Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Hot answers tagged

70

Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains hosted from one box) so that they can decide which certificate to return. Normally the target virtual host is detected via the Host HTTP header, but that can't be ...


63

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank for sites that do not HTTPS, and adding a browser warning when a site is not secure. However, the ratio of HTTPS sites to not is still far too low to recommend ...


61

What kind of vulnerability or attack vector is prevented by the error? The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a mismatch between the target name in the TLS handshake ("provided via SNI") and the target name in the HTTP protocol ("provided via HTTP") can be exploited. ...


60

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) to tell browsers to remember to only use TLS when connecting to your site in the future. There is nothing insecure about port 80 being open. Security issues ...


55

I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8: Here it is: 🐐 Note: On a whim, I also looked up the Intel opcodes corresponding to these byte values. They don't do anything interesting at all — 0x90 is NOP (does nothing), 0x9f is LAHF (load FLAGS into AH ...


51

Simplest way I can think of is using cURL (which is scriptable). curl -v -X TRACE http://www.yourserver.com Running it against an Apache server with TraceEnable Off correctly returns HTTP/1.1 405 Method Not Allowed (just tested on an Apache 2.2.22) This also works on HTTPS sites, provided that cURL has the correct information supplied to the SSL layer. ...


44

I personally think you're doing alright. As long as your underlying login method is secure, add as many obscurity layers as you want. I have worked with some clients that wanted the exact thing you're trying to achieve. I've always used one of these two methods: Cross-Site login form: A local .html file that has a login form submitting to the example.com/...


43

It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in that country, and that, whilst really unlikely, it's theoretically possible for IP assignments to change, meaning that if you didn't keep these blocks maintained ...


41

The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection. An SQL injection vulnerability has been reported in Joomla Com S5clanroster. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system. https://www.checkpoint.com/...


34

This looks similar to the poetry that was being sent out at the Chaos Communications Congress in Hamburg. In particular, it starts using the HEAD as part of the poetry (the example below uses DELETE to start the line). https://nakedsecurity.sophos.com/2016/01/07/millions-of-servers-infected-with-poem-inviting-them-to-jump-in-the-river/


32

The robots.txt does not disallow you to access directories. It tells Google and Bing not to index certain folders. If you put secret folders in there, Google and Bing will ignore them, but other malicious scanners will probably do the opposite. In effect you're giving away what you want to keep secret. To disallow folders you should set this in Apache vhost ...


32

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.


29

It's all about what you're trying to achieve and/or mitigate with the use of SSL. Random people on the Internet cannot assess your company's information. So you need to keep this in mind: it all depends on the risk, the probability of the risk, and how far you would go to mitigate that risk. @apsillers brings a good point about your job application forms ...


28

Aside from CGI, one overlooked use of sh is in exec() calls, or through the use of system() and popen(), on most Linux systems this means bash. The exec() family of calls are often used with "/bin/sh -c" to provide various features like shell redirection, pipelines or even just argument expansion when invoking processes. Apache uses exactly this (via APR, ...


28

This can provide adequate security, if configured correctly. I can think of one common flaw: with Apache and rewrite rules, it is often possible to construct an URL that points to the same file and is not redirected. For example, requesting /Config/config.php redirects, but requesting //Config//config.php does not. This is because the rewrite rule matches ...


26

There's nothing wrong with deploying from a git repo, in fact it's a pretty common practice and as you say a lot less prone to errors than copying files over ftp or rsync. Given the information you've provided I'd note the following points: Don't just pull in the latest master. Production should be deployed from a release tag. Use git flow or similar to ...


25

As Thomas pointed out, this attack is designed to exploit poor content handling in log utilities. There are many "log to HTML" engines that simply extract the text of the logs and place them blindly into a HTML template. When the user requests the HTML page from the server, the <?php tags are parsed by the PHP engine and the code is executed. Since many ...


25

Your "secret files" remain secret exactly as long as their names (with full path) remain secret. You may consider the path as a kind of password. Note that the paths will leak to various places (proxy, Web server logs, history of your browser...). If the files are important and sensitive, you should just do things properly: Use SSL for upload and access to ...


22

Yes, strict transport security provides a real benefit. HSTS tells the browser to only communicate with the server via HTTPS. The first time the browser sees the HSTS header from the server, it remembers it. When the user visits the site again, the browser enforces that all communication is done via HTTPS. This will work as long as the attacker doesn't ...


21

The fact that your website might have job application forms is a sufficient reason to have SSL. In particular, users expect to enter some personal information into your website, but they don't know precisely what information. Letting an eavesdropper read the contents of a job application is bad, but it gets worse. Even if your application form doesn't have ...


19

Apache and MySQL can be configured so that they only listen to requests from your own computer. For most test systems this is fine and it greatly reduces the risk because the services are not reachable from the Internet. Before you start XAMPP for the first time find and edit these files: For Apache edit the files xampp\apache\conf\httpd.conf and xampp\...


18

This is a JSON Deserialize Remote Code Execution Attempt This answer will be made based on the assumption that your website was hacked. If it wasn't hacked, and these files were not loaded, then it's only a hack attempt. If you found suspicious files, you've probably been hacked. This is essentially a Remote Code Execution exploit in that loads multiple ...


17

Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why: Many people use VPNs or anonymizing networks such as TOR, meaning valid users may appear to have an IP from a country you don't consider to be part of your target audience. Users of such networks may not use your ...


17

You could drop packets from tor nodes all together if you like with ip tables. List of tor nodes can be found at: Ref 1: https://check.torproject.org/cgi-bin/TorBulkExitList.py Ref 2: https://www.dan.me.uk/tornodes Here is a bash one liner to block all traffic from tor to your web server. There are currently about 2000 tor nodes online now that support ...


16

There are a couple of things you can do to prevent DOS/DDOS. First I would recommend using an autoban firewall. I've been using Fail2Ban for some time now. Most of my problems with DDOS/DOS attacks to SSH,FTP,BIND and etc were solved. What fail2ban actually does is it's scanning a log file and when a regex pattern matches X times it bans the person. With a ...


16

SSL provides several benefits not just data privacy. By presented a properly signed SSL certificate there are some assurances that the server your clients connect to actually is yours (let's assume CAs aren't being negligent). SSL provides data integrity. For every string of text, whitepaper, image, patch, whatever, the user can have some assurance that the ...


15

One way to mitigate BEAST is to do nothing. It so happens that though the vulnerability used in BEAST is still there, exploiting it is rather difficult. It requires the ability to do cross-domain requests, with a high level of control on the data which is sent in the request; in particular, it needs "binary" data. Duong and Rizzo did not find a way to map ...


15

Yes, if you are using SSL sitewide, then I definitely recommend enabling HSTS. HSTS is an important security measure to defeat man-in-the-middle attacks that shift the user over to http and then attack the user. For instance, sslstrip is a well-known tool to mount such an attack. For more details on this sort of attack, see the following questions: How to ...


15

Your method is functionally equivalent to requiring authentication with two passwords, the Referer being one of them. A more common variant is to use a secret URL, i.e. to make the "special string" part of the path to the private site. Including the secret string in the URL may include some extra details to think about (e.g. users can bookmark it, meaning ...


Only top voted, non community-wiki answers of a minimum length are eligible