Questions tagged [webserver]

A system whose primary function is to deliver web pages on request to clients.

A system whose primary function is to deliver web pages on request to clients. This includes as a core the delivery of HTML documents as well as any additional content that may be included by a document, such as images, style sheets and scripts.

Many web servers also support server-side scripting, e.g., Apache HTTP Server and PHP. This means that the behaviour of the web server can be scripted in separate files, while the actual server software remains unchanged. Usually, this function is used to create HTML documents "on-the-fly" as opposed to returning fixed documents. This is referred to as dynamic and static content respectively. The former is primarily used for retrieving and/or modifying information from databases. The latter is, however, typically much faster and more easily cached.

Web servers can also be found embedded in devices such as printers, routers, webcams and serving only a local network. The web server may then be used as a part of a system for monitoring and/or administrating the device in question. This usually means that no additional software has to be installed on the client computer, since only a web browser is required (which now is included with most operating systems).

(core info from wikipedia)

953 questions
60
votes
15 answers

How is "hacking" even possible if I "defend" properly?

On a Linux-based server, I follow basic practices as below: Make the admin account password long and complicated enough (i.e. theoretically speaking, password cannot be cracked within reasonable time). Monitor all incoming network traffic to the…
J. Berman
  • 603
  • 5
  • 6
47
votes
9 answers

Hack-resistant hosting solution for non-profit?

(While the answers and comments at How do I deal with a compromised server? are useful, my question is more about prevention of hacking when I do not have total (or much) control over the server. I have SSH access but not root privileges. I cannot…
user249493
  • 523
  • 1
  • 5
  • 8
27
votes
5 answers

What are the dangers of advertising my MySQL-powered amateur site?

I recently started server-side programming, and wrote up a page containing a drawable-canvas that lets users publically draw and save a picture, and overwrite pictures made by others. For kicks, I thought of advertising the link on social media to…
Carcigenicate
  • 387
  • 3
  • 10
13
votes
3 answers

Is "mini-httpd" a secure web server?

I'm using http://acme.com/software/mini_httpd/ for my embedded system. Is it as "secure" as more known web servers like Apache or lighttpd? Being a lesser known web server means that it's less likely to be targeted by attacks, but maybe also less…
michelemarcon
  • 241
  • 2
  • 7
10
votes
3 answers

Does hiding version numbers increase my security?

I’m currently trying to improve the security at our work. This sounds very broad, but, for example, I’m penetrating our systems and checking whether servers are vulnerable to certain exploits. As an example, SMTP gave me this telnet result: 220…
Rob
  • 381
  • 3
  • 12
8
votes
3 answers

Someone registered a domain name with the IP of my VPS

I rented a VPS server to run my website a few month ago. Today, I looked at the /var/log/apache2/access.log and noticed a strange line : 192.0.2.123 - - [02/Aug/2015:05:21:29 -0400] "GET / HTTP/1.1" 200 4043 "http://buttons-for-website.com"…
Jovial
  • 89
  • 2
3
votes
2 answers

Why are web servers ubiquitously configured by blacklisting inaccessible files instead of whitelisting the accessible ones?

Take a random PHP site. It is essentially guaranteed that its web server is configured as follows: serve any file from the document root, except for certain files or paths that are blacklisted. Scripts are also made executable using a similar model:…
RomanSt
  • 1,220
  • 10
  • 25
3
votes
3 answers

Someone found an obfuscated path on my website. Is this possible without hacking my site?

I am running a server with Django and Nginx. I tried to hide the admin panel by assigning it a 50digit random string as URL (something like https://mydomain/asidfhifuerbdsi...). Now someone found this URL and I am wondering if this was possible…
Nik
  • 131
  • 3
3
votes
1 answer

A=0 appended to web server queries

While looking through the logs for my web server, for a web site I wrote, I've noticed a lot of queries are being made twice, first as I expect then followed again within a second with 'A=0 appended to each argument. The A=0 is not part of any code…
simpleuser
  • 135
  • 8
3
votes
1 answer

How can a server be hacked apart from port 80 or SSH?

Currently I have a compromised server (Ubuntu) that is running all services in Docker containers, but I found today a malicious program that was generating a DDOS attack. I checked all services in Docker, and they are ok, they wasn't compromised,…
IAmJulianAcosta
  • 2,475
  • 3
  • 16
  • 18
3
votes
1 answer

Is this information leakage dangerous?

After scanning my website with a automated tool I get this Is this dangerous, is it a vulnerability or not? If yes what can an attacker do, how to fix it?
Test
  • 55
  • 8
2
votes
2 answers

Using a special user to manage web server?

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify files under /var/www/, I'm using the root account.…
TomatoGuy
  • 29
  • 1
2
votes
1 answer

Can the following .htaccess rules prevent this attack?

See these related questions from the same user about the same incident first: How to find and protect against the exploited vulnerability in an PHP application based on the logged URL? php.ini security setting after attack I am sorry having a…
TryHarder
  • 257
  • 4
  • 9
2
votes
2 answers

What are the security implications of STARTING a reverse proxied origin server as an unprivileged user?

A common recommendation as part of web server security is to run the server daemon as an unprivileged user (e.g.: nobody) so that exploits executing arbitrary code may have less unwanted effects. However, since port 80 is a "privileged port" the…
