Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

-5
votes
1answer
111 views

what type of server is best for launching a vulnerable application on an Organization network? [closed]

For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo ...
0
votes
0answers
30 views

Can a website run a malware on my computer? [duplicate]

Can a website install a malware on my computer and run it in the background without my knowing about it?
0
votes
1answer
302 views

What web servers are affected by this user agent exploit?

I found this user agent logged in one of my websites: Array ( [IPaddress] => 115.89.123.121 [userAgent] => }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}...
0
votes
1answer
595 views

Fuzzing a webserver using DirBuster

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster ...
27
votes
8answers
7k views

What security risks are there in allowing someone to upload PHP scripts?

Let's say that a partner wants to upload a PHP script to my Apache server. What kind of mayhem could be caused by this? Which PHP parameters pose threats? If those PHP parameters are fully disabled, ...
1
vote
1answer
105 views

A secure connection with an application and a dedicated server

I'm wondering if this kind of technology is already exist (not VPN), I'm looking for a method to make secure internet connection within a dedicated server, where my laptop has a desktop application to ...
1
vote
1answer
185 views

How secure is it to store passwords in a non-accessible file?

So, I was thinking about workarounds for saving passwords in text files (just because I'm curious), and I thought, what if I saved my file somewhere that is non-accessible? My server has a public_html ...
1
vote
0answers
575 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
2
votes
1answer
40 views

How to secure a web service that allows custom user defined paths?

I'm working on a website that will rebuild data as an RSS feed based on a custom path. For example: You have a video on youtube that you want an rss feed of comments, you can add -rss to the url (...
0
votes
1answer
183 views

Long handshake intolerance (SSL/TLS) - Command Line

How can one check Long handshake intolerance on terminal for a remote website? If anyone knows a openssl command or without use of openssl please suggest! Please do not suggest use of ssllabs.com.
1
vote
0answers
91 views

How to forbid hackers on a Joomla website? [closed]

My Joomla website was the victim of a hacker attack recently. Hackers had access to my server and added some PHP files and mostly modified some index.php files. THe code is unfortunately ...
57
votes
8answers
19k views

Brutalized VPS recovery data now available. Considerations? [closed]

Backstory My sites and VPS were stolen from me. The hosting company and I were locked out and unable to access it. They weren't able to create a temp password for access because the attacker blocked ...
1
vote
1answer
861 views

How can I use phpinfo.php file to find new files on a server

I have been given a server to hack into for a cyber security class I have taken. After using dirb to look at the file structure, the only accessible file was the phpinfo.php file. I need to use this ...
-3
votes
1answer
143 views

Can a VPS provider see the IP address I use when connecting? [closed]

I recently purchased a VPS. Can the provider see the IP address I use when connecting to my VPS?
0
votes
0answers
134 views

Auditd not writing to log after clearing without a service restart

I noticed that if everything is working fine with auditd on Ubuntu, and then the log at /var/log/audit/audit.log is cleared (all the text erased, the file is not deleted), auditd will no longer log ...
2
votes
2answers
66 views

Dangers in hosting software on a webserver?

I'm interested in hosting a competition in which participants (all of whom are remote) will be creating FPGA/RTL designs and judged on certain performance metrics such as speed/latency/size/etc. The ...
0
votes
1answer
52 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
2
votes
2answers
48 views

Web servers with different risk models in same network

This question comes from a security aspect rather than a routing/network aspect (which is why I chose here instead of server fault). We are creating a network architecture and have 2 webservers. One ...
0
votes
0answers
37 views

Webhook server protection

use-case A user sends a file to us, we process that file and sending callback request to his server that his file is uploaded to our servers. Now what I'm concerned about is the server that sending ...
1
vote
1answer
48 views

HTTPS flow clarification [duplicate]

I have done a small test and result is as expected, but I am trying to understand more. I have configured a fake DNS server to resolve all names to the IP of my VPS. On my VPS, I installed a web ...
2
votes
1answer
495 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
0
votes
1answer
1k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
3
votes
2answers
253 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
2
votes
1answer
36 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
1
vote
1answer
39 views

Port filtering for Ubuntu-Nginx minimal server environment

I've established a minimal, uncustomized LEMP stack (Ubuntu 16.04). The only server I have besides Nginx is Postfix. To protect that environment I filtered all ports besides a few, this way: ufw ...
3
votes
2answers
2k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
2
votes
1answer
2k views

What makes servers vulnerable to Return Of Bleichenbacher's Oracle Threat (ROBOT) attack?

