Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

4
votes
2answers
14k views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
4
votes
3answers
4k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
4
votes
4answers
410 views

What security standards should be implemented in a simple web application [closed]

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
4
votes
2answers
706 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
4
votes
2answers
197 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
4
votes
2answers
7k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
4
votes
2answers
176 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and services ...
4
votes
1answer
197 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
4
votes
2answers
415 views

Use mining to prevent DDOS attacks on websocket: Is this a viable solution?

I'm thinking whether the following way is a good way to completely and totally prevent ddos on my server. My idea is to use the same mechanism of cryptocurrency mining (bitcoin, with sha256 or any ...
4
votes
1answer
10k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
4
votes
1answer
5k views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
4
votes
2answers
2k views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
4
votes
3answers
3k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
4
votes
3answers
232 views

Practically, when good password policies are used, how much is gained from SSH keys? [duplicate]

Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way. I understand the arguments for why ...
4
votes
5answers
211 views

What is the best way to secure your web resources when you provide API as web service?

Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy ...
4
votes
1answer
7k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
4
votes
2answers
2k views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
4
votes
1answer
86 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...
4
votes
1answer
753 views

Does visiting the localhost with my Tor browser reduce my security?

I happen to have Tor open right now, and want to do a quick modification to my website. Does visiting localhost with Tor reduce the security of that session?
4
votes
1answer
618 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
4
votes
3answers
638 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
2answers
1k views

Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?

Is it worth separating www-data and apache service from each other, in jails? I currently have this setup: Freebsd 9 1x Public ip (jails are in private ip's, nat'ed) 2 separate domains, managed by ...
4
votes
1answer
140 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
4
votes
1answer
4k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
4
votes
1answer
1k views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started investigating....
4
votes
3answers
31k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
4
votes
2answers
1k views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
4answers
131 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
4
votes
2answers
144 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
4
votes
3answers
2k views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
4
votes
2answers
4k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
4
votes
4answers
160 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
4
votes
1answer
3k views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
4
votes
2answers
2k views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
4
votes
1answer
931 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...
4
votes
2answers
73 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
4
votes
1answer
615 views

Why does my web server receive so many TCP resets from some clients?

I run a web server and log connections that are dropped. Occasionally, I get a burst of TCP RST packets from some of my clients, like this: Feb 11 11:56:29 SRC=1.2.3.4 TTL=57 SPT=38383 DPT=80 WINDOW=...
4
votes
1answer
1k views

VPS Safety in the Cloud

Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
4
votes
2answers
576 views

How to improve VPS security?

I’m using Linux based VPS hosting, and a firewall and mod_sec help to keep most hackers out. However, over the last couple of weeks I noticed several entries in mod_sec showing that an unknown domain ...
4
votes
3answers
196 views

Single web application - security advantages to two server model?

I'm looking to deploy infrastructure for a web application that will live on a LAMP stack. The infrastructure is such that this is the only application that will ever live on this server and it must ...
4
votes
2answers
253 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
4
votes
1answer
266 views

SSH Access to Personal Server sudo vs su

I have a server running Debian, which is on the web, and has few traffic (I use it essentially for some coulds, calendars, etc. for me). In an attempt to secure its access, I made the following in the ...
4
votes
2answers
300 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
4
votes
1answer
176 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in /var/...
4
votes
2answers
2k views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
4
votes
0answers
25 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
4
votes
0answers
116 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
4
votes
0answers
5k views

Apache vs Jetty with regard to Security [closed]

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
4
votes
2answers
249 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
3
votes
2answers
1k views

Is it possible to steal a non secure Cookie when the Web Server (IIS) only allows Https?

Is it possible to steal a non secure Cookie (Secure Flag is false) when the Web Server (IIS) only allows Https?