Hot answers tagged

87 votes
Accepted

Security implications of stolen .git/objects/ files

Should I worried about it? Worried? No, of course not. You should be absolutely terrified and have nightmares about this. Having stolen .git directory means the attacker have the current and past ...
user avatar
  • 50.3k
72 votes

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains ...
user avatar
  • 132k
64 votes
Accepted

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

What kind of vulnerability or attack vector is prevented by the error? The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a ...
user avatar
64 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
user avatar
  • 63.8k
62 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
user avatar
  • 5,724
55 votes
Accepted

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8: Here it is: 🐐 Note: On a whim, I also looked up the ...
user avatar
  • 875
44 votes
Accepted

Is HTTPS required for local network server to server communication

The answer to your question comes down to threat modeling. Using cryptographic protocols like HTTPS is a security mechanism to protect against certain threats. If those threats are relevant for you, ...
user avatar
  • 7,214
42 votes
Accepted

Is it practical to pre-blacklist certain GeoIP regions?

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in ...
user avatar
  • 27.2k
40 votes
Accepted

Received "md5" in access logs

The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection. An SQL injection vulnerability has been reported in Joomla Com S5clanroster. ...
user avatar
  • 9,975
34 votes

What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

This looks similar to the poetry that was being sent out at the Chaos Communications Congress in Hamburg. In particular, it starts using the HEAD as part of the poetry (the example below uses DELETE ...
user avatar
  • 1,297
34 votes
Accepted

Why am I receiving HTTP GETs for a domain I don't own?

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.
user avatar
  • 5,700
32 votes
Accepted

How to access directories disallowed in robots.txt?

The robots.txt does not disallow you to access directories. It tells Google and Bing not to index certain folders. If you put secret folders in there, Google and Bing will ignore them, but other ...
user avatar
  • 7,349
29 votes

How do I secure Apache against the Bash Shellshock vulnerability?

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -...
user avatar
  • 7,917
28 votes
Accepted

Is redirecting in htaccess providing enough security for sensitive pages?

This can provide adequate security, if configured correctly. I can think of one common flaw: with Apache and rewrite rules, it is often possible to construct an URL that points to the same file and ...
user avatar
  • 28.6k
25 votes
Accepted

(How) Can outsiders discover the pages that are being hosted on my server?

Your "secret files" remain secret exactly as long as their names (with full path) remain secret. You may consider the path as a kind of password. Note that the paths will leak to various places (proxy,...
user avatar
19 votes

Is using Git for deploying a bad practice?

I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI. The methods people are advocating here are fine for small projects, but generally speaking, ...
user avatar
18 votes

Current State of BREACH (GZIP SSL Attack)?

BREACH is a vulnerability that is present when several conditions are met: HTTP compression is used, A part of the input is reflected, A static secret is present in the HTTP body of the response, The ...
user avatar
  • 28.6k
18 votes
Accepted

I think my site was hacked. Can someone explain the "GET / HTTP/1.0" garbage in my Apache log, and what it's doing?

This is a JSON Deserialize Remote Code Execution Attempt This answer will be made based on the assumption that your website was hacked. If it wasn't hacked, and these files were not loaded, then it's ...
user avatar
  • 22.5k
18 votes

Is it practical to pre-blacklist certain GeoIP regions?

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, ...
user avatar
  • 289
17 votes

Stop large requests to my server (TOR)

You could drop packets from tor nodes all together if you like with ip tables. List of tor nodes can be found at: Ref 1: https://check.torproject.org/cgi-bin/TorBulkExitList.py Ref 2: https://www....
user avatar
  • 807
17 votes

Sucuri detects malware on wordpress but I can't find the malicious code

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...
user avatar
14 votes

FTP hacked, planted file

You can decode the start of $_X: root@bt:~# echo -e '...
user avatar
  • 5,700
14 votes

Security implications of stolen .git/objects/ files

Worried? Maybe. Is your source code filled with holes? Then yes. But quiet honesty, you should have been worried BEFORE your source code leaked. People have this idea that they're safe because &...
user avatar
  • 21.5k
13 votes
Accepted

Extracting openssl pre-master secret from apache2

Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export ...
user avatar
  • 5,898
12 votes
Accepted

Is it safe to email the contents of your .htaccess?

There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this: <Files .htaccess> Order Allow,Deny Deny from ...
user avatar
  • 5,724
12 votes

Apache - strange requests in logs

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec? What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
user avatar
11 votes

Escalating from Apache shell to root

You are right that you gain access to the UID of the process/script you exploited. In the case of the Apache identity with no mandatory access control and no proper separation of developer and apache ...
user avatar
11 votes
Accepted

Hack my server, please?

You're looking for a penetration tester. You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
user avatar
  • 5,486
11 votes

Is redirecting in htaccess providing enough security for sensitive pages?

The way your config.php is set up should not allow people to view the credentials even if they did have access to this file via the web browser. Consider the following config file, borrowed from this ...
user avatar
  • 211

Only top scored, non community-wiki answers of a minimum length are eligible