes
0answers
17 views

server logs invalid HTTP_HOST header, Bad request, 400 [duplicate]

I created a Digital Ocean droplet recently, to learn how to make Django app. Eventually they say I should use Gunicorn to serve and Nginx to face the world, however, in very early stage of learning ...
0
votes
1answer
18 views

Vulnerability in Composer/MeekroDB WhereClauseTest.php?

I have a development webserver for which the domain is not published or used (legitimately) by anyone other than me. However, I'm seeing hits in my access and error log for the following file from ...
0
votes
2answers
135 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
1
vote
4answers
148 views

employing SSL even on non critical web server [duplicate]

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those ...
2
votes
1answer
60 views

Security Log Analyze [closed]

is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not? I don't want to use SIEM.
0
votes
1answer
94 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
3
votes
2answers
2k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
90
votes
7answers
13k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
1
vote
3answers
542 views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
0
votes
1answer
22 views

Best practice for config files for ec2 instances

I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script. THere are some config files that have ...
1
vote
2answers
54 views

Is an open source web application server publishing it's version at a public endpoint a security issue? [duplicate]

If an open source web application is publishing the version via a public, non-access controlled API/Header, is it considered a security issue? The premise of the question is that, if a particular ...
1
vote
1answer
42 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
2
votes
1answer
130 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
1answer
63 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
1
vote
0answers
31 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
3
votes
3answers
209 views

A protocol for encrypting the data on the server, but with a password on a mobile device

I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
2
votes
2answers
131 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
0
votes
1answer
2k views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of ...
33
votes
3answers
1k views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
0
votes
1answer
71 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
2
votes
5answers
13k views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
1
vote
2answers
78 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
1
vote
1answer
25 views

What are the drawbacks to automatically deleting web server access logs?

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days? I'd like to limit how long I store personally-identifiable data (IP ...
1
vote
1answer
202 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
43
votes
8answers
12k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
5
votes
1answer
111 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
11
votes
1answer
3k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
1
vote
1answer
68 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
-1
votes
1answer
37 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
3
votes
1answer
139 views

Is it safe to open ports 80 and 443 in a home network

The intention behind this is that I'll be able to host a website from a home server (another pc with ECC ram etc.), but what worries me is that the network I'm using is also the same network which I ...
1
vote
2answers
951 views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
2
votes
1answer
441 views

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

I know that one can deny services (DoS) in any of the 7 layers of the OSI model and that in principle, a denial can be done by a single entity (human or machine) or from 2 or more such entities ("...
23
votes
5answers
5k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
23
votes
4answers
5k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
29
votes
3answers
7k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
1
vote
3answers
182 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
0
votes
1answer
174 views

NIKTO: Requires Authentication for realm ''MD5''

I am trying to perform a scanning of a web server using Nikto using: nikto -id id:pass -h xxx.xxx.xx.xxx I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
2answers
134 views

What are the security issues of exposing default server home page in public internet?

I have seen on internet where several website companies have exposed the default home page of web server such as Tomcat, NGNIX, Apache web server. I always believe it is not the best practice to ...
0
votes
2answers
94 views

Does HTML Purifier (which converts & to &amp;) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
1
vote
2answers
157 views

What can a site visitor do with a 777 file on my web server?

Sometimes I prefer working with text files instead of database as I can later manually edit the file content. Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...