Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
1
vote
0answers
79 views

Trust boundaries for webapps (vs desktop apps)

I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted. In some cases, our ...
3
votes
3answers
293 views

A protocol for encrypting the data on the server, but with a password on a mobile device

I want to implement the following encryption scheme. The data is created and stored on a web server, but related to some user of the system (i.e. it is entered "on behalf" of the user). Both ...
2
votes
2answers
184 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
34
votes
3answers
1k views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
0
votes
1answer
78 views

How can we find server location and IPs? [closed]

Is it possible to find where some known application servers (such as whatsapp) are located and their IPs ?
3
votes
5answers
17k views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
1
vote
2answers
94 views

Encrypt but not verify sender identity https without nagging user?

I have a five or six personal websites that I would like to send over https so isps can't inject ads. They're nothing sites hosted on a $60/year shared server. If I want to buy a https certificate I ...
1
vote
1answer
30 views

What are the drawbacks to automatically deleting web server access logs?

What would be the downsides to either disabling or automatically deleting web server access logs that are older than 7-10 days? I'd like to limit how long I store personally-identifiable data (IP ...
44
votes
8answers
13k views

Should log files be kept secret?

Accessing web server log files via a URL has a certain appeal, as it provides easy access. But what are the security risks of allowing open access to log files?
14
votes
1answer
5k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
1
vote
1answer
95 views

Risks of deploying a server authentication certificate along with a client application

What are the risks of deploying a client application with server authentication certificate (private + public key) so that a client application can host a webserver. Which is accessible via HOSTS ...
-1
votes
1answer
39 views

If I send request with PUT, and server return valid page with 403 status. This is correct work? [closed]

I send PUT. Server returned 301 status to valid http-address(!), but next response 403 status to hhtp-address. If I copy/paste this address all works correct. Please, say me: this is correct response ...
3
votes
1answer
557 views

Is it safe to open ports 80 and 443 in a home network

The intention behind this is that I'll be able to host a website from a home server (another pc with ECC ram etc.), but what worries me is that the network I'm using is also the same network which I ...
1
vote
2answers
1k views

OSSEC, what is it telling me about port changes?

I've been diving into OSSEC for the last couple of months, but I feel unclear on one of it's alerts. I've provided the alert below. The main difference I see in previous output and current output is ...
23
votes
5answers
6k views

How to detect “forged” SSL certificates from the webserver end

The company I work for sometimes intercepts employees ssl connections to https websites by making the ssl connection on their behalf from a proxy, and then using the own generated certificate to send ...
24
votes
4answers
6k views

Can an HTTPS server accidentally leak its private key?

Are there any known cases of HTTPS websites leaking the private key of their SSL certificate? Is it even technically possible for a bad website admin to misconfigure a site to send the private key as ...
28
votes
3answers
9k views

Is it practical to pre-blacklist certain GeoIP regions?

In recent events, a server I've been managing with has been under a few attacks, a risk you take when hosting a web-server. The firewall has been set up properly to only allow connections through the ...
1
vote
3answers
522 views

How to prevent unauthorized users from accessing an image on my server just by URL?

I have a few dynamically generated images on my server (of high business value), which are supposed to be viewed only via our mobile app. The image is simply loaded from the URL as PNG. How can I ...
0
votes
1answer
584 views

NIKTO: Requires Authentication for realm ''MD5''

I am trying to perform a scanning of a web server using Nikto using: nikto -id id:pass -h xxx.xxx.xx.xxx I am specifying HTTP Basic authentication credentials and indeed with this credentials I can ...
0
votes
2answers
212 views

What are the security issues of exposing default server home page in public internet?

I have seen on internet where several website companies have exposed the default home page of web server such as Tomcat, NGNIX, Apache web server. I always believe it is not the best practice to ...
0
votes
2answers
350 views

Does HTML Purifier (which converts & to &) prevent HTTP parameter pollution?

If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint: http_get("http://example.com/api2?p=".$_GET['p']); I will be able to exploit it by ...
1
vote
2answers
179 views

What can a site visitor do with a 777 file on my web server?

Sometimes I prefer working with text files instead of database as I can later manually edit the file content. Imagine I have created a text file blacklist and chmodded it to 777. Let's say it is ...
24
votes
4answers
28k views

What website accepts only TLS 1.2 so I can verify client capability?

Is there a publicly accessible website which will only accept TLS 1.2 connections so that I can test to see if my application can successfully, securely connect to it? Background: I have an old VB....
1
vote
1answer
870 views

Host header attacks: Possible exploits

We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
3
votes
2answers
2k views

Cipher Suite TLS 1.2 - Weak in OHS

I am trying to correct weak encryption in TLS, by doing a test in SSL Labs, it throws weak encryption in the following chpher suite: Current Configuration: SSLCipherSuite HIGH:!MEDIUM:!LOW:!aNULL:!...
1
vote
0answers
44 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
0answers
38 views

Found possible malware code on site - contacted owner - what does it do? [duplicate]

Small question. I'm trying to figure out what a piece of code does that I came across on a website I visited. The website has obviously been hacked into, as there's a bunch of minified PHP code up ...
2
votes
0answers
59 views

Protecting website from content theft [duplicate]

I have a website called http://example.com. there is another website called http://example1.com it has the same content as for my website. If I upload file on my website like http://example.com/test....
0
votes
1answer
337 views

Any threats/SQL injections possible, when single-quote is being escaped?

Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url: example.com/?id=a'b the app ...
6
votes
2answers
3k views

Known security vulnerabilities in JBoss 4.x.x?

We just had a breach of one of our servers, where an intruder got access using the JBoss account and started running exploit scripts. The server has been taken offline and is being investigated, but I'...
1
vote
4answers
2k views

Attacks on server-side web

What types of attacks are specific for server-side web, but not client-side? From what I have found on the Web the most attacks focus on client-side rather than server-side.
2
votes
3answers
1k views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
6
votes
2answers
1k views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about man-...
0
votes
1answer
43 views

How to defend and attack single database on server?

Lets say I would have my own web server with MySQL database hosted together with new website. What are the techniques that I can protect it and what are called the attack that can query my db ? Is ...
6
votes
1answer
5k views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
108
votes
7answers
54k views

Is using Git for deploying a bad practice?

I tend to use Git for deploying production code to the web server. That usually means that somewhere a master Git repository is hosted somewhere accessible over ssh, and the production server serves ...
8
votes
4answers
18k views

How to identify the HTTP methods supported by a web server?

How can I identify the different HTTP methods supported by a web server, like OPTIONS, TRACE, etc.? I have tried the nc command on Linux. But it doesn't work. It doesn't show me the HTTP methods ...
2
votes
2answers
680 views

Server Side request forgery (SSRF) explanation

I am looking to gain a better understanding of the SSRF vulnerability. I have googled and watched YouTube tutorials but they all show advanced techniques that are difficult to understand. I am ...
1
vote
0answers
85 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
-1
votes
1answer
104 views

If a site has no input then can it be hackable? [closed]

If I made a website without any input box can Hackers still hack my site?
1
vote
1answer
258 views

Data on VPS is safe, or can accessed on rent VPS Virtual Server?

I rent a VPS server for two months to test a webapp. I insert data into SQL on this server and want to host web app to this virtual server for test. Can that server owner that rents a VPS to me or ...
-1
votes
1answer
723 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
3
votes
0answers
103 views

Why exactly are self hosted websites deemed that dangerous? [closed]

Up to now I'm using a raspberry pi as a local server for trying out things or hosting my own little projects (beginner level), but I want to make it publicly available (most likely only for people I ...
-1
votes
1answer
233 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
3k views

Is using enctype=“multipart/form-data” always a bad idea?

If the form doesn't have any file upload, you just use enctype="multipart/form-data" everywhere, is it a bad idea from a security point of view? Here someone says, in 2007 Uusing enctype="...
10
votes
1answer
2k views

How do I prevent users from modifying resources they do not own?

I am writing a server where I have an entity StoreOwner that "owns" or has a @OneToMany relationship to a Store entity (one store owner has 1 to N stores). Each Store has Offer and Item, each also ...
1
vote
1answer
92 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
-1
votes
1answer
322 views

Secure version of httpd package [closed]

I am using Linux xyz.co 3.10.0-514.21.1.el7.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux Tried to install latest version of httpd which is 2.4.33. But it is not available for RHEL7. That's why I ...
-3
votes
1answer
132 views

How to determine if a website uses an internal WAF? [closed]

Is there a tool to know if a website uses a firewall?
1
vote
1answer
878 views

dangers of using WAMPServer on my home PC?

Hello there I have been working on (learning) web development and have gone down the route of self hosting at the moment. I have a website which I've made, it doesnt have any user interface for input, ...

1 2
3
4 5
18