The tag has no wiki summary.

learn more… | top users | synonyms (1)

21
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
19
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...
13
votes
12answers
570 views

An honest security ethics nondisclosure question I need help with

Three years ago I did a security audit for a large ecommerce website. When the audit was performed, I found several severe security issues that allow for access to data that should not be accessible ...
12
votes
1answer
2k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
9
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
7
votes
1answer
2k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
5
votes
1answer
510 views

`ps` and `bin/bash su` in ps aux output

I have a shared server (amazon ec2 micro powered by bitnami) with a web application (Wordpress), which is showing low performance lately (with relatively stable traffic and usage). The only suspitious ...
4
votes
2answers
567 views

How to secure your Linux server from pass-the-hash attacks

I was just reading this article: http://www.infoworld.com/d/security/stop-pass-the-hash-attacks-they-begin-167997?page=0,2&source=IFWNLE_nlt_daily_2011-07-26 He talks about pass-the-hash attacks ...
4
votes
2answers
306 views

Attack on my web server - What could this mean

My provider informed that there is an outbound attack on my web server. On further inspection I saw this in my Apache error.log file: --2012-02-04 04:40:59-- ...
4
votes
2answers
230 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
4
votes
3answers
1k views

SSL - should I just make my entire site secured?

I'm planning on building an application wherein my users can create accounts on it, email other users, etc. The site will also have forums, chat, etc. It will also need to process credit cards. I'm ...
3
votes
1answer
363 views

Using nginx and Drupal, how do I serve a 404 error for static files and directories that exist?

I deploy a Drupal web site using git (well, OK, the developers deploy it; I try to keep them out of trouble), and for that reason the site has a directory .git and a file .gitignore in the document ...
3
votes
1answer
751 views

How to make TLS the preferred secure connection in IIS 7

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
2
votes
2answers
659 views

Is it more secure to close port 80 to IIS?

Our software runs on 443 (https) on IIS and our network administrator insist on closing port 80 on the firewall. Port 80 would be used to redirect to 443. The problem is that the users now need to ...
2
votes
4answers
156 views

Apache Security Config - Ubuntu 12

I am running a LAMP stack on Ubuntu 12, with the primary function to serve a PHP based API. There is only one file I want to be exposed to the public called: api.php It needs to reference a config ...
2
votes
1answer
134 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
2
votes
3answers
259 views

Designing a persistent asynchronous TCP protocol

I have got a collection of web sites that need to send time-sensitive messages to host machines all over my metro area, each on its own generally dynamic IP. Until now, I have been doing this the way ...
2
votes
2answers
245 views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
2
votes
1answer
69 views

hosting people asking for my account username and password to enable curl and socket function only for me

I have hosted my site in a shared environment. My hosting people disabled socket function all together. and they said that we can enable only for you if i given a written statement. I did but they ...
2
votes
1answer
34 views

SSLv2 in IIS 7.5?

Just found that SSLv2 is enabled in IIS 7.5 by default and to change it requires tweaking in registry. What is the design decision for it? Is there a disadvantage of disabling it?
2
votes
1answer
80 views

why does adding a DNS root zone to the URL sometimes result in security errors?

Disclaimer: I've only witnessed this behaviour on chrome. adding the rightmost dot to a URL as in facebook.com. should result in a fully qualified domain name (FQDN) and hence I wouldn't expect any ...
2
votes
1answer
213 views

How can I verify a client's identity using an SSL handshake to allow access to certain website pages?

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL ...
2
votes
2answers
809 views

Block IPs that try to exploit common webapp vulnerabilities

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities? I have an nginx web server that serves only static content. I routinely ...
2
votes
2answers
294 views

SQL Server Windows-only Authentication Strategy problem

I would like to use Windows-only Authentication in SQL Server for our web applications. In the past we've always created the all powerful 1 SQL Login for the web application. After doing some ...
2
votes
1answer
120 views

What options exist to prevent Google Chrome Frame from rendering external URLs?

What options exist to prevent Google Chrome Frame (GCF) from rendering external URLs? I'd like to deploy GCF within our organization to allow some intranet sites to use modern html features. How can ...
1
vote
3answers
5k views

What are perfect unix permissions for usual web project directories?

