Hot answers tagged

60

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you specifically. The payload itself just appears to just be testing to see if the server is vulnerable to command injection. It does not appear to have any additional ...


22

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to see.


22

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and other scripting languages' equivalents). I note that the executable code appears immediately after the first version parameter after Mozilla/. This means the ...


7

Here are a few details that might help clarify the situation: Ports less than 1024 are (in most OSes) privileged ports that require root to run anything on them. This is intended as a security feature to make it more difficult for an attacker to host services on important ports on a compromised server. As a result, root is required to run anything on port ...


4

Please don't make up your own configuration and ask if it is secure for some unknown purpose and unknown security requirements but instead follow established recommendations. If you feel that it is better to create your own config please don't just dump the config. Instead explain why do you think the specific configuration options make sense in your (...


3

This is not strictly an Nginx problem, but rather is an issue with old versions of PHP. It has been fixed for quite a long while (I'm not sure exactly what version, but it certainly isn't a concern with PHP 7.0). The answers to this question: https://serverfault.com/q/627903/377662 Explain the underlying issue and solution in detail. The short answer is ...


3

HTTP status code 444 is simply an internal response that indicates NGINX has closed the connection without response. This is a non-standard code and is not sent to the requesting client. Often, 403 Forbidden is the equivalent used in Apache. To generate an error in response to DoS or other attacks, you will need a script on either NGINX or Apache that ...


2

Even now it seems to carry danger because of how PHP is still processing script from the 1st occurence of found file. So why did they keep the default as ;cgi.fix_pathinfo=1 then? Because CGI is independent of PHP and have its own standard. CGI (Common Gateway Interface) is an interface that instructs the server on how to communicate data with applications, ...


2

I recommend to have a bastion host to access your server via a SSH-port forwarding agent to tighten the SSH aspects. Usually I perform OS hardening images using CIS Benchmark guide. Always focus on 3-tier architecture concepts. I don't recommend to run on the same ports on the same node. You can use docker concepts for your usage. I use the following: ...


2

It depends. One reason to run nginx as root is to make it possible to listen on ports below 1024 i.e. port 80 (http) and port 443 (https). This is not needed in your case. Another reason is to make it possible for nginx to read sensitive files like certificate private keys on startup without having these file readable in case a child process gets ...


2

Well, as I was pointed at nginx mailing list, nginx removes all environment variables inherited from its parent process except the TZ variable, so once I defined needed variables in nginx.conf env LD_PRELOAD=/usr/local/lib/libsslkeylog.so; env SSLKEYLOGFILE=/tmp/premaster.txt; keys started being recorded as expected.


2

it looks like they are trying to inject PHP code into log files. The idea being that if the sysadmin is using a PHP app to parse the logs, some might view the logfile as trusted (after all, the user does not normally get to directly alter the logfile) and therefore forego any sanitisation processes. If you are looking at your log files through a desktop or ...


1

You handle the upload with POST requests to a PHP script which checks the file extension and renames the file You should check the mime type. PHP have mime_content_type function for that. Even if it's possible to fool the mime header and have some code on the metadata of the file, this raises the bar for exploiting your system. If I understand correctly, ...


1

The issue is that most often people configure their PHP block like this: location ~ '\.php' { include fastcgi.conf; include fastcgi_params; fastcgi_param HTTP_PROXY ""; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param QUERY_STRING $...


1

This is simple; they're trying PHP command injection. The process is to substitute a header (in this case the user agent field) with a mathematical expression, then to determine whether the code is being executed view the return value. If the code is executed, the return value will be the result of the expression, rather than the original expression. You'll ...


1

These appear related to EC2 health checks https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-healthchecks.html So I'd say no you are not under any type of recon check


1

Security is a practice. So, keep thinking and never assume you are safe, is a start. So how should I ensure the best security for my VPS and for my app? Indeed a very broad subject. Here is a start:- Obviously following points(de facto) SSL on frontend remove unnecessary applications, especially the ones using network change ssh port; these days you ...


1

To my knowledge, NGINX does not include anything like to describe, but we can implement our own. As I understand Apache 2 modsecurity_crs_11_slow_dos_protection, limits the number of connections. modsecurity_crs_11_slow_dos_protection NGINX has a webpage, Mitigating DDoS Attacks with NGINX and NGINX Plus which mentions several methods for DDoS. Three ideas ...


1

This looks like a generic bot. They scan the internet and probably randomly found your server, then probed around to see if it could find any gaping security holes. Nothing to worry about, your server is not at risk if they did not find anything.


1

Try disabling the following rules from naxsi_core.rules: id:1001 (double quotes) id:1015 (comma) That should work :)


Only top voted, non community-wiki answers of a minimum length are eligible