Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
0
votes
1answer
128 views

Paths in web servers

Using sqlmap I was able to gain access to one database and using --current-user and --privileges. I can confirm that the user is root@localhost with full privileges. The part I have problem with is ...
8
votes
1answer
814 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. What ...
1
vote
1answer
52 views

Best methods to mitigate DDOS with changing IP sources

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
1
vote
3answers
127 views

Can DirBuster list all website links or information displayed on a static website?

I am in the process of looking for a specific keyword on a particularly large website with lots of pages. I'm thinking I'd have better luck if I have a way to see the links within the website. If I ...
1
vote
1answer
56 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
1
vote
1answer
61 views

What exploit is trying to be leveraged here? (Apache access.log)

I've just deployed a barebones Apache server on Digital Ocean, only hosting static files. No PHP et al. I'm not too bothered to see random exploit attempts, but 99% of the requests are of this similar ...
0
votes
1answer
455 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
0
votes
1answer
63 views

TLS integration of webapplications

Let's say I am a developer/maintainer of an open-source-webapplication distributed via docker. Any server-admin can install (using docker) and host this webapplication on his server with his own ...
-1
votes
2answers
275 views

Pure-ftpd connections from unknown IPs

I'm seeing unknown IPs in results like this in the messages log on a CentOS 6 webserver, are these IPs actually accessing the machine? Mar 13 19:11:49 server pure-ftpd: (?@some.ip.here) [INFO] New ...
1
vote
1answer
71 views

Docker container exposed port vulnerabilities on Debian server?

I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the ...
1
vote
1answer
36 views

Private keys with or without password for webservices?

What is the industry standard on this matter? How do you handle the keys for your websites, apis, micro-services, etc. If I create private keys without password they will be 100% compromised if one ...
0
votes
1answer
50 views

why the website cant understand my request in http smuggling?

hi I started to find bug bounty vulnerabilities and i think i found a te.cl vulnerability in a website. i send GET / HTTP/1.1 Transfer-Encoding: chunked Host: subdomain.domain.com User-Agent: Mozilla/...
0
votes
2answers
292 views

How to detect malicious files or web shell on a vps web server

How is it possible to detect malicious files or web shell on a vps web server? I used to use a shared hosting, and when I tried to upload any malicious code for testing it got deleted automatically. ...
5
votes
2answers
3k views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
1
vote
0answers
43 views

Is it ok to give the client the power to make any request from within our server?

We have a very heavy endpoint on our server, that takes a few hours to respond. Of course, this would result in a timeout, so we added an "asynchronous" functionality to it. To summarize, a ...
3
votes
1answer
116 views

What are these long hexadecimal HTTP requests? [closed]

I'm receiving long hexadecimal requests on my webserver, such as: /...
16
votes
7answers
2k views

Online Government Elections System - Is it possible?

I am from Bulgaria and currently some groups here are promoting the idea of referendum among the people, about the possibility for establishing a system for ONLINE GOVERNMENT ELECTIONS. The idea is ...
42
votes
2answers
12k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
4
votes
0answers
100 views

Is an out-of-band request via DNS by abusing the X-Forwarded-For header exploitable

By changing the X-Forwarded-For header in a request, I am able to have it sent an OOB interaction with Burp Collaborator requesting a DNS lookup of type A. Is there any risk to this vulnerability or ...
0
votes
1answer
62 views

How to know if the response is from the CDN and not the origin?

I am doing some bug hunting. I inserted a malicious payload into a request. But I am not sure if the response is from CloudFlare or the origin. Are there special headers which help me to distinguish ...
1
vote
1answer
59 views

sudo systemctl running a webserver a security risk?

On linux ami the only way to easily run systemctl for my server is by running sudo systemctl start node In the service: /etc/systemd/system/node.service sudo seems to be mandatory for the 'enable',...
0
votes
0answers
46 views

Is it possible to know the keep-alive time supported by a web server?

I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
0
votes
2answers
143 views

What are the risks of using non-ssl connection between server and (externally hosted) database?

I am building an application using AWS Lambda and using a MongoDB database hosted directly with MongoDB (Atlas). For some reason, I get an error when trying to connect via SSL and I've been working on ...
1
vote
1answer
318 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
7
votes
1answer
195 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
0
votes
0answers
216 views

Strange get request to my web server [duplicate]

I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
16
votes
1answer
6k views

Does a log entry with “SPT=81” despite nothing listening on that port indicate my server is hacked?

