The tag has no wiki summary.

learn more… | top users | synonyms (1)

21
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
19
votes
8answers
2k views

How to prevent zero day attacks

Traditionally, all anti-virus programs and IPS systems work using signature-based techniques. However, this doesn't help much to prevent zero-day attacks. Therefore, what can be done to prevent ...
13
votes
12answers
575 views

An honest security ethics nondisclosure question I need help with

Three years ago I did a security audit for a large ecommerce website. When the audit was performed, I found several severe security issues that allow for access to data that should not be accessible ...
12
votes
1answer
4k views

What is an open DNS resolver, and how can I protect my server from being misused by hackers?

I don't have the strongest background in computer security, but yesterday one of my company servers was shut down by our host. It's a server assigned a public IP where I host several web-service ...
10
votes
5answers
2k views

Why we need SELinux?

I could not get much idea where the SELinux has been used and what it saves from attacker. I have gone through SELinux web site and read the basic but still not getting clue about SELinux. For the ...
8
votes
3answers
1k views

How to decide where to purchase a wildcard SSL certificate?

Recently I needed to purchase a wildcard SSL certificate (because I need to secure a number of subdomains), and when I first searched for where to buy one I was overwhelmed with the number of choices, ...
7
votes
1answer
3k views

Safest ciphers to use with the BEAST? (TLS 1.0 exploit) I've read that RC4 is immune

Now that the BEAST is public knowledge, TLS 1.0 is NOT safe to use (nor is SSL 3.0). I have seen reports that the RC4 cipher is unaffected (and is widely supported). Is that true? I know that TLS 1.1 ...
5
votes
1answer
563 views

`ps` and `bin/bash su` in ps aux output

I have a shared server (amazon ec2 micro powered by bitnami) with a web application (Wordpress), which is showing low performance lately (with relatively stable traffic and usage). The only suspitious ...
4
votes
2answers
683 views

How to secure your Linux server from pass-the-hash attacks

I was just reading this article: http://www.infoworld.com/d/security/stop-pass-the-hash-attacks-they-begin-167997?page=0,2&source=IFWNLE_nlt_daily_2011-07-26 He talks about pass-the-hash attacks ...
4
votes
2answers
311 views

Attack on my web server - What could this mean

My provider informed that there is an outbound attack on my web server. On further inspection I saw this in my Apache error.log file: --2012-02-04 04:40:59-- ...
4
votes
2answers
231 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
4
votes
3answers
1k views

SSL - should I just make my entire site secured?

I'm planning on building an application wherein my users can create accounts on it, email other users, etc. The site will also have forums, chat, etc. It will also need to process credit cards. I'm ...
3
votes
1answer
204 views

Determine if possible successful probe is successful exploit?

A logwatch report outputted the following message. A total of 1 possible successful probes were detected (the following URLs contain strings that match one or more of a listing of strings that ...
3
votes
1answer
442 views

Using nginx and Drupal, how do I serve a 404 error for static files and directories that exist?

I deploy a Drupal web site using git (well, OK, the developers deploy it; I try to keep them out of trouble), and for that reason the site has a directory .git and a file .gitignore in the document ...
3
votes
1answer
986 views

How to make TLS the preferred secure connection in IIS 7

I have a mvc3 website that is hosted on a Server 2008 r2 server and I have a security certificate installed and all seems to be working ok. However if I connect to the site with Google Chrome, and ...
2
votes
3answers
6k views

What are perfect unix permissions for usual web project directories?

What are the perfect minimal permissions in octal format for the followings in a web application written? A directory where user uploaded static files (images/swf/js files) will reside A directory ...
2
votes
2answers
772 views

Is it more secure to close port 80 to IIS?

Our software runs on 443 (https) on IIS and our network administrator insist on closing port 80 on the firewall. Port 80 would be used to redirect to 443. The problem is that the users now need to ...
2
votes
4answers
163 views

Apache Security Config - Ubuntu 12

I am running a LAMP stack on Ubuntu 12, with the primary function to serve a PHP based API. There is only one file I want to be exposed to the public called: api.php It needs to reference a config ...
2
votes
1answer
147 views

Beast / CRIME / Beach attack and stopping it

I have read so much on all this but not entirely sure I understand what has gone on. Also, is this one, two or three problems? It looks to me like three, but it's all very confusing: Beast CRIME ...
2
votes
3answers
301 views

Designing a persistent asynchronous TCP protocol

I have got a collection of web sites that need to send time-sensitive messages to host machines all over my metro area, each on its own generally dynamic IP. Until now, I have been doing this the way ...
2
votes
2answers
276 views

WebDAV Security and Hardening

What are the security ramifications that one should be aware of when considering using WebDAV? How does one go about securing it? What else should I know about it?
2
votes
1answer
70 views

hosting people asking for my account username and password to enable curl and socket function only for me

I have hosted my site in a shared environment. My hosting people disabled socket function all together. and they said that we can enable only for you if i given a written statement. I did but they ...
2
votes
1answer
46 views

SSLv2 in IIS 7.5?

Just found that SSLv2 is enabled in IIS 7.5 by default and to change it requires tweaking in registry. What is the design decision for it? Is there a disadvantage of disabling it?
2
votes
1answer
2k views

Security issue on Nginx, PHP & fastcgi_split_path_info

According to this post, it was said that if I am using PHP/Nginx, for better security, I should either cgi.fix_pathinfo = 0 or if ( $fastcgi_script_name ~ \..*\/.*php ) { return 403; } In ...
2
votes
1answer
81 views

why does adding a DNS root zone to the URL sometimes result in security errors?

Disclaimer: I've only witnessed this behaviour on chrome. adding the rightmost dot to a URL as in facebook.com. should result in a fully qualified domain name (FQDN) and hence I wouldn't expect any ...
2
votes
1answer
224 views

How can I verify a client's identity using an SSL handshake to allow access to certain website pages?

I'm a programmer in the process of writing Web Services on a website for a specific client. These Web Service can only be accessed by this one client. They intend to send a client certificate over SSL ...
2
votes
2answers
883 views

Block IPs that try to exploit common webapp vulnerabilities

Is there an application that goes through the nginx logs and blocks IPs that made requests for common webapp vulnerabilities? I have an nginx web server that serves only static content. I routinely ...
2
votes
2answers
298 views

SQL Server Windows-only Authentication Strategy problem

I would like to use Windows-only Authentication in SQL Server for our web applications. In the past we've always created the all powerful 1 SQL Login for the web application. After doing some ...
2
votes
1answer
122 views

What options exist to prevent Google Chrome Frame from rendering external URLs?

What options exist to prevent Google Chrome Frame (GCF) from rendering external URLs? I'd like to deploy GCF within our organization to allow some intranet sites to use modern html features. How can ...
1
vote
3answers
165 views

Why do we really need apache + php if php can run as web server?

A few months ago i did an experiment that kinda went out very well, today we have an intranet portal using the following technologies: JeasyUI phpgrid Kibana So, based on our tests why do we need ...
1
vote
2answers
752 views

How can I block a malicious port scanner currently running on my server? [duplicate]

I'm currently attempting to clean and secure a server that has pnscan running on it. This instance of pnscan was installed by an outside party most likely to use our server as part of a port scanning ...
1
vote
1answer
202 views

Is it possible to capture traffic to the remote web server

I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark POST /***URL*** HTTP/1.1 Host: ***DNS NAME*** ...
1
vote
3answers
440 views

How to secure a server physically and the software?

We are creating a web application that will be installed on a server and sold to a client, similar to a Google Mini Search appliance. We are looking at various ways to secure the server from being ...
1
vote
1answer
112 views

How to ensure my connection is secure to Google [closed]

Blogspot blogs are banned in Iran, they redirected to a page that says you can't access that site. But when I try to open a blog via HTTPS prefix I get this error: This is certification detail: ...
1
vote
4answers
140 views

Do I need a hardware firewall for Win 2003?