Is server vulnerable if it supports RSA key exchange ciphers? Can server be still vulnerable if it is running on unpatched vendor software but does not support RSA key exchange ciphers? After applying ...
0
votes
2answers
222 views

Should I keep incoming data UDP ports open in a minimal server environment?

I have a minimal, uncustomized Ubuntu 16.04 xenial Nginx server environment with only these incoming data TCP ports unfiltered: 22, 80, 443, 9000 When reviewing /etc/csf/csf.conf I found out that ...
1
vote
2answers
971 views

Most efficient way to scan for webservers

Lets say I want to scan a large amount of ip addresses for webservers running on port 80 (aware that there are other ports for webservers, ignoring for example). What would be the most efficient way ...
2
votes
3answers
791 views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
1
vote
1answer
267 views

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
1
vote
2answers
73 views

How to verify if SSH Client is not recording my login information?

there are lots of SSH Clients one can use with Android, for example JuiceSSH client, so i have a security concern, that is, how can i know or verify, that this app is not recording my credentials to ...
0
votes
0answers
62 views

How does the webserver/browser know the encryption key(s) for encryption (SSL) [duplicate]

I just want to know how this works. As I know, encryption works with one or two encryption keys to encrypt. But how does it work with SSL certificates or SSL encryption? How does the browser know with ...
3
votes
1answer
344 views

Is mod_reqtimeout a sufficient and safe technique to mitigate Slow HTTP DoS Attacks?

We've been looking into configuring apache against the Slow HTTP DoS Attacks and stumbled upon this article, which goes over multiple techniques and apache configuration options. mod_reqtimeout ...
3
votes
2answers
108 views

SSL for external micro-services for Tor hidden service

I building a Tor hidden service for educational purposes, and I'm trying to make it as secure as I can. The main app is in Rails, and I'll communicate with multiple micro-services. Due to bandwidth ...
2
votes
1answer
92 views

Why wouldn't you institute Strict-Transport-Security headers?

I read recently that HSTS can cause problems with site access. Under what circumstances might that happen and what are safe HSTS settings to implement on my web server?
1
vote
0answers
73 views

How to list user and group access on an unfamiliar Linux system? [closed]

Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow ...
0
votes
0answers
168 views

Safely searching elasticsearch from client-side JS?

If my elasticsearch could be called directly from jQuery it would be much faster and simpler. I currently have a proxy in the middle of my static site and ES cluster. I have been looking at Search ...
1
vote
1answer
1k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
4
votes
4answers
123 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
1
vote
1answer
187 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
2
votes
1answer
73 views

Apache 2.4 log question

Documentation for Apache 2.4 states that: Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, ...
0
votes
1answer
59 views

New files appearing on my web server (I did not create)

I recently had a keylogger on my computer recording usernames and passwords including their respective web addresses. I have changed all my passwords however on my web hosting account, in the FTP, ...
0
votes
2answers
87 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
3
votes
1answer
189 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
0
votes
1answer
70 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
2
votes
2answers
180 views

What are the dangers of hot-linking assets from other websites

Say there is a situation where site a is directly linking a font file ie https://www.example.com/FONT.woff2 from site b. Would it be possible for someone to make a URL rewrite rule to point to a ...
-2
votes
1answer
117 views

How to know the vulnerabilities of my website? [closed]

My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further ...
1
vote
3answers
128 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
1
vote
3answers
222 views

How to chose a port to run an application on localhost? [closed]

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ...