Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
1
vote
1answer
649 views

Data Retention Laws for ISPs in North America

I was reading an article on TorrentFreak where Private Internet Access claims the United States "is one of the only countries without a mandatory data retention law." According to the linked article ...
4
votes
4answers
1k views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
24
votes
6answers
5k views

Why do DDoS attacks cost a fortune to stop?

I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions: Is this because they try to keep the servers accessible to real site ...
1
vote
3answers
600 views

Is this approach of securing cookie secure?

I could not find writeups about secure cookies so I have done some thinking. (I already have a "secure" password database with bcrypt and salt) Steps: User logs in Save user IP + randomstring in ...
1
vote
1answer
1k views

How to fix the audit failure in our web server

We noticed that we are getting the following audit failure logs in our web server. The workstation is not in our network. Can anybody help me how to isolate and prevent this from happening? An ...
-1
votes
1answer
290 views

Impact of attack occured in Radius, DHCP and HTTP servers on VOIP?

Assume we can crash the RADIUS server in a VOIP system. What would be the impact on the confidentiality, integrity, and availability of VOIP service. What would be the impact if the same question if ...
3
votes
4answers
5k views

Determining the point of compromise on an infected web server?

Recently a friend of mine has had his web server compromised - all PHP files were injected with malicious code, in particular one that looks to be called "GetMama". If I look this up, it seems that ...
4
votes
2answers
197 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
8
votes
3answers
342 views

Does concealing server software versions have a notable effect on security?

Web servers can add Server, X-Powered-By and similar headers into HTTP responses. Looks like the consensus is such headers should be removed so that automatic vulnerability scanners don't immediately ...
4
votes
2answers
1k views

Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?

Is it worth separating www-data and apache service from each other, in jails? I currently have this setup: Freebsd 9 1x Public ip (jails are in private ip's, nat'ed) 2 separate domains, managed by ...
3
votes
2answers
479 views

Securing a script to prevent database from being exposed

We have an Ioncube encoded script running on an Apache web server which stores customer confidential information in a MySQL database. We have configured the script to run under its own account using ...
3
votes
1answer
5k views

Something causing Sonicwall to throw Smurf Amplification Attack Warning?

I set up a new laptop recently and, after installing various developer tools, it started causing our Sonicwall firewalls to issue an alert email whenever the laptop connected to the network. The ...
6
votes
2answers
4k views

How does IP tracking work?

Excuse the naive question (I'm more of a dev than a web-sec person) In the past I've had webservers hacked and usually i've traced it to some random machines which seem to have been compromised (i ...
2
votes
2answers
905 views

I've just purchased a VPS to use for developing and managing my clients hosting packages. What necessary steps do I have to take?

The VPS is running CentOS and I have full access. I only looked around using the cPanel installation and already disabled anonymous FTP access. What other security risks are there with a default VPS ...
13
votes
4answers
2k views

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
1
vote
1answer
450 views

Where do I find more information about a given hacking attempt requests to my website?

Having a report which shows me to which requests my website responded with a 404, I often find hacking attempts like this: Some are recurrent and too explicit, like PHPMyAdmin-type requests ...
0
votes
2answers
4k views

How could the hacker tamper with the 'configuration.php' file in my Joomla web server?

I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so? Note that the file has 777 permission. Also, ...
3
votes
2answers
1k views

Killing IP connections who “spam” with requests

How can I go about killing IP connections that seem to be sending a lot of requests to the same url? Let's say I have someone who requests the same url for more than 10 times in 5 seconds, I want to "...
3
votes
2answers
5k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
1
vote
4answers
548 views

Integrity monitoring for a LAMP server

So I'm setting up a small e-commerce app, and am thinking what happens if the server is compromised. We are selling software so potentially an intruder could generate themselves some free serial ...
4
votes
1answer
1k views

VPS Safety in the Cloud

Imagine you are running a web server on a Virtual Private Server (VPS) hosted in a datacenter. Could the people running the datacenter covertly read files from my VPS's hard disk? Could an attacker ...
9
votes
3answers
744 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
1
vote
1answer
2k views

IIS password protected website

I have a website built upon windows IIS and to use password to protect the website and disable anonymous logon to that website, the ONLY way is to disable the anonymous logon in IIS and use a windows ...
60
votes
4answers
10k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
7
votes
5answers
5k views

Is it trivial to bypass IP blocking?

There is a site with IP blocking. When a client makes too many invalid attempts when guessing e.g. password, then their IP address becomes blocked. I've heard about IP spoofing and similar attacks. ...
3
votes
1answer
1k views

What attacks use enabled Apache's PATH_INFO?

In Tangled Web Michal Zalewski says: If you are not using path-based parameter passing (such as PATH_INFO), consider disabling this feature. He gave only one example of this vulnerability. There ...
2
votes
3answers
245 views

Would people object my website just because I use Google Analytics, +1, or FB Connect?

Are there people who will refuse to use a website just because that site sends browser information to Google Analytics? Could the +1 button be a red flag? Should I expect that there would be ...
20
votes
3answers
6k views

What are the risks of using a CDN to speed up my website? How do I avoid them? [duplicate]

Content Delivery Networks (CDNs) are well known to speed up the performance of a website, but they create the obvious security risks if someone were to change the code that resides on the CDN. What ...
5
votes
2answers
942 views

Compromised server redirecting only requests from Google

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
9
votes
5answers
1k views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
6
votes
3answers
2k views

Is there a good reason to turn off phpinfo()?

New server setup and the server admin decided phpinfo was too scary. I guess the fear is that a hacker could somehow get phpinfo() to run from injected php and find out all the extensions that are ...
12
votes
3answers
6k views

Installing Development Tools on Production Server? Security Risk?

I am using an Amazon Linux EC2 instance as a web server. My web app uses ImageMagick. Because the Amazon Linux (CentOS) repository doesn't include an up-to-date version of ImageMagick, I am compiling ...
8
votes
1answer
878 views

Is Chinese great firewall white or black list based? [closed]

Is a new website blocked by default in China ? I just put online a new website dedicated to chinese people (a working days calculator in China, nothing subversive indeed). However a friend of a ...
1
vote
2answers
192 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
8
votes
3answers
880 views

How does an attacker approach a website?

What is a typical mindset and method of approach? What are they likely to try first? At what point does a novice give up versus an expert? How would an automated attack differ from a manual one?
8
votes
1answer
785 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
2
votes
1answer
6k views

How can log poisoning be successful with a Local File Inclusion attack?

I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
2
votes
1answer
193 views

Is there a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? [closed]

As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is ...
0
votes
1answer
765 views

Iframe hack / done through FTP?

On two websites which I host for a friend, I found that there is an iframe at the bottom of each site's index.htm file. <iframe src="http://www.kunstsalen.dk" width=1 height=1 style="visibility: ...
1
vote
1answer
166 views

Where to find a fake hierarchy for a honeypot for double-dot/path traversal attacks?

I would like to provide content when a hacker tries something like GET /../../../etc/passwd, but they may choose something else, other than passwd. I will install notification of when somebody does ...
4
votes
3answers
5k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
8
votes
2answers
9k views

How to secure a dedicated linux server running a LAMP stack for commercial E-commerce use

To be more specific, I would like to get some help, either through a tutorial or through a book, on how to configure an apache server to run securely and minimize the risks for commercial use. -...
12
votes
3answers
12k views

Is .htaccess protection secure enough?

For the moment we protect a directory on our site with .htaccess and .htpasswd. But I was wondering how secure this is? Are there things I should watch for or can do make it more secure? I don't know ...
3
votes
1answer
5k views

My web server is hit by strange traffic, what is that?

I'm a noob and just set-up a linode account to play around with linux development. I started nginx and made a simple homepage for my domain (giuliopizzini.com). Today I checked the nginx logs and ...
5
votes
3answers
419 views

How do I defend against known php hacks

I have IPs attempting to probe our web server trying to find open URLs. The two known methods are attempting to find specific nodes on our drupal site, or attempting the ../../../../ trick to try and ...
22
votes
1answer
6k views

Does the practice of blocking an off-site “Referer:” HTTP requests improve website security?

Is there any benefit for a security-paranoid website to disallow HTTP requests that have a Referer: from 3rd party sites? The pitch is that if such a HTTP request were to come in, then certain XSS ...
2
votes
1answer
630 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
2
votes
1answer
460 views

How does IE's Privacy options affect javascript's ability to save cookies?

I'm looking at IE's privacy options screen and am trying to figure out how it breaks javascript, workarounds to that, and how I can gracefully degrade my user experience. Is there a guide that ...
3
votes
3answers
393 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
10
votes
2answers
3k views

CloudFlare benefits or drawbacks

Anyone running a webserver would agree, security can be a hustle and tedious job. Recently I came across a service claiming to help with that -- CloudFlare.com. There's plenty of benefits listed on ...