Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

1
vote
1answer
954 views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
1
vote
2answers
172 views

Can I detect OS and browser spoofing on webserver side?

My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server. Is there a way to detect if user is ...
1
vote
1answer
308 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
3
votes
1answer
105 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
0
votes
1answer
225 views

Why cant I bypass user authentication by copying cookies?

I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and ...
1
vote
1answer
2k views

On company intranet yet web server picked up URL scanning-type requests?

I was running some unit tests for a web app using Karma in watch mode (so it was running a web server) and I got this output in my console between tests while the console should have been idle. 20 01 ...
1
vote
2answers
394 views

what is the security issue if session time out is the default value from server configuration?

In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
-2
votes
4answers
121 views

Can SSL deployment incur performance issues [closed]

Does SSL deployment for secure server-client communication incur any performance overhead? I ask myself, why not just use HTTPS for standard web browsing when it is proven that it protects our privacy?...
1
vote
1answer
210 views

Running a local server inside a virtual machine disconnected from the Internet - is this secure?

This is a follow up to the question I asked yesterday. According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial ...
2
votes
3answers
183 views

Am I exposing myself to attacks when running my test server while connected to a commercial VPN?

I installed the Apache Web Server on my computer and I use it for developing a website locally, when it is finished I will move it to a paid host. The protections implemented against incoming ...
2
votes
2answers
1k views

How important is the usage of open_basedir on a server with multiple different PHP websites?

On an apache webserver with multiple VirtualHosts running different PHP websites on different domains, how important is it to set open_basedir for each VirtualHost? Will it actually help to isolate ...
0
votes
2answers
307 views

Setting up communication between internal database and hosted web server by third party

I am trying to figure out the best and most secure way to do this, if it is possible to do it safe and secure. Small company. We have a hosted web server from a third party that serves our client web ...
3
votes
1answer
74 views

Does SSL communicate automatically using the most secure protocol available?

As different version of the SSL protocol can be used to communicate SSLv2, SSLv3, TLS1.0, TLS1.1, TLS1.2 with different level of security of course my question is simple : Does SSL communicate ...
-4
votes
1answer
71 views

How to keep users's files seperate from each other? [closed]

I want to create cloud storage platform that users can uploads any kind of files and download them.But I want to be sure that none will enter another people files thats why I think I need to deny ...
1
vote
1answer
5k views

Cannot figure out how to bypass this function for lfi

I'm currently doing some practice about security and facing challenges provided in a website. One of them talks about LFI and I did figure out what to do, but I have no idea how to do this, so let's ...
-2
votes
4answers
150 views

Is 'content validation' the golden rule to avoid all web attacks and breaches?

I'm new to web programming and am really upset about the security precautions that should be taken into account while launching a website.If I plan to read analyze and learn every security threats ...
2
votes
4answers
356 views

If Yahoo can get hacked , how can we secure our small websites? [closed]

Law enforcement provided Yahoo in November 2016 with data files that a third party claimed was Yahoo user data. We analyzed this data with the assistance of outside forensic experts and found that ...
0
votes
1answer
25 views

Split Production and “public” Webspaces

We're developing a Software, using Git and some web based organsiation software on one of our members webspace. This webspace is as far isolated, thus none could access it without knowing the address. ...
2
votes
2answers
103 views

How to conclude from a target IP to associated URL(s)?

Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s). I can scan the IP(s) with nmap and possibly conclude on which ports a webserver is running, ...
1
vote
2answers
201 views

Are there risks associated with using a free SSH server?

So basically I was looking on the Internet for free SSH server as I wanted to exercise some Linux commands and I only have Windows installed on my laptop. I saw so many Free SSH servers on the result ...
0
votes
0answers
94 views

Honeypot URL and reporting site

Is there some sort of tool list that can work with Apache/NGinx/etc that has a list of "honeypot" URLs such as /HNAP1/ that when it gets detected in the logs of the web server then it will ...
-1
votes
3answers
419 views

Can Tor Browser prevent ISP or IT Department at a Work place from knowing what i do while watching a Video online from a work computer (not mine)? [duplicate]

I must change the security settings of Tor browser to the lowest to be able to play a Video online, yet i have not tried it till now. That is why i got to think, whether it is unsafe to play online ...
2
votes
2answers
105 views

With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server?

Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of ...
1
vote
1answer
210 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
0
votes
1answer
46 views

Should a webserver's access to certain directories be limited?

There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories....
3
votes
1answer
228 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...
33
votes
8answers
8k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
2
votes
0answers
95 views

Are there successors to httprecon [closed]

httprecon appears to be dead, the latest update per changelog is from 2009. Are there any successors?
6
votes
4answers
603 views

How to safely extract an uploaded zip?

