Hot answers tagged

60

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you specifically. The payload itself just appears to just be testing to see if the server is vulnerable to command injection. It does not appear to have any additional ...


32

Every server that is connected to the Internet will receive hundreds of "weird requests". Most of them are from automatic botnets which try to replicate, by finding machines which feature a specific vulnerability. They try random IP addresses (there are only four billions of possible IP addresses, after all). So yes, someone is trying to enter into your ...


30

We are installing the same self-signed certificate into every development and prototype unit. Installing the same certificate into every unit is about the worst security practice one could imagine when dealing with certificates. We now know not to release products with the default hard coded administrative credentials. We avoid default credentials because ...


27

First, let's go over how cipher suite negotiation works, very briefly. For example, we can use the TLS 1.2 document RFC 5246 starting at section 7.4.1.2 to see, in the short short form: ClientHello: The client tells the server which cipher suites the client supports Now the server picks one I'll discuss how to control which one it picks next! ServerHello:...


23

Since you have the logs I suggest that you look for usage of the login form. Did the try to login at all? Most often this is just a scan that looks for interesting sites and stores them for later use. This behaviour is extremely common and is common place in almost every http log with a internet facing web service. First of all you should look at the ...


22

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to see.


22

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and other scripting languages' equivalents). I note that the executable code appears immediately after the first version parameter after Mozilla/. This means the ...


14

These are scans for proxy servers. The first one tests for a SOCKS4 proxy, the second one for a SOCKS5 proxy, and the third one tests if your server allows forwarding via a CONNECT request to "valuable" ports (SMTP in this case). You don't have to be worried about that, it's what you expect to see on public servers. Your server answers with return code of ...


14

BREACH is a vulnerability that is present when several conditions are met: HTTP compression is used, A part of the input is reflected, A static secret is present in the HTTP body of the response, The attacker can read the size of the encrypted response, The attacker can forge requests to the site under attack. Each of these conditions pose no threat in ...


12

I haven't tested this myself, but reading Nginx's source code, it seems to use libc's crypt() function directly. Depending on your OS, you may have a sane crypt() implementation available, either bcrypt or glibc's SHA-256/SHA-512 scheme. It's worth a shot to see if you can use it with Nginx.


11

if you want to block known scanners you might want to use nginx-based WAF naxsi + doxi-rules; these scanners are widely known


11

I've solved it by generating a fake certificate that doesn't reveal domain name and adding it as a default one on the start of the config: server { listen 443 default; server_name _; ssl on; ssl_certificate /path/to/fake.crt; ssl_certificate_key /path/to/fake.key; return 403; } And yes, it requires a nginx with ...


10

According to nginx documentation the ssl_trusted_certificate parameter contains trusted CA certificates used to verify client certificates and OCSP responses if ssl_stapling is enabled and the list of these certificates will not be sent to clients. Therefore I think that what ssllabs calls "Additional Certificates (if supplied)" are the certificates in the ...


10

Does it increase connection security if I regenerate the dhparam files used with NGINX on our servers periodically e.g. every week? No, not significantly. DH parameters are really just a large prime that takes a lot of time to be generated (because it needs to be a safe prime). Additionally there's a so-called "generator", but this one is cheap to ...


9

Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to access the site, regardless of the domain name used. This is true with both Apache and nginx. From the Apache Wiki: As a rule, it is impossible to host ...


9

Make nginx drop requests to timeout client on purpose It is not possible to drop HTTP requests to hide the server, no matter if using nginx or another server. The HTTP request will only be sent after establishing the TCP connection. This connection can then only be closed with or without a response. You could also keep it open so that the browser times out ...


9

This looks like an open HTTP proxy scan to me. The HEAD or GET request is not normally followed by http://, but only by the local path. If your server acts as an open HTTP proxy, the attacker is trying to hide behind it and you should close it. This will get your server blacklisted pretty soon. Make sure your server is not acting as an open proxy, then ...


8

Mozilla has an online tool that will help you choose the correct cipher suite. https://mozilla.github.io/server-side-tls/ssl-config-generator/ It will let you input your server version, software version, etc. and then choose between a balance of security and legacy support.


7

The linked solution allows jenkins to run any command via sudo without a password. A better solution is to allow jenkins to restart nginx without a password, but nothing else. This way you have root permission for the command you need to execute, but you're not granting blanket permission for jenkins to do anything and everything. Use visudo to stick this ...


7

This is an known attack, Shellshock. On servers with a vulnerable bash shell, the attacker can exploit an condition that executes shell commands by sending a special crafted URL. Basically, the attacker is scanning your server to see if it is vulnerable to it. If your server was found to be vulnerable, probably you would see a few wget/curl being sent in ...


7

A late response, but this is a long-standing bug in Chrome. Chrome doesn't update the security indicator in the address bar before showing the basic auth dialog (though it does validate the security correctly, so an expired certificate is correctly marked). https://bugs.chromium.org/p/chromium/issues/detail?id=700748 https://bugs.chromium.org/p/chromium/...


7

Here are a few details that might help clarify the situation: Ports less than 1024 are (in most OSes) privileged ports that require root to run anything on them. This is intended as a security feature to make it more difficult for an attacker to host services on important ports on a compromised server. As a result, root is required to run anything on port ...


5

If I understand you want to deny HTTP-Requests, which don't contain a Host header, even if these requests are inside a SSL connection (e.g. https-Requests). These are old-style HTTP/1.0 requests, HTTP/1.1 requires a Host header but also most HTTP/1.0 clients already send one. Blocking these clients can be done with: if ( $http_host = '' ) { ...


5

I would also recommend using: ngx_http_limit_req_module to limit RPS, and fallback to 503 on burst cap hit optionally. It does very well with exploited zombie browsers DDoS; agressive caching for anonymous users (with next bullet applied maybe) and for target location (in case it is not random) to eliminate FastCGI passes; use power of LUA module and bash-...


5

(Much of this is based on my answer here) There are techniques, such as memory guard pages and wiping of deallocated memory, that should have stopped Heartbleed or a similar attack in the future. OpenBSD, for example, uses them by default. Heartbleed was made worse because it uses its own memory allocator that actively works to defeat memory protection. ...


5

It is as secure as the machine - which is probably to say "not very". But I don't believe the issue stems from doing just HTTP internally, that is fine. The problem comes from having a single, internet-facing machine that does everything. So if you are happy with the security of the machine then you are fine. Any attacker would need to be able to run a ...


5

Those log entries look like normal scanning activity. You can also notice that the scanner did not target your setup specifically, because multiple versions and directories are tried. And as you said, none of those actually exist in your setup. What I don't understand is, why does he use // rather than / That's likely a bug in their scanning software (...


5

I see some sites have blocked there port 80 (or 443) to be accessed by IP. My guess is that you mean that access to http://hostname works while http://ip-adress/ does not work. At the TCP level the host is still accessed by IP address but the HTTP request looks different because the name given in the URL is contained in the HTTP request, e.g. GET /some-...


Only top voted, non community-wiki answers of a minimum length are eligible