59
votes
Accepted
What exploit are these user agents trying to use?
It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
- 3,322
30
votes
Accepted
Dealing with SSL Certificates on Products
We are installing the same self-signed certificate into every development and prototype unit.
Installing the same certificate into every unit is about the worst security practice one could imagine ...
- 1,029
23
votes
Accepted
What can I do after an attack to our system that hit our login route?
Since you have the logs I suggest that you look for usage of the login form. Did the try to login at all?
Most often this is just a scan that looks for interesting sites and stores them for later ...
- 419
22
votes
What exploit are these user agents trying to use?
It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
- 2,711
22
votes
What exploit are these user agents trying to use?
The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
- 1,738
20
votes
Current State of BREACH (GZIP SSL Attack)?
BREACH is a vulnerability that is present when several conditions are met:
HTTP compression is used,
A part of the input is reflected,
A static secret is present in the HTTP body of the response,
The ...
- 32.9k
10
votes
What can I do after an attack to our system that hit our login route?
This looks like an open HTTP proxy scan to me. The HEAD or GET request is not normally followed by http://, but only by the local path.
If your server acts as an open HTTP proxy, the attacker is ...
- 505
8
votes
Extracting openssl pre-master secret from nginx
Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf
env ...
- 181
7
votes
Accepted
HTTPS and Basic Auth
A late response, but this is a long-standing bug in Chrome. Chrome doesn't update the security indicator in the address bar before showing the basic auth dialog (though it does validate the security ...
- 86
7
votes
Why is it okay to run NGiNX or Apache Web Server as root on port 80/443 and not your app directly?
Here are a few details that might help clarify the situation:
Ports less than 1024 are (in most OSes) privileged ports that require root to run anything on them. This is intended as a security ...
- 31.5k
5
votes
HTTPS and Basic Auth
The authentication request is likely happening before the redirect. If you enter your credentials, they will likely be send in plaintext, after which you will be redirected to HTTPS.
You can easily ...
- 29.7k
5
votes
Accepted
Wordpress site hack attempt
It is actually URL-Encoding and decodes to this:
cgi-bin/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://...
- 2,074
5
votes
Accepted
What are the potential vulnerabilities of allowing a large http body size?
I'm going to go for an answer but I'm also not an expert on this particular topic, so I'll be curious to read any other answers that might come in.
I believe that the short answer is this: allowing ...
- 31.5k
5
votes
Accepted
I'm moving my website to a new server, what implications does this have for my SSL certificate?
It does not mean anything. The certificate is not bound to the server, so you can move them around as needed.
When you copy the certificates from the old to the new server, and change the DNS records ...
- 55.1k
5
votes
Is it a security risk to run master process of nginx as root?
It depends.
One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make ...
- 205k
4
votes
Accepted
Under xmlrpc attack, what is the best approach?
That happens all the time, on the first moment, identify the ip addresses that are attacking your wordpress and just block it with iptables.
On a second moment, install Fail2Ban, configure it to ...
- 346
4
votes
Nginx and HSM integration to hold private keys
I've never done this before. But here are some suggestive pointers. These points are NOT concrete steps to get it working. From the documentation for the new AWS CloudHSM (not classic) offering:
...
- 857
4
votes
Dealing with SSL Certificates on Products
Customers will be able to provide their own certificates, signed in whatever manner they wish (publicly, or privately). This will give them the chain of trust, and will allow them to be sure that they ...
- 936
4
votes
Dealing with SSL Certificates on Products
You could do something like offer up a unique certificate for
product-serial-number.product-name.company-name.com
and have it issued by something that has something trusted in the certification path....
- 226
4
votes
Accepted
Proxy not rejecting illegal host header when coming from my VM provider's network
$host will be set to $server_name if the client does not provide a Host header value in the request. You should use $http_host to access the pure Host header.
See this document for details.
- 156
4
votes
What can I do after an attack to our system that hit our login route?
What I see there are two different users, one (139.x.x.x network) presumably being a script kiddie running an exploit scanner, and the other (46.x.x.x network) being a presumably legitimate user.
...
- 5,221
4
votes
Should we enable TLS on backend connection after reverse proxy?
Connections to the backend server should be rejected when the originate from an external address, that is from some other machine outside the secure machine/subnet. This is accomplished by configuring ...
- 141
4
votes
Accepted
User authentication: In HTTP Server vs. in Web Application
The advantage of authenticating at the application is having this done independently of the OS and web server, you are not mixing your implementation layers (i.e. the application's authentication and ...
- 3,931
4
votes
Accepted
Changing $_SERVER['REMOTE_ADDR'] remotely
The $_SERVER['REMOTE_ADDR'] can be trusted. This is the source address of the TCP connection to the server, it is not taken from headers that are sent by the client as is the case with some of the ...
- 23.9k
3
votes
Accepted
XSS protection header for firefox
Firefox doesn't support the X-XSS-Protection header as you can see in this compatibility table.
If you want similar protection against reflected XSS as a Firefox user, you can use the NoScript addon. ...
- 45k
3
votes
Accepted
Nginx fallback SSL for one domain
The server has no knowledge if the client will accept a certificate or not because validation is fully done at the client and depends a lot on the clients trust anchors. The server also has no ...
- 205k
3
votes
Accepted
Nginx forwarding undesired hosts to Django
The issue was being caused by Nginx using my Django host as the default, so an "https://293.7.10.738/" request was being delegated to it. The solution was to add a default server. The default is used ...
- 3,462
3
votes
nginx - How to prevent processing requests with undefined server names with HTTPS
I used the similar method as @int_ua mentioned, but a bit tricky.
I configured my nginx to use RSA and ECDSA as TLS Authentication method, but issued a DSA certificate for the default server.
As ...
- 305
3
votes
Dealing with SSL Certificates on Products
I have been in exactly the same situation, having been responsible for developing a HTTPS server (and associated content, REST API, and so on) that is embedded within a consumer device.
As already ...
- 173
Only top scored, non community-wiki answers of a minimum length are eligible