Hot answers tagged

88

Should I worried about it? Worried? No, of course not. You should be absolutely terrified and have nightmares about this. Having stolen .git directory means the attacker have the current and past source for the production server, all history of all code since the start of the repository. With that, they can reconstruct your infrastructure, and do a white ...


71

Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains hosted from one box) so that they can decide which certificate to return. Normally the target virtual host is detected via the Host HTTP header, but that can't be ...


64

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) to tell browsers to remember to only use TLS when connecting to your site in the future. There is nothing insecure about port 80 being open. Security issues ...


62

What kind of vulnerability or attack vector is prevented by the error? The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a mismatch between the target name in the TLS handshake ("provided via SNI") and the target name in the HTTP protocol ("provided via HTTP") can be exploited. ...


61

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank for sites that do not HTTPS, and adding a browser warning when a site is not secure. However, the ratio of HTTPS sites to not is still far too low to recommend ...


55

I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8: Here it is: 🐐 Note: On a whim, I also looked up the Intel opcodes corresponding to these byte values. They don't do anything interesting at all — 0x90 is NOP (does nothing), 0x9f is LAHF (load FLAGS into AH ...


42

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


42

The answer to your question comes down to threat modeling. Using cryptographic protocols like HTTPS is a security mechanism to protect against certain threats. If those threats are relevant for you, must be analyzed: Are there potential threat actors in your internal network? Based on your question you seem to assume that the internal network can be fully ...


40

The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection. An SQL injection vulnerability has been reported in Joomla Com S5clanroster. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system. https://www.checkpoint.com/...


34

This looks similar to the poetry that was being sent out at the Chaos Communications Congress in Hamburg. In particular, it starts using the HEAD as part of the poetry (the example below uses DELETE to start the line). https://nakedsecurity.sophos.com/2016/01/07/millions-of-servers-infected-with-poem-inviting-them-to-jump-in-the-river/


34

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.


32

The robots.txt does not disallow you to access directories. It tells Google and Bing not to index certain folders. If you put secret folders in there, Google and Bing will ignore them, but other malicious scanners will probably do the opposite. In effect you're giving away what you want to keep secret. To disallow folders you should set this in Apache vhost ...


29

It's all about what you're trying to achieve and/or mitigate with the use of SSL. Random people on the Internet cannot assess your company's information. So you need to keep this in mind: it all depends on the risk, the probability of the risk, and how far you would go to mitigate that risk. @apsillers brings a good point about your job application forms ...


29

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -c" to provide various features like shell redirection, pipelines or even just argument expansion when invoking processes. Apache uses exactly this (via APR, ...


28

This can provide adequate security, if configured correctly. I can think of one common flaw: with Apache and rewrite rules, it is often possible to construct an URL that points to the same file and is not redirected. For example, requesting /Config/config.php redirects, but requesting //Config//config.php does not. This is because the rewrite rule matches ...


27

There's nothing wrong with deploying from a git repo, in fact it's a pretty common practice and as you say a lot less prone to errors than copying files over ftp or rsync. Given the information you've provided I'd note the following points: Don't just pull in the latest master. Production should be deployed from a release tag. Use git flow or similar to ...


25

Your "secret files" remain secret exactly as long as their names (with full path) remain secret. You may consider the path as a kind of password. Note that the paths will leak to various places (proxy, Web server logs, history of your browser...). If the files are important and sensitive, you should just do things properly: Use SSL for upload and access to ...


21

The fact that your website might have job application forms is a sufficient reason to have SSL. In particular, users expect to enter some personal information into your website, but they don't know precisely what information. Letting an eavesdropper read the contents of a job application is bad, but it gets worse. Even if your application form doesn't have ...


18

This is a JSON Deserialize Remote Code Execution Attempt This answer will be made based on the assumption that your website was hacked. If it wasn't hacked, and these files were not loaded, then it's only a hack attempt. If you found suspicious files, you've probably been hacked. This is essentially a Remote Code Execution exploit in that loads multiple ...


18

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


17

BREACH is a vulnerability that is present when several conditions are met: HTTP compression is used, A part of the input is reflected, A static secret is present in the HTTP body of the response, The attacker can read the size of the encrypted response, The attacker can forge requests to the site under attack. Each of these conditions pose no threat in ...


17

You could drop packets from tor nodes all together if you like with ip tables. List of tor nodes can be found at: Ref 1: https://check.torproject.org/cgi-bin/TorBulkExitList.py Ref 2: https://www.dan.me.uk/tornodes Here is a bash one liner to block all traffic from tor to your web server. There are currently about 2000 tor nodes online now that support ...


17

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...


16

SSL provides several benefits not just data privacy. By presented a properly signed SSL certificate there are some assurances that the server your clients connect to actually is yours (let's assume CAs aren't being negligent). SSL provides data integrity. For every string of text, whitepaper, image, patch, whatever, the user can have some assurance that the ...


16

I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI. The methods people are advocating here are fine for small projects, but generally speaking, do not scale very well. ...which is not to say that you should not continue to do what you're doing. Just keep in mind, as your career progresses, that the ...


14

You can decode the start of $_X: root@bt:~# echo -e '...


14

Worried? Maybe. Is your source code filled with holes? Then yes. But quiet honesty, you should have been worried BEFORE your source code leaked. People have this idea that they're safe because "nobody will discover my horrible security hole because they don't know how it works!". This is a bad way to think of security. MANY security holes are ...


13

A system upgrade is required but here a quick fix. In /etc/apache2/sites-enabled/000-default I comment out: ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ <Directory "/usr/lib/cgi-bin"> AllowOverride None Options ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all </Directory> ...


12

There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this: <Files .htaccess> Order Allow,Deny Deny from all </Files> The contents of this file may tell users about your configuration, such as where passwords, certificates, and so on reside in the system, and ...


Only top voted, non community-wiki answers of a minimum length are eligible