Skip to main content
87 votes
Accepted

Security implications of stolen .git/objects/ files

Should I worried about it? Worried? No, of course not. You should be absolutely terrified and have nightmares about this. Having stolen .git directory means the attacker have the current and past ...
ThoriumBR's user avatar
  • 54.6k
71 votes

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains ...
Polynomial's user avatar
  • 135k
65 votes
Accepted

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

What kind of vulnerability or attack vector is prevented by the error? The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a ...
Steffen Ullrich's user avatar
63 votes

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
forest's user avatar
  • 67k
62 votes
Accepted

Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
phyrfox's user avatar
  • 5,734
47 votes
Accepted

Is HTTPS required for local network server to server communication

The answer to your question comes down to threat modeling. Using cryptographic protocols like HTTPS is a security mechanism to protect against certain threats. If those threats are relevant for you, ...
Demento's user avatar
  • 7,485
43 votes
Accepted

Is it practical to pre-blacklist certain GeoIP regions?

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in ...
Matthew's user avatar
  • 27.4k
40 votes
Accepted

Received "md5" in access logs

The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection. An SQL injection vulnerability has been reported in Joomla Com S5clanroster. ...
Mirsad's user avatar
  • 10.2k
37 votes
Accepted

Understanding suspicious HTTP GET Request

The reason it counts as "success" is because of the beginning: /?... This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
The one who tests's user avatar
28 votes
Accepted

Is redirecting in htaccess providing enough security for sensitive pages?

This can provide adequate security, if configured correctly. I can think of one common flaw: with Apache and rewrite rules, it is often possible to construct an URL that points to the same file and ...
Sjoerd's user avatar
  • 31.8k
22 votes

Is using Git for deploying a bad practice?

I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI. The methods people are advocating here are fine for small projects, but generally speaking, ...
siliconrockstar's user avatar
20 votes

Current State of BREACH (GZIP SSL Attack)?

BREACH is a vulnerability that is present when several conditions are met: HTTP compression is used, A part of the input is reflected, A static secret is present in the HTTP body of the response, The ...
Sjoerd's user avatar
  • 31.8k
19 votes

Is it practical to pre-blacklist certain GeoIP regions?

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, ...
Rogue's user avatar
  • 299
17 votes

Stop large requests to my server (TOR)

You could drop packets from tor nodes all together if you like with ip tables. List of tor nodes can be found at: Ref 1: https://check.torproject.org/cgi-bin/TorBulkExitList.py Ref 2: https://www....
Tim Jonas's user avatar
  • 827
16 votes
Accepted

Extracting openssl pre-master secret from apache2

Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export ...
Lekensteyn's user avatar
  • 6,088
14 votes

Security implications of stolen .git/objects/ files

Worried? Maybe. Is your source code filled with holes? Then yes. But quiet honesty, you should have been worried BEFORE your source code leaked. People have this idea that they're safe because &...
Steve Sether's user avatar
  • 21.6k
13 votes

Apache - strange requests in logs

I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec? What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
Steffen Ullrich's user avatar
11 votes
Accepted

Hack my server, please?

You're looking for a penetration tester. You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
S.L. Barth is on codidact.com's user avatar
11 votes

Is redirecting in htaccess providing enough security for sensitive pages?

The way your config.php is set up should not allow people to view the credentials even if they did have access to this file via the web browser. Consider the following config file, borrowed from this ...
Shadow's user avatar
  • 211
9 votes

Is it practical to pre-blacklist certain GeoIP regions?

Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice. Think of it like terrorism-- Timothy McVeigh detonates a bomb in ...
Ivan's user avatar
  • 6,338
9 votes

How likely is it that I was hacked by running a local server for development?

have always thought that when you run something as localhost, nothing ever leaves your computer and your server can't be accessed by computers in your WiFi network You accessing your services ...
ndrix's user avatar
  • 3,306
8 votes
Accepted

SSL warnings while using Origin Certificate on my VPS

CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not ...
Matt Nordhoff's user avatar
8 votes

Is HTTPS required for local network server to server communication

Mixing and matching HTTP and HTTPS is not a good idea - you will constantly be juggling configurations. Usually adding a component into a system should only be done if there is a very specific reason ...
symcbean's user avatar
  • 18.7k
8 votes

Is HTTPS required for local network server to server communication

Internal networks are not secure In general, internal networks are more secure than public-facing systems, but they should not be considered as completely secure. A significant portion of attacks ...
Peteris's user avatar
  • 8,429
6 votes

What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?

If you have a setup in which a lightweight frontend uses SNI to dispatch requests across different HTTPS servers, the extra check performed by Apache protects against invalid requests being used to ...
kasperd's user avatar
  • 5,472
6 votes
Accepted

Permissions for .htaccess file that needs to be modified by sister application?

Yes, XX7 is very bad for security, it gives read, write and execute access to all users and should be avoided unless absolutely necessary. A malicious user could use the .htaccess file to get a ...
Topher Brink's user avatar
  • 1,639
6 votes

Supporting TLS v1.0 while remaining PCI compliant

No CHD over TLS 1.0 The core requirement as explicitly listed in PCI DSS is that cardholder data (CHD) must be securely encrypted in transit, not about particular configuration of servers. TLS 1.0 is ...
Peteris's user avatar
  • 8,429

Only top scored, non community-wiki answers of a minimum length are eligible