Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Hot answers tagged

8

It sounds like you are interested in finger printing a CMS. This can be done similar to what is done with nmap. You would need to compromise a library of unique urls, etc and than scan a page to see if they exhibit these. You can use BuiltWith.com. Here are some examples of it is use: Joomla.org being positively identified as Joomla Wordpress.org being ...


5

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


4

There is no sensitive data Are you sure your visitor are OK to share their browsing history? Are your webpages about something they might not want to share? Is it ok to have content on https and the site on http. Are there any issues with this approach? Is it recommended? If your website present the same content with http and https, you must ...


4

Is there real need of having CMS inside of the CHD (card-holder data) environment? We always recommend to keep the CHD as small as possible. Isn't it possible to design it in another way where your PCI DSS environment will just process/transfer/store the CHD and pass something as "tokens" outside (i.e. to CMS) instead of storing the CHD directly in CMS? Its ...


3

AFAIK, it does not matter what the owner of group of files is (unless they are setuid). What matters is that this is a hint that the application could be run as root which is a security threat. The rules are: the web application should be runned as a non priviledged user - in particular, that user should never be allowed to sudo! it should only have write ...


2

Security is increased through the use of multiple layers and techniques. You would be able to slow down the attacker, but as noted in the comments to your question there are still plenty of ways to attack a wordpress site - there is not a high degree of seperation between components, databases, etc in a vanilla install. Ensure the digest auth is also TLS/...


2

Yes, this adds some defense in depth, assuming the digest auth (or even Basic auth) is done by the webserver. This would require requests to be authenticated before even hitting your application, meaning an attacker would be unable to exploit any vulnerabilities that might exist in the admin login. That being said, is the security margin added by this ...


1

Many off the shelf bulletin board and similar forum software are simplistic enough to not store history of changes. However some are more complex and do. One way to positively identify ones that do (although the reverse is not true, this will not prove a negative) is to change your password to something, then try changing it back to the original. A good ...


1

While this won't protect from particularly heavy DoS attacks, you can use a VPS service that provides protection against such attacks as part of the regular package. OVH is one such company that provides attack mitigation to all their VPSes. You can either host your site on their servers directly, or run a GRE tunnel through it, giving you the DoS-resistance ...


1

In the abstract, serving multiple domains from a single codebase is far better than serving multiple domains from multiple codebases. Less code much better than more code. That said, there are reasons NOT to do this- most notably if the different domains have different risk profiles (like one is a CMS and another is ecommerce). And when doing this, it ...


1

If by "administrator" you mean the person with all the rights, then this is fine and not considered a vulnerability. If you also have a more privileged "superadministrator", then the administrator could elevate their privileges to superadministrator via XSS. There are some vulnerabilities whose impact would be increased by this. For example CSRF would now ...


1

The fact a directory or a file is owned by root don't give root privilege to people who access them. (Unless suid bit are set). Having files and directories owned by root ensure nothing won't be written by another user, unless changing permission to 777 (full permissions for everybody). The user who serve web (mostly www-data through any webserver) must not ...


1

Updates mod_security and its rules. Get help from the pros and their specific community: https://modsecurity.org/help.html While you wait for a response try some of these things. http://www.inmotionhosting.com/support/website/modsecurity/find-and-disable-specific-modsecurity-rules grep ModSecurity /usr/local/apache/logs/error_log | sed -e 's#^.*\[id "\([...


1

It would suffice to say - as for both of your case no. 1 & case. 2 to be that of input sanitisation problem. Pre-liminary to that of input sanitisation, there's input validation - this could be white listed or black-listed. The black listed approach is not preferred. Now let's narrow down to the answer, it's just not data conversion, parsing of data, ...


1

Short answer: yes. Longer answer: You should have CSRF protection EVERYWHERE where you do something which requires the permission of the current logged in user and is changing some data.


1

It's always good to have encryption over a CMS-based website. I would recommend to always use HTTPS because you never know who is intercepting traffic and what their intentions could be. For instance, if someone was intercepting your traffic and performing MITM attacks; they could respectively grab your login if they decided to and could pretty much try this ...


1

That's the old dilemma Security vs Usability, and only you can answer this question. Having the admin panel on your PC only is surely safer, but having it on the server means that you can access it even when you're not at home. And that other people can, too; unless you whitelist the access IPs, which however will also prevent you from accessing it from ...


1

After formulating a question, I've noticed solution myself. In case this might be useful for someone else: CMS_get0_type - converts CMS_ContentInfo into ASN1_object pointer OBJ_obj2nid - gets one of the following NID values from ASN1_object pointer: NID_pkcs7_data NID_pkcs7_signed NID_pkcs7_digest NID_id_smime_ct_compressedData: NID_pkcs7_encrypted ...


Only top voted, non community-wiki answers of a minimum length are eligible