51
votes
Accepted
How do hosting providers prevent the compromise of one website from causing the compromise of another one?
This question is a bit broad, but I think an answer that is a little bit broad will still be helpful. The answer depends on the "kind" of hosting you are talking about. There are three main kinds ...
- 31.7k
43
votes
Accepted
Pentesting against own web service hosted on 3rd party platform
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection ...
- 62.6k
42
votes
Accepted
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
This is likely a server misconfiguration, since all those websites are served from 95.173.215.72.
When opening one of the websites via HTTPS, my browser warns me that the certificate common name, ...
- 14.7k
19
votes
How do hosting providers prevent the compromise of one website from causing the compromise of another one?
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
Yes, this is definitely possible. Since I have only experienced this with Linux based hosting solutions, I ...
- 5,851
19
votes
Dealing with spam scripts as a shared hosting operator, with users who host mail externally
This is a long and complicated topic, but I will try to answer as concisely as I can.
Basically, you are mixing three kinds of problems here:
Abuse of legitimate email sending facilities which your ...
- 838
12
votes
Accepted
Any threats from isolated subdomain (controlled by hacker)?
Based on the few details of this setup and some guess work what you might use this setup for the following problems come to mind:
with local privilege escalation exploit one might break out of the ...
- 208k
12
votes
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
You might also be asked to add a temporary security exception to view the content.
This is a typical issue when multiple sites share the same IP address and some of these have HTTPS enabled and some ...
- 208k
11
votes
Accepted
Could one create a vulnerable website on purpose to attack a server of a hosting provider?
You wouldn't need the vulnerable website if you have an account on the shared hosting already. What you need is code execution on the host. A remote code execution vulnerability in one of the hosted ...
- 65.8k
7
votes
Pentesting against own web service hosted on 3rd party platform
You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service ...
- 71
6
votes
Any threats from isolated subdomain (controlled by hacker)?
Yes.
Although we don't know all the details about the OS you are using or about the different software's you use the potential attack is a Privilege Escalation that can be done.
The attacker (in ...
- 3,869
5
votes
How do hosting providers prevent the compromise of one website from causing the compromise of another one?
This is a rather broad question and it assumes that webhosts actually DO suffiently protect you against this problem.
The typical shared web hosting uses:
Apache mod_suexec
PHP safe mode, ...
- 3,472
5
votes
Dealing with spam scripts as a shared hosting operator, with users who host mail externally
ThorstenS's answer is spot on (+1 from me); in order to control the email these websites are sending, you need to run them over your own server.
However, I disagree with some of the details - when ...
- 1,987
3
votes
How can a PHP file be added over and over to my hacked site?
Your xm1rpc.php came from wordpress. Follow these steps, it will solve your issue. Go straight to the point and follow the below steps to fix it. This is a script kiddie kind of work, don't over ...
- 1,293
3
votes
How can a PHP file be added over and over to my hacked site?
It's pretty hard to answer by just the information you give.
Some mates said that your problem may be a SQL Database Vulnerability, but i don't think so (i still can be wrong). As if that was the ...
- 1,029
3
votes
How can a PHP file be added over and over to my hacked site?
How can a file be added over and over to my site?
Exploiting the "Privilege Escalation flaw" on the system/programs
A user with a low-privileged account can get the root privilege by ...
- 2,251
3
votes
How can a PHP file be added over and over to my hacked site?
First, check the access logs of your sites to prove to yourself that you're not getting reinfected through the same attack vector that got you infected. If you don't see requests coming in every ten ...
- 9,293
3
votes
How can a PHP file be added over and over to my hacked site?
You might have some backdoor in the database as inline HTML or Javascript.
If you are sure that you have removed everything from the files, look into the database.
Also, make sure you upgrade both ...
- 31
3
votes
Is it safe to use Memcached in a shared hosting environment?
If you did not configure it, then you can't know if its secure. Doesn't matter if we're talking about memcached, an Oracle database, opensshd....
As grochmal says, there are no intrinsic access ...
- 18.8k
3
votes
Is it safe to use Memcached in a shared hosting environment?
Well, memcached itself has no permission configuration whatsoever (just the permissions of the listening socket). You simply boot the daemon and all memory objects that are sent to it will be stored ...
- 5,897
3
votes
Am I a Hosting service provider in a sense of PCI-DSS SAQ D Appendix A?
Are we a shared hosting/service provider?
The PCI SSC defines what they mean by "shared hosting provider" under the PCI DSS requirement 2.6. The guidance section states:
This [requirement] is ...
- 31
2
votes
Pentesting against own web service hosted on 3rd party platform
Additional to the ISP consideration as per the answer of "Mike Lane", put in mind that also you are going to pentest over networks that are properties of a different entities that belong to the state ...
- 1,872
2
votes
Accepted
Host header attacks: Possible exploits
I would say this is not a vulnerability in itself, but enables the exploitation of other vulnerabilities.
Recently an attack was published for Wordpress that depended on the site being available ...
- 34.4k
2
votes
Accepted
Paypal and PCI Compliance
At a minimum you would need to fill out the SAQ A or SAQ A-EP. PayPal appears to have a partnership with a QSA, SecurityMetrics, and also covers the cost:
How do I complete a Self-Assessment ...
- 73.3k
2
votes
Multiple wp-login.php attack on shared hosting
Although you don't provide this level of detail in your question I'll assume that the WordPress sites you host are publicly accessible and that they either have their own domain name or that they are ...
- 208k
2
votes
Multiple wp-login.php attack on shared hosting
Whatever you said is a kind of server or instance hardening. And the scenario that you are saying is basically a probing, not an attack. And you can't stop probing anyways.
Keep in mind one thing, if ...
- 421
2
votes
Accepted
What is the best file permission for .user.ini in hosting folder?
The PHP .user.ini file:
Since PHP 5.3.0, PHP includes support for configuration INI files on a
per-directory basis. These files are processed only by the CGI/FastCGI
SAPI. This functionality ...
- 19.4k
2
votes
Remote host identification has changed - How do I know if it's an attack or not?
You did the right thing, don't connect if you don't know what happened, that is exactly what the warning is for. This message would absolutely appear if an attack was taking place. If it wasn't it ...
- 3,951
1
vote
Differences between compromised shared hosting and dedicated/virtual hosting
In both cases, the ideal incident response should be the same:
Make a backup of your data (or, preferably, grab a recent backup pre-dating the intrusion)
Restore your data to a new (shared or ...
- 73.3k
1
vote
Security requirements for commingling systems
You'll want to look at NIST SP 800-171 (Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). This document details the security controls for CUI information on ...
- 87
1
vote
Identifying website attack type (Meuhy.php)
I found the Meuhy.php file on 10 WordPress sites. I also found these additional files added to GoDaddy hosted sites:
suspended..php
wp_rmder.php
test.php
The above files all of the Last Modified ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible