Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
2
votes
2answers
382 views

Best guide/reference/roadmap for server penetration testing [closed]

I have been assigned to pen test some servers and have been provided the IPs of the same. In my past I have worked on application security testing projects and am aware of OWASP 10, SANS 25 etc. but ...
5
votes
2answers
2k views

Retention periods for web logs

I work for an ASP that provides banking solutions Card Services Payments ACH Online Banking And others Back Story: Our company provides an "all in one" solution or parts thereof, we are constrained ...
0
votes
1answer
110 views

Show full path of a downloadable file

On the website of the company I am working for are files, which can be downloaded. On the page, where you can download that file, you can also see the full path on the server itself of the file, e.g. /...
5
votes
2answers
3k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
18
votes
1answer
1k views

Why is the Wikileaks site still accessible? How come it hasn't been hacked? [closed]

Let me get started by saying I think Wikileaks is great, and that their work is invaluable. Background/context for this question: The recent Wikileaks data dump on the CIA. I've visited the site ...
1
vote
2answers
144 views

Why Oracle says following deserialization vulnerabilities are related to HTTP protocol?

According to Oracle website, following deserialization vulnerabilities are related to HTTP protocol. CVE-2015-7501, CVE-2016-5535, CVE-2016-3586, CVE-2016-3510, etc. But I do not understand why ...
4
votes
5answers
227 views

What is the best way to secure your web resources when you provide API as web service?

Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy ...
0
votes
2answers
119 views

VPS outbound emails security

I have an instance of VPS running with logrotate that emails me logs every day. It is a send-only SMTP server with Postfix, set up using this guide. I just need to receive the logs from this server. ...
3
votes
0answers
774 views

Do I need DNSSEC from GoDaddy?

I just registered a co.uk domain with GoDaddy. I've been managing domains for a few years now, and hosting my own website. I know a bit, but not enough to be safe with anything important like this. ...
2
votes
3answers
1k views

Danger of Path Traversal Attacks

I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him. However, I want to understand what more can be done if ...
7
votes
3answers
2k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
1
vote
0answers
847 views

Are BSD jails a “huge security liability”? [closed]

In this 2014 blog post from an apparently anti-BSD blog, the author criticizes BSD jails for being poorly designed and therefore insecure. The opening paragraph reads: If you’re thinking of ...
6
votes
1answer
218 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
2
votes
1answer
201 views

Securing connection credentials on a web server

I'm in process of creating a tiny blog platform and I've encountered a pretty controversial topic of storing connection string to a DB securely on a host. Here is a reference question: How to encrypt ...
0
votes
1answer
1k views

Securing firewalls for XAMPP on Mac OS X

I've recently installed XAMPP on my Mac OS X 10.6.8, and this has caused me to reevaluate how I have my firewall setup. Right now I am using the two firewalls that came pre-installed on my computer: ...
1
vote
1answer
1k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
1
vote
2answers
230 views

Can I detect OS and browser spoofing on webserver side?

My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server. Is there a way to detect if user is ...
2
votes
1answer
111 views

What are the security issues of having all services (web, smtp, dns) on a single machine?

I'm wondering what are the drawbacks, from a security point of view, of having more than one service (let's say the web server, the mail server and the DNS server) on the same machine, rather than ...
0
votes
1answer
322 views

Why cant I bypass user authentication by copying cookies?

I am getting confused by a website cookie authentication process. I captured the packets going from the website and saw the cookie being sent. I copied the entire cookie content of the website and ...
7
votes
3answers
375 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
1
vote
2answers
574 views

what is the security issue if session time out is the default value from server configuration?

In a web-application the session time-out is not defined neither in the application nor in the application configuration. But the default time out is taken from the IIS. what is the security issue if ...
2
votes
1answer
3k views

On company intranet yet web server picked up URL scanning-type requests?

I was running some unit tests for a web app using Karma in watch mode (so it was running a web server) and I got this output in my console between tests while the console should have been idle. 20 01 ...
-1
votes
4answers
130 views

Can SSL deployment incur performance issues [closed]

Does SSL deployment for secure server-client communication incur any performance overhead? I ask myself, why not just use HTTPS for standard web browsing when it is proven that it protects our privacy?...
4
votes
2answers
267 views

Sites that allow user-generated content

Is there a way to identify which popular sites will host arbitrary user-generated content? I am doing some analysis to detect phishing sites. It would be nice to use the popularity of a website as a ...
0
votes
2answers
571 views

Setting up communication between internal database and hosted web server by third party

I am trying to figure out the best and most secure way to do this, if it is possible to do it safe and secure. Small company. We have a hosted web server from a third party that serves our client web ...
2
votes
1answer
80 views

Does SSL communicate automatically using the most secure protocol available?

As different version of the SSL protocol can be used to communicate SSLv2, SSLv3, TLS1.0, TLS1.1, TLS1.2 with different level of security of course my question is simple : Does SSL communicate ...
-3
votes
1answer
72 views

How to keep users's files seperate from each other? [closed]

I want to create cloud storage platform that users can uploads any kind of files and download them.But I want to be sure that none will enter another people files thats why I think I need to deny ...
6
votes
3answers
391 views

Is it a security risk to give read/write permissions to /Library/WebServer/Documents to my main account?

The default setting is that the apache2 root-directory Documents is owned by root and I have to enter a password each time I change it. This is why I want to give full permissions to my user account ...
-1
votes
4answers
163 views

Is 'content validation' the golden rule to avoid all web attacks and breaches?

I'm new to web programming and am really upset about the security precautions that should be taken into account while launching a website.If I plan to read analyze and learn every security threats ...
1
vote
2answers
2k views

Directory traversal & default filesystem permissions (755) for web server

I'm trying to get a better understanding of the potential security holes my default filesystem permissions might be creating. It appears I am capable of traversing my filesystem, serving simple php ...
1
vote
2answers
67 views

Parameters to check before storing data on cloud

I want suggestions regarding the storing/securing my data on cloud. I want to upload my data on cloud, so it will be safe and can be accessible from anywhere. I have around 15 GB of data which I ...
2
votes
4answers
363 views

If Yahoo can get hacked , how can we secure our small websites? [closed]

Law enforcement provided Yahoo in November 2016 with data files that a third party claimed was Yahoo user data. We analyzed this data with the assistance of outside forensic experts and found that ...
2
votes
2answers
107 views

How to conclude from a target IP to associated URL(s)?

Given a target IP or target IP(s). Is there any reasonable way to conclude from the IP to hosted URL(s). I can scan the IP(s) with nmap and possibly conclude on which ports a webserver is running, ...
47
votes
4answers
9k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
0
votes
1answer
27 views

Split Production and “public” Webspaces

We're developing a Software, using Git and some web based organsiation software on one of our members webspace. This webspace is as far isolated, thus none could access it without knowing the address. ...
1
vote
2answers
210 views

Are there risks associated with using a free SSH server?

So basically I was looking on the Internet for free SSH server as I wanted to exercise some Linux commands and I only have Windows installed on my laptop. I saw so many Free SSH servers on the result ...
0
votes
0answers
128 views

Honeypot URL and reporting site

Is there some sort of tool list that can work with Apache/NGinx/etc that has a list of "honeypot" URLs such as /HNAP1/ that when it gets detected in the logs of the web server then it will ...
33
votes
8answers
9k views

Giving malicious crawlers and scripts a hard time

My webserver has been up for < 25 hours and has already been crawled for various default pages, just to name one /administrator/index.php. I understand that this is very common and it's not really ...
-1
votes
3answers
476 views

Can Tor Browser prevent ISP or IT Department at a Work place from knowing what i do while watching a Video online from a work computer (not mine)? [duplicate]

I must change the security settings of Tor browser to the lowest to be able to play a Video online, yet i have not tried it till now. That is why i got to think, whether it is unsafe to play online ...
3
votes
1answer
1k views

A=0 appended to web server queries

While looking through the logs for my web server, for a web site I wrote, I've noticed a lot of queries are being made twice, first as I expect then followed again within a second with 'A=0 appended ...
1
vote
1answer
278 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
0
votes
1answer
53 views

Should a webserver's access to certain directories be limited?

There was a security update to Roundcubemail today and I just patched my web/mail -server. Within the update files, there was some recommendations to restrict webserver's access to certain directories....
3
votes
1answer
299 views

Is it okay to keep .zip files in the public_html folder? [duplicate]

My company website just take copies of the public html folder and keep zip files as backup in the same folder, I want to know if this is secure or not ? Because other people don't know the name for ...
2
votes
0answers
109 views

Are there successors to httprecon [closed]

httprecon appears to be dead, the latest update per changelog is from 2009. Are there any successors?
6
votes
4answers
755 views

How to safely extract an uploaded zip?

I'm working on a project for a client where they would like their users to upload a ZIP file that can be extracted. Once extracted, we would utilise certain files in there, such as images and HTML ...
1
vote
3answers
166 views

Consequence of using SSH when Fingerprint has Changed?

I got the following error connecting to my server via ssh: The authenticity of host '[ip address]:port ([ip address]:port)' can't be established. ECDSA key fingerprint is SHA256:[...
4
votes
1answer
1k views

Configuring socat to pentest an IPv6-only remote web server from an IPv4 host

I need to pentest an IPv6-only web server situated in a remote network from my IPv4 host (Kali Linux VM). I have a 6-to-4 tunnel up between the two hosts (configured using Hurricane Electric). I'm ...
0
votes
1answer
108 views

passing user input to command line

I am using crack lib to check password strength for my web application. However, I’m concerned about whether or not my current implementation is secure. The user enters a password, which is then ...
7
votes
1answer
3k views

Flask debug=True exploitation

It's a well known fact that Flask's debug=True option can lead to remote code execution via werkzeug debugger capabilities and even several resources were hacked. I decided to look into it and it ...
1
vote
1answer
74 views

Is this generation of project URL safe?

In proceedings of my question's answer I found a way of generating a project URL regardless of project's path in Document root. If in a file in the root of the project I define the following: define(...