What are the perfect minimal permissions in octal format for the followings in a web application written? A directory where user uploaded static files (images/swf/js files) will reside A directory ...
1
vote
2answers
491 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
1
vote
1answer
191 views

Is it possible to capture traffic to the remote web server

I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark POST /***URL*** HTTP/1.1 Host: ***DNS NAME*** ...
1
vote
3answers
431 views

How to secure a server physically and the software?

We are creating a web application that will be installed on a server and sold to a client, similar to a Google Mini Search appliance. We are looking at various ways to secure the server from being ...
1
vote
1answer
112 views

How to ensure my connection is secure to Google [closed]

Blogspot blogs are banned in Iran, they redirected to a page that says you can't access that site. But when I try to open a blog via HTTPS prefix I get this error: This is certification detail: ...
1
vote
4answers
140 views

Do I need a hardware firewall for Win 2003?

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to ...
1
vote
3answers
183 views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
1
vote
2answers
83 views

Checking for Joomla or wordpress sites needing updates

Is there any software that I can run on either a Linux or a Windows server to check for domains that have out dated WordPress installations. I have seen a rise in hacked sites and in all cases the ...
1
vote
3answers
383 views

Possible DNS hack or Unknown reason causing some users to redirect to a porn website?

I have website, which is a very popular website, but from last two weeks several customers complain to me that my site was hacked and redirected to a porn website, but whenever i check the website i ...
1
vote
2answers
88 views

More safety than standard HTTPS settings [closed]

It maybe sounds strange, but if you can correct me and provide the right solution, please do it. I heard that Ettercap can sniff HTTPS open encryption key and user's data. So, how to make server with ...
1
vote
2answers
790 views

Should apache have write access to the web root? [duplicate]

Possible Duplicate: What are the best linux permissions to use for my website? I'm trying to get a canonical answer on how to set up permissions for apache vis-a-vis the web root ...
1
vote
1answer
436 views

Should Jetty always be behind another webserver (eg nginx, apache) to improve security?

For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have ...
1
vote
1answer
55 views

Web Server security — webapp + website?

I am setting up a tiny, static website for a company. I am also building a rather complex and highly customized webapp for this same company. The webapp will only be used by the staff of the company ...
1
vote
2answers
87 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user1000 to execute any shell (php, pl, exe). The shells ...
1
vote
2answers
371 views

Google searches in my apache access logs?

I'm quite familiar with the idea that of bots are probing my server for vulnerabilities, but today when I checked my access logs, I noticed a bunch of google searches appearing in the logs. What ...
1
vote
2answers
364 views

Locating Rogue Perl Script

I've been trying to source the location of a perl script which is causing havoc on a server which I control. I'm also trying to find out exactly how this script was installed on the server - my best ...
1
vote
1answer
1k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
1
vote
1answer
98 views

How to secure communications inside Azure? [closed]

I'm interested in knowing best practices for securing communications between a Linux VM and a Windows VM/Web Role. So in the end, i need to communicate securely like so-- Linux VM < -- > Windows ...
1
vote
1answer
44 views

Protecting Python Data Apache2

i have a doubt about protection of Python Code. I'm not meaning just "Obfuscation", so, i've read a lot of topics about this subject, and i choose to put my application behind a web interface. So, ...
1
vote
2answers
2k views

Is it possible to use IIS 7 Application Pool Identities on a 2008 Domain Controller

So, let me put the disclaimer in first: I wouldn't typically piggy-back IIS on a domain controller, but that's what I've got and I can't change that in this instance. I've got a WCF web service I ...
0
votes
2answers
195 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...
0
votes
1answer
93 views

How to connect to a SINGLE colocated server - is StrongSWAN sufficient?

I am thinking of colocating a SuperMicro 1022G-URF (16-way 1u server, 16 GB RAM) at a "place that does server colocation. I am running CentOS 6. The server will be a web server and an email server ...
0
votes
1answer
210 views

How to block an IP, if it is making many http/apache/mysql requests in a second?

If some one tried force burst attack on my website, how can i block their IP address? I mean, I want to block an IP if I am getting many http/Apache/SQL requests per second from it. How can i prevent ...
0
votes
1answer
37 views

Restricting access using IP address / Network Redirection?

I have a situation where we have a web server (lets call it A) that is hosting a set of HTTP based services. Due to some client requirements, this web server is not open to the outside world but ...
0
votes
2answers
1k views

fail2ban apache-noscript not working

My debian server has come under attack recently and I've been poring over the logs to see what I can do to harden it. I've been running fail2ban for a while but I've noticed the apache-noscript jail ...