I manage a Debian GNU/Linux web server (Debian 10 Buster with its bundled 4.19 kernel). I put in place simple iptables logging rules a long time ago, among other things. Here they are: # iptables -A ...
0
votes
2answers
136 views

Hijacking of my site

I have my site xyz.mysite.com this is sitting on Cloudflare. I was reviewing my Apache logs and I saw a website as a referrer I did not recognise. I went to the site and it redirected to my site xyz....
0
votes
1answer
82 views

What (aside from the law) prevents cloud-hosting owners from eavesdropping on servers/code?

Given a server hosted on a cloud platform, what would stop the cloud platform owner from stealing the server's data and/or code? As far as I can tell, a motivated cloud owner could retrieve the data ...
0
votes
2answers
121 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
1
vote
2answers
163 views

How are hidden private URLs being “leaked” to third parties?

We're hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is ...
20
votes
6answers
43k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network as ...
1
vote
1answer
55 views

Getting an abnormal amount of firewall warnings on web server

I just had a look at the firewall status and saw it had blocked over 300 requests from TOR, Python Urllib, and some script called aabbccdd.xss.ht/pigeonburger.xyz (pigeonburger.xyz being my website). ...
40
votes
5answers
29k views

Any reason NOT to set all cookies to use httponly and secure

Assuming a site is using all HTTPS all the time (LB redirects port 80 to 443), is there any reason not to force every cookie set by the application to use BOTH secure AND httponly? Currently, for ...
51
votes
4answers
30k views

Should I disable http HEAD requests?

I have seen increased 'HEAD' requests in my webserver access.log. What are these requests for? Should I disable this method in my webserver configs?
0
votes
0answers
44 views

Dreamhost hosted wordpress site attacked - SSH password was changed - Need help assesing attack vector

My client had his wordpress site attacked, his site is not a juici target, the attack consisted in redirecting the site to another site. That in itself is no surprise, the weird thing is that both the ...
14
votes
3answers
14k views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and password,...
1
vote
1answer
50 views

Build and execute code on a sandboxed environment?

Numerous websites allow us to build and execute C code from web browsers (repl.it, onlinegdb.com, ideone.com...). For my own application (education purposes) I would like to do the same on my web ...
0
votes
0answers
8 views

Is there a utility that identifies attack footprints in HTTPD log files? [duplicate]

We're manually reading HTTPD log files and taking note of service abuse. Example: 10.0.0.1 - - [01/Jan/1970:00:01:01 -0100] "GET /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media ...
0
votes
0answers
38 views

How to perform encryption/decryption in a RESTful system? [duplicate]

I'm not a crypto/security expert and have designed an architecture for encryption/decryption. I'm not sure if its full proof and want to know what people use as industry standard? I'm trying to ...
-2
votes
1answer
360 views

How can I fuzz a http server? [closed]

I was researching fuzzing using AFL and hongofuzz and they mainly support applications that run in the terminal. After that I came across a list of resources for network fuzzers, and found afl-net ...
89
votes
5answers
42k views

Are there any downsides to using Let's Encrypt for a website's SSL certificates?

On the advantages side, I see several benefits to using the Let's Encrypt service (e.g., the service is free, easy to setup, and easy to maintain). I'm wondering what, if any, are the disadvantages to ...
3
votes
2answers
212 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
0
votes
0answers
29 views

E2EE through a browser for multiple users and devices in a many-to-many scenario

I've multiple IoT devices that read and write streams of data (audio/video signals, sensory data, ecc...) and multiple users that can do the same, I should be able to interchange informations from one ...
0
votes
1answer
64 views

Securing application server for a single user

I'm building some simple dashboard app for myself, but I want to have them on multiple devices - hence the server and front end. As I will be the only user who will access the application server, what ...
0
votes
0answers
31 views

What are these access requests? [duplicate]

So I have a series of these requests in my log and was wondering what they were? It appears malicious but no harm has been done. Can anyone confirm? - Any insight or reading material etc that would ...
0
votes
1answer
296 views

Understanding sqlite3 sanitization in python

I use sqlite3 for my database and get data from untrusted source with flask.request.get() I insert all data with such syntax c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2)) ...
0
votes
1answer
61 views

CDN vs server-level GeoIP

Suppose a website is set up so that only IPs from country X are allowed read/write access. This server goes through a CDN such as Cloudflare. Because the GeoIP read block is at server level, it never ...
2
votes
2answers
88 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
0
votes
1answer
67 views

Where is the best way to filter user input? [duplicate]

Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the ...

1
2 3 4 5
18