We have had a Win 2003 server at a co-lo for a while. It is used as a web server and has a very cheap hardware firewall between it and the internet. Ports 3389 and 80 are the only ones forwarded to ...
1
vote
2answers
111 views

Checking for Joomla or wordpress sites needing updates

Is there any software that I can run on either a Linux or a Windows server to check for domains that have out dated WordPress installations. I have seen a rise in hacked sites and in all cases the ...
1
vote
3answers
408 views

Possible DNS hack or Unknown reason causing some users to redirect to a porn website?

I have website, which is a very popular website, but from last two weeks several customers complain to me that my site was hacked and redirected to a porn website, but whenever i check the website i ...
1
vote
2answers
88 views

More safety than standard HTTPS settings [closed]

It maybe sounds strange, but if you can correct me and provide the right solution, please do it. I heard that Ettercap can sniff HTTPS open encryption key and user's data. So, how to make server with ...
1
vote
2answers
911 views

Should apache have write access to the web root? [duplicate]

Possible Duplicate: What are the best linux permissions to use for my website? I'm trying to get a canonical answer on how to set up permissions for apache vis-a-vis the web root ...
1
vote
1answer
487 views

Should Jetty always be behind another webserver (eg nginx, apache) to improve security?

For a long time I've always run nginx in front of jetty to do load balancing. However, I have a new project where I will be using HAProxy to do the load balancing and was wondering if I should have ...
1
vote
1answer
2k views

Is a local-only MAMP installation secure?

I just installed a basic MAMP server (on a Macbook Air 11" running OSX Lion) with no settings changed except for some php.ini things like "memory", "file_upload", etc that are more script related. I ...
1
vote
2answers
2k views

Is it possible to use IIS 7 Application Pool Identities on a 2008 Domain Controller

So, let me put the disclaimer in first: I wouldn't typically piggy-back IIS on a domain controller, but that's what I've got and I can't change that in this instance. I've got a WCF web service I ...
1
vote
1answer
56 views

Web Server security — webapp + website?

I am setting up a tiny, static website for a company. I am also building a rather complex and highly customized webapp for this same company. The webapp will only be used by the staff of the company ...
1
vote
2answers
159 views

How to deny shell execution in all sub-directories?

I want nginx to deny users who have folders inside /webroot/uploads e.g. /webroot/uploads/user1 /webroot/uploads/user2 /webroot/uploads/user1000 to execute any shell (php, pl, exe). The shells ...
1
vote
2answers
491 views

Google searches in my apache access logs?

I'm quite familiar with the idea that of bots are probing my server for vulnerabilities, but today when I checked my access logs, I noticed a bunch of google searches appearing in the logs. What ...
1
vote
2answers
486 views

Locating Rogue Perl Script

I've been trying to source the location of a perl script which is causing havoc on a server which I control. I'm also trying to find out exactly how this script was installed on the server - my best ...
1
vote
1answer
103 views

How to secure communications inside Azure? [closed]

I'm interested in knowing best practices for securing communications between a Linux VM and a Windows VM/Web Role. So in the end, i need to communicate securely like so-- Linux VM < -- > Windows ...
1
vote
1answer
46 views

Protecting Python Data Apache2

i have a doubt about protection of Python Code. I'm not meaning just "Obfuscation", so, i've read a lot of topics about this subject, and i choose to put my application behind a web interface. So, ...
1
vote
0answers
76 views

Understanding & Resolving Web Server Exploits

We recently had someone contact our company pointing out that we had numerous security threats that could be used to exploit our systems. They were nice enough to provide a list of these to which we ...
0
votes
2answers
205 views

Webhosting on virtual sever vs physical server: Security vulnerability

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites? For example, can the fact that there is not any hardware ...