I'm working on a project for a client where they would like their users to upload a ZIP file that can be extracted. Once extracted, we would utilise certain files in there, such as images and HTML ...
1
vote
3answers
124 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
4
votes
1answer
691 views

Configuring socat to pentest an IPv6-only remote web server from an IPv4 host

I need to pentest an IPv6-only web server situated in a remote network from my IPv4 host (Kali Linux VM). I have a 6-to-4 tunnel up between the two hosts (configured using Hurricane Electric). I'm ...
0
votes
1answer
95 views

passing user input to command line

I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure. The user enters a password, which is then ...
1
vote
1answer
73 views

Is this generation of project URL safe?

In proceedings of my question's answer I found a way of generating a project URL regardless of project's path in Document root. If in a file in the root of the project I define the following: define(...
7
votes
1answer
2k views

Flask debug=True exploitation

It's a well known fact that Flask's debug=True option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it ...
1
vote
2answers
57 views

Parameters to check before storing data on cloud

I want suggestions regarding the storing/securing my data on cloud. I want to upload my data on cloud, so it will be safe and can be accessible from anywhere. I have around 15 GB of data which I ...
2
votes
1answer
3k views

How to configure F5 load balancer and backend server both with SSL Certs

I have an F5 load balancer and a backend server. Load balancer is www.example.com. Backend server is server1.example.com. I have the F5 load balancer with SSL Profile (client) and SSL Profile (server) ...
2
votes
1answer
292 views

Which server is responsible for “security” when ASP.NET Core Kestrel is hosted behind IIS?

I want to understand how the flow between IIS and Kestrel works with regards to security. It seems that the integration between IIS and Kestrel is that IIS just sends absolutely all that it receives ...
0
votes
3answers
1k views

How to find out what websites are associated with an IP that has port 80 open?

New to security, so please forgive my ignornance - I have a machine with port 80 open, and I found the following information: Starting Nmap 7.01 ( https://nmap.org ) at 2016-09-29 23:46 EDT Nmap scan ...
1
vote
2answers
341 views

Replacing a TLS cert when the old one is pinned (HPKP)

Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now? This site says: ...
0
votes
4answers
103 views

Is there any security flaw in using a non root port in production?

I am planning to use a web service running on port 8080 for serving some static files in production . Is it acceptable or is there any possible security flaw in this? NOTE- I don't want this service ...
3
votes
1answer
760 views

A=0 appended to web server queries

While looking through the logs for my web server, for a web site I wrote, I've noticed a lot of queries are being made twice, first as I expect then followed again within a second with 'A=0 appended ...
0
votes
0answers
86 views

Is this a Cross Site Scripting attack?

I was examining my web server log file this afternoon when I saw a couple of entries like this, which I wasn't happy about and banned the IP in iptables. 113.90.122.99 - - [20/Sep/2016:19:07:58 +0100]...
-1
votes
1answer
135 views

Weird GET request to /proxychecker/check.cgi [duplicate]

I started running a flask application on a raspberry pi last night. It was not hiding behind apache or nginx, served the requests by itself. I set up my router to forward http traffic towards it as ...
1
vote
2answers
610 views

How to specify virtual web hosts in Nessus (host header/SNI)

Say I have the web server 198.51.100.125 in Amazon cloud that I want to scan, which is hosting two domains example.com and example.org. In Nessus, I have configured the targets like so: 198.51.100....
-1
votes
2answers
146 views

Got this php file in my webserver root. Am I attacked? [duplicate]

The name of the file is dmpdstcm_qsdfjmqsjfdlmqjf.php and its content is below. What should I do please? :( <?php $brian= 'r';$exhaling ='ctpv'; $jacki= 'b'; $cravat = 'am('; $giselbert = 'LkRi"...
2
votes
3answers
4k views

I want to host a server from my home computer; safe?

I am planning to make public a website I have been working on; it seems to me that (in my very limited experience) the only way I can do this without needing to pay any extra money to external hosts ...
1
vote
1answer
195 views

Executing XSS on .jsp page by escaping string and with raw bytecode?

Assume that a java (.jsp) page takes a from input as a string, the server does nothing to sanitize it, and then echoes it back to the user. How would an attacker escape the string to execute ...
2
votes
1answer
557 views

What network topology should be used in a SOHO environment with a publicly available web server?

My home office setup currently has a wireless router running DD-WRT NXT connected to a cable modem. Connected to this router are a number of workstations which I do not have to deal with that I assume ...
1
vote
1answer
69 views

Does a continuously freshly installed proxy server increase security?

If a small number of physical servers are used to run an OS and reverse proxy purely in RAM and have no storage, and they are rebooted/re-initiated in relay every X minutes - so that changes to the ...
0
votes
1answer
329 views

Parse logs from router to database

I would like to parse log files from Cisco WRVS4400N router to a specific database for detecting a DoS Attack. Any idea please?