Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Hot answers tagged

63

Google, the major search engine of the Internet (dwarfing both Bing and Yahoo), and the browser used by majority of Internet users, has been pushing for an HTTPS-only world by decreasing the page rank for sites that do not HTTPS, and adding a browser warning when a site is not secure. However, the ratio of HTTPS sites to not is still far too low to recommend ...


60

You should not close off port 80. Instead, you should configure your server to redirect HTTP port 80 to HTTPS port 443 in order to use TLS. You can optionally use HSTS (HTTP Strict Transport Security) to tell browsers to remember to only use TLS when connecting to your site in the future. There is nothing insecure about port 80 being open. Security issues ...


15

The malware in question is hosted elsewhere, and is (probably) being added by cross-site-scripting (XSS). If you have a look at the "var src" part, you'll see a long string of Base64-encoded text: ...


5

In short: USUALLY, keep it open and use it to redirect everything to HTTPS. Now onto the complicated stuff: taking away port 80 can stop cookie-thieves that passively look for straggle http://corp.com/some/forgotten/thing requests. The TCP connection does not succeed, the browser does not send the GET and cookies, and the bad guy cannot read them. ...


4

In addition to the other forest and phyrfox's answers, ACME http-01 verification uses port 80 to reach your servers. If you close the port, you won't be able to renew or create certificates.


3

How do i know that 2ubuntu3.9 has the latest security patches This is not a simple. Not all vulnerabilities listed on the Apache security page are relevant for the version shipped with Ubuntu. Ubuntu ships version 2.4.18 with backported patches they consider relevant. The starting point to look what is fixed would be the Changelog and compare it with the ...


3

Apache om Debian 9 (Stretch) uses OpenSSL 1.0.2 (see apache2-bin dependency on libssl1.0), so you can use the approaches documented in that linked post. You can modify the startup script to export LD_PRELOAD=/path/to/libsslkeylog.so and SSLKEYLOGFILE=/tmp/your.keys. How to do so is dependent on the application. For systemd you could try systemctl edit ...


3

At least historically, the HSTS Preload site required that HTTP requests must redirect to HTTPS before doing anything else. As such, the order given in your second block is correct. In particular, the redirect to HTTPS must occur before any other redirects (such as to a www. subdomain, or expanding a shortened URL to its full form). Sending HSTS headers in ...


3

That is just normal background traffic. All domains are crawled all the time in order to find common vulnerabilities: Unsecured or default passworded admin areas (like the wp-admins.php in your listing) Files containing credentials (config.php) Files or directories that are publicly available but not linked on the page (resulting in some people thinking ...


2

At the time I am answering this, this question is 2 years old, so my answer might include things that have changed from the time this was posted. Ill answer the second question first: credentials.properties -> clear text passwords credentials-enc.properties -> Encrypted passwords, if configured groups.properties -> a list of groups, ...


2

What you are seeing is (90% confidence) the server's certificate's chain of trust, which only contains public keys. At the very least (99% confidence if what you've told us is true), it certainly doesn't contain the server's TLS private key; it might contain something like the ephemeral Diffie-Hellman key exchange parameters or the TLS session key that your ...


2

There is benefit to using a full-cycle platform that allows SIEM Engineering (e.g., Splunk ES) and Security Automation (e.g., Splunk Phantom), but these can also be performed using open-source platforms (e.g., HELK for SIEM engineering and Rundeck for Security Automation). There are many benefits to ATT&CK detection, which may be platform-dependent. For ...


2

Nuke it from orbit! An attacker compromised your server. It's no longer your server. re-Install the OS, fix the vulnerability in your application and then re-deploy


2

It's completely normal that a site is only available with the domain, and it's vital for shared hosting: before the Host: header was added in HTTP 1.1 (RFC 2068, 14.23 from 1997, updated in RFC 7230, 5.4) every site required an own IP address, and before SNI (RFC 6066, 3) it was pretty much the same with HTTPS. This same Host: header could be used in your ...


2

Validation / sanitizing is done on server only. In your example there is no server side code. If your client loads files that should be available to everyone without any restriction, then there is no need on server to check anything. I.e. you don't have to do anything on the server. "anyone could just make the simple call anyways" - this is wrong statement. ...


2

I think that by including it in the webroot, you may leave yourself vulnerable to some bypass if you do not write the .htaccess correctly. If you keep important files outside the webroot in a directory such as /opt or /etc/web_program_folder/data, there's no way they will be able to access that data without a local file inclusion vulnerability as apache or ...


2

There are tools like Fail2Ban that temporarily restrict access from IPs that have tried for non-existing files in a short time range too often (it is configurable what "too often" means exactly). This will reduce the scanning traffic on your site, but as @fleitner already wrote, you cannot exclude it completely.


2

I figured out the issue. The problem was not with the CA key, it was with the private key. Once i remade the private key using this: keytool -genkey -alias gis.akrf.com -keyalg RSA -keystore "C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\Keystore\keystore" -ext SAN=dns:(your dns here, like some.domain.com or localhost, which should also ...


2

Let people store anything they want, rename the file to something random (SHA1 of random long number is enough), move them off the server root, and record the new name and original name on a database, taking care of sanitizing the filename. List files using the original names on the filename (again take care with sanitization), and use PHP fpassthru or ...


1

To be clear, the CA (or its delegate) must support (plain) OCSP, but the server must support stapling, either single or multi (aka v2). From http://httpd.apache.org/docs/2.4/mod/mod_ssl.html at SSLUseStapling, with emphasis added: This option enables OCSP stapling, as defined by the "Certificate Status Request" TLS extension specified in RFC 6066. If ...


1

I would not consider it XSS vulnerability, as SOAP services are usually called by another service that would not execute anything in the response. However you could address it by validating the namespace and throwing a more generic error without including any contents from the payload. Trying to encode it differently is just creating a moving target and ...


1

You probably want this: REQUEST_HEADERS:X-Forwarded-For To me, it seems that X-Forwarded-For is not an environment variable, but a request header. In some environments, each header is automatically converted to an environment variable, in the form HTTP_X_FORWARDED_FOR. However, it seems that in ModSecurity you can simply retrieve the request header.


1

How does someone prevent client browsers from revealing these certificates? Remember that most browsers are more or less open source. Chrome is based on chromium, which is open source. Firefox is open source. Lots of other as well. In addition, the browsers communicate with the server over an open, well-documented and inspectable protocol. Hiding something ...


1

Yes, it is possible as long as you are connected to the internet, check your network configuration that could possibly expose the machine you're using which has WAMP installed. Let's say for example your router is configured to port forward all ports to the IP of your machine and you also have a vulnerable version of WordPress installed inside your WAMP, ...


1

If you do not have CSRF protection in place, you can gather from the logs that a page has been spontaneously accessed, without going though an expected set of pages (each of them bringing in its CSRF token). Unfortunately if your site is being scanned and walked though, this out-of-band approach will not work easily, and in that case the volume of queries ...


1

One option is to look at launchpad under Bugs->CVE https://bugs.launchpad.net/ubuntu/+source/apache2/+bugs?field.has_cve=on These are the bugs we know that affect that version of Apache the way it was built by Canonical. But as Steffen Ulrich has detailed in his answer above there is a balance of issues with code, deployment and then software on running ...


1

As @WhiteWinterWolf mentioned, Pepoluan answered over here on ServerFault: The COOK verb appears to be synonymous with the User-Agent string containing "Synapse". The term Synapse is a free TCP/IP library written in Pascal (see here: http://wiki.freepascal.org/Synapse#From_an_HTTP_server) that is used to create bots, scrapers and crawlers as well as other ...


Only top voted, non community-wiki answers of a minimum length are eligible