Hot answers tagged

61 votes
Accepted

What exploit are these user agents trying to use?

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
Dan Landberg's user avatar
  • 3,322
30 votes
Accepted

Dealing with SSL Certificates on Products

We are installing the same self-signed certificate into every development and prototype unit. Installing the same certificate into every unit is about the worst security practice one could imagine ...
Kirill Sinitski's user avatar
24 votes
Accepted

What can I do after an attack to our system that hit our login route?

Since you have the logs I suggest that you look for usage of the login form. Did the try to login at all? Most often this is just a scan that looks for interesting sites and stores them for later ...
Peter's user avatar
  • 429
22 votes

What exploit are these user agents trying to use?

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
DarkMatter's user avatar
  • 2,691
22 votes

What exploit are these user agents trying to use?

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
Dai's user avatar
  • 1,736
20 votes

Current State of BREACH (GZIP SSL Attack)?

BREACH is a vulnerability that is present when several conditions are met: HTTP compression is used, A part of the input is reflected, A static secret is present in the HTTP body of the response, The ...
Sjoerd's user avatar
  • 30.4k
15 votes
Accepted

nginx - How to prevent processing requests with undefined server names with HTTPS

I've solved it by generating a fake certificate that doesn't reveal domain name and adding it as a default one on the start of the config: server { listen 443 default; server_name _; ...
int_ua's user avatar
  • 266
13 votes
Accepted

Make nginx drop requests to timeout client on purpose

Make nginx drop requests to timeout client on purpose It is not possible to drop HTTP requests to hide the server, no matter if using nginx or another server. The HTTP request will only be sent after ...
Steffen Ullrich's user avatar
12 votes
Accepted

Regenerating dhparam periodically

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? No, not significantly. DH parameters are really just a large ...
SEJPM's user avatar
  • 9,750
11 votes

What can I do after an attack to our system that hit our login route?

This looks like an open HTTP proxy scan to me. The HEAD or GET request is not normally followed by http://, but only by the local path. If your server acts as an open HTTP proxy, the attacker is ...
Calimo's user avatar
  • 475
7 votes
Accepted

HTTPS and Basic Auth

A late response, but this is a long-standing bug in Chrome. Chrome doesn't update the security indicator in the address bar before showing the basic auth dialog (though it does validate the security ...
Gavin's user avatar
  • 86
7 votes

Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?

Here are a few details that might help clarify the situation: Ports less than 1024 are (in most OSes) privileged ports that require root to run anything on them. This is intended as a security ...
Conor Mancone's user avatar
7 votes

Extracting openssl pre-master secret from nginx

Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf env ...
user2586441's user avatar
5 votes
Accepted

Was my phpMyAdmin hacked?

Those log entries look like normal scanning activity. You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you ...
tim's user avatar
  • 29.6k
5 votes

Is it a good practice to forbid IP access to port 80?

I see some sites have blocked there port 80 (or 443) to be accessed by IP. My guess is that you mean that access to http://hostname works while http://ip-adress/ does not work. At the TCP level the ...
Steffen Ullrich's user avatar
5 votes

Nginx: How to block IP by hostname regex

First off, let me start with an important fact: Regex on reverse IP lookups is a bad idea for blocking incoming requests. Reverse DNS is an informational function. Unlike DNS where it is critical for ...
wireghoul's user avatar
  • 5,959
5 votes

Transparent pixel in nginx error log...Is this hacking?

Someone sent a request asking your server to fetch that image from Amazon, and your server interpreted it as a local file which it then failed to find (which is a good thing). They were probing for ...
Dont's user avatar
  • 51
5 votes

HTTPS and Basic Auth

The authentication request is likely happening before the redirect. If you enter your credentials, they will likely be send in plaintext, after which you will be redirected to HTTPS. You can easily ...
tim's user avatar
  • 29.6k
5 votes
Accepted

Wordpress site hack attempt

It is actually URL-Encoding and decodes to this: cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://...
Ben's user avatar
  • 2,054
5 votes
Accepted

What are the potential vulnerabilities of allowing a large http body size?

I'm going to go for an answer but I'm also not an expert on this particular topic, so I'll be curious to read any other answers that might come in. I believe that the short answer is this: allowing ...
Conor Mancone's user avatar
5 votes

Is it a security risk to run master process of nginx as root?

It depends. One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make ...
Steffen Ullrich's user avatar
4 votes
Accepted

Under xmlrpc attack, what is the best approach?

That happens all the time, on the first moment, identify the ip addresses that are attacking your wordpress and just block it with iptables. On a second moment, install Fail2Ban, configure it to ...
OPSXCQ's user avatar
  • 346
4 votes

What does an unquoted shell variable allow?

In general, $DEFAULT_BRANCH (with no surrounding quotes) is the “split+glob” operator. What it does is: Take the value of the variable DEFAULT_BRANCH (or the empty string if the variable is unset). ...
Gilles 'SO- stop being evil''s user avatar
4 votes

Nginx and HSM integration to hold private keys

I've never done this before. But here are some suggestive pointers. These points are NOT concrete steps to get it working. From the documentation for the new AWS CloudHSM (not classic) offering: ...
eternaltyro's user avatar
4 votes

Dealing with SSL Certificates on Products

Customers will be able to provide their own certificates, signed in whatever manner they wish (publicly, or privately). This will give them the chain of trust, and will allow them to be sure that they ...
Kevin's user avatar
  • 936
4 votes

Dealing with SSL Certificates on Products

You could do something like offer up a unique certificate for product-serial-number.product-name.company-name.com and have it issued by something that has something trusted in the certification path....
David A's user avatar
  • 201
4 votes

What can I do after an attack to our system that hit our login route?

What I see there are two different users, one (139.x.x.x network) presumably being a script kiddie running an exploit scanner, and the other (46.x.x.x network) being a presumably legitimate user. ...
Damon's user avatar
  • 5,211
4 votes

Should we enable TLS on backend connection after reverse proxy?

Connections to the backend server should be rejected when the originate from an external address, that is from some other machine outside the secure machine/subnet. This is accomplished by configuring ...
snibbets's user avatar
  • 141
4 votes
Accepted

I'm moving my website to a new server, what implications does this have for my SSL certificate?

It does not mean anything. The certificate is not bound to the server, so you can move them around as needed. When you copy the certificates from the old to the new server, and change the DNS records ...
ThoriumBR's user avatar
  • 53.9k

Only top scored, non community-wiki answers of a minimum length are eligible