Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

0
votes
2answers
25 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
5
votes
1answer
110 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
3
votes
1answer
582 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
1answer
93 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
1
vote
1answer
187 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
0
votes
1answer
801 views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of ...
0
votes
1answer
70 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
4
votes
0answers
596 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
3
votes
0answers
330 views

Memory and CPU usage during a denial of service attack. How to understand the data?

The Debian crontab file that is a web server Apache has the line: */2 * * * * echo -e "`date`\n\n`free` \n\n`vmstat`\n" >> /home/hacker/free_vmstat_output.txt I ...
2
votes
0answers
83 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
2
votes
0answers
448 views

How to validate Excel data to protect against XSS?

My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application ...
1
vote
0answers
31 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
0answers
45 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
1
vote
0answers
575 views

What's so special about `eval(“z!ax”)`?

While checking out some error logs for our site, I noticed one odd-looking request that provided many parameters that we don't use: 'q' => 'die(\'z!a\'.\'x\');', 'w' => 'die(\'z!a\'.\'x\');', '...
1
vote
0answers
21 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
0answers
161 views

Bizarre HTTP requests to VPS, former malware command and control server?

I just bought a new VPS with Linode. I installed Apache and noticed some very strange behavior that I have been seeing consistently throughout the logs. So basically, I keep receiving stranger HTTP ...
1
vote
0answers
25 views

Information and Settings Collected from a PC Connected to a Web Server

1- What are the information and settings collected from my pc when I connect to a website server? 2- When I connect through a VPN, Could the website server detect a mismatch between my new location ...
1
vote
0answers
92 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
1
vote
0answers
76 views

Does standard configuration in Tomcat pose any security risk?

I have a simple test website on Tomcat running on RaspberryPi. Pi is behind a router. Port forwarding is on and I can access the website from the Internet. What are the security risks of standard out ...
1
vote
0answers
55 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
0
votes
0answers
58 views

XSS : How to bypass htmlentities when < > " & is escaped and no input is inside a tag attribute with single quote? (the page is UTF8)

So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a ...
0
votes
0answers
54 views

Technical Repercussions of SSN briefly touching a server

I need to safely pass a SSN to Stripe from a web page. (We are doing taxes for our contractors) I am well aware that storing a SSN is not a good idea. We don't need to. Stripe can handle it, but I am ...
0
votes
0answers
134 views

Auditd not writing to log after clearing without a service restart

I noticed that if everything is working fine with auditd on Ubuntu, and then the log at /var/log/audit/audit.log is cleared (all the text erased, the file is not deleted), auditd will no longer log ...
0
votes
0answers
37 views

Webhook server protection

use-case A user sends a file to us, we process that file and sending callback request to his server that his file is uploaded to our servers. Now what I'm concerned about is the server that sending ...
0
votes
0answers
168 views

Safely searching elasticsearch from client-side JS?

If my elasticsearch could be called directly from jQuery it would be much faster and simpler. I currently have a proxy in the middle of my static site and ES cluster. I have been looking at Search ...
0
votes
0answers
401 views

Is it a good idea to have a nextcloud exposed host?

I have a Raspberry Pi with this nextcloud for Raspberry image. I've configured my router to open port 80 and 443 for the Raspy. I'm using https only and certificates from letsencrypt. How big is the ...
0
votes
0answers
94 views

Honeypot URL and reporting site

Is there some sort of tool list that can work with Apache/NGinx/etc that has a list of "honeypot" URLs such as /HNAP1/ that when it gets detected in the logs of the web server then it will ...
0
votes
0answers
86 views

Is this a Cross Site Scripting attack?

I was examining my web server log file this afternoon when I saw a couple of entries like this, which I wasn't happy about and banned the IP in iptables. 113.90.122.99 - - [20/Sep/2016:19:07:58 +0100]...
0
votes
0answers
128 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
0
votes
0answers
69 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses If none of above is ...
0
votes
0answers
138 views

Can I use process crash information to detect buffer overflow attacks?

Buffer overflow is a very common vulnerability, often targeted with zero-day exploits. Successful attacks often result in arbitrary code execution, while failed attempts tend to crash the target ...
0
votes
0answers
36 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
0
votes
0answers
162 views

Securing my API: concept of access tokens

First of all I want to excuse for the bad spelling and grammar. English is not my mother tongue. I have built a JSON communication between a front-end (website) and my Node.js web server. I want to ...