87
votes
Accepted
Security implications of stolen .git/objects/ files
Should I worried about it?
Worried? No, of course not.
You should be absolutely terrified and have nightmares about this.
Having stolen .git directory means the attacker have the current and past ...
- 53.6k
72
votes
What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?
Server Name Indication (SNI) is a TLS extension which allows a TLS client to indicate which host it is trying to reach. This is important for web servers with virtual hosts (i.e. multiple domains ...
- 135k
66
votes
Accepted
What kind of attack is prevented by Apache2's error code AH02032 ("Hostname provided via SNI and hostname provided via HTTP are different")?
What kind of vulnerability or attack vector is prevented by the error?
The attack is called "virtual host confusion" and in 2014 several CDN were found vulnerable against it. The main idea is that a ...
- 198k
64
votes
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) ...
- 66.5k
63
votes
Accepted
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank ...
- 5,734
55
votes
Accepted
What was the aim of this invalid HTTP request that tells a story about goats in the request URI?
I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8:
Here it is: 🐐
Note: On a whim, I also looked up the ...
- 875
47
votes
Accepted
Is HTTPS required for local network server to server communication
The answer to your question comes down to threat modeling. Using cryptographic protocols like HTTPS is a security mechanism to protect against certain threats. If those threats are relevant for you, ...
- 7,429
42
votes
Accepted
Is it practical to pre-blacklist certain GeoIP regions?
It's essentially a business decision, rather than a security one. The risks from a business perspective are that you lose users from that country, or who are accessing the site from VPNs located in ...
- 27.4k
40
votes
Accepted
Received "md5" in access logs
The attacker is trying to exploit Joomla component called com_s5clanroster which is vulnerable to SQL Injection.
An SQL injection vulnerability has been reported in Joomla Com
S5clanroster. ...
- 10.2k
37
votes
Accepted
Understanding suspicious HTTP GET Request
The reason it counts as "success" is because of the beginning:
/?...
This means the path the server cares about is /, which likely maps to the index of your web application. The query ...
34
votes
What was the aim of this invalid HTTP request that tells a story about goats in the request URI?
This looks similar to the poetry that was being sent out at the Chaos Communications Congress in Hamburg. In particular, it starts using the HEAD as part of the poetry (the example below uses DELETE ...
- 1,297
34
votes
Accepted
Why am I receiving HTTP GETs for a domain I don't own?
Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.
- 5,959
28
votes
Accepted
Is redirecting in htaccess providing enough security for sensitive pages?
This can provide adequate security, if configured correctly.
I can think of one common flaw: with Apache and rewrite rules, it is often possible to construct an URL that points to the same file and ...
- 29.6k
21
votes
Is using Git for deploying a bad practice?
I'm going to disagree with popular opinion here. Git is for version control, it is not for deployment/CI.
The methods people are advocating here are fine for small projects, but generally speaking, ...
- 319
19
votes
Current State of BREACH (GZIP SSL Attack)?
BREACH is a vulnerability that is present when several conditions are met:
HTTP compression is used,
A part of the input is reflected,
A static secret is present in the HTTP body of the response,
The ...
- 29.6k
18
votes
Accepted
I think my site was hacked. Can someone explain the "GET / HTTP/1.0" garbage in my Apache log, and what it's doing?
This is a JSON Deserialize Remote Code Execution Attempt
This answer will be made based on the assumption that your website was hacked. If it wasn't hacked, and these files were not loaded, then it's ...
- 22.6k
18
votes
Is it practical to pre-blacklist certain GeoIP regions?
Banning ranges of IPs is generally not a good idea. You should only do this if a range is consistently a big problem for you. Here's why:
Many people use VPNs or anonymizing networks such as TOR, ...
- 289
17
votes
Stop large requests to my server (TOR)
You could drop packets from tor nodes all together if you like with ip tables.
List of tor nodes can be found at:
Ref 1: https://check.torproject.org/cgi-bin/TorBulkExitList.py
Ref 2: https://www....
- 817
17
votes
Sucuri detects malware on wordpress but I can't find the malicious code
The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text:
...
- 1,789
16
votes
Accepted
Extracting openssl pre-master secret from apache2
Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export ...
- 6,078
14
votes
Security implications of stolen .git/objects/ files
Worried? Maybe. Is your source code filled with holes? Then yes. But quiet honesty, you should have been worried BEFORE your source code leaked.
People have this idea that they're safe because &...
- 21.6k
13
votes
Apache - strange requests in logs
I'm concerned especially about first request from this host - what may this be, some function coded in hex or dec?
What you see in \x16\x03\x01\x01... is just the start of a TLS 1.0 handshake, i.e. ...
- 198k
12
votes
Accepted
Is it safe to email the contents of your .htaccess?
There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this:
<Files .htaccess>
Order Allow,Deny
Deny from ...
- 5,734
11
votes
Accepted
Hack my server, please?
You're looking for a penetration tester.
You could also invite people on the net to try and hack your server, but that's a very risky business - you never know who's going after it. Telling the ...
11
votes
Is redirecting in htaccess providing enough security for sensitive pages?
The way your config.php is set up should not allow people to view the credentials even if they did have access to this file via the web browser.
Consider the following config file, borrowed from this ...
- 211
9
votes
How likely is it that I was hacked by running a local server for development?
have always thought that when you run something as localhost, nothing
ever leaves your computer and your server can't be accessed by
computers in your WiFi network
You accessing your services ...
- 3,286
8
votes
Is it practical to pre-blacklist certain GeoIP regions?
Don't waste your time trying to maintain GeoIP blacklists. It's a kneejerk response, and is shortsighted and ineffective in practice.
Think of it like terrorism-- Timothy McVeigh detonates a bomb in ...
- 6,338
8
votes
Accepted
SSL warnings while using Origin Certificate on my VPS
CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not ...
- 3,498
Only top scored, non community-wiki answers of a minimum length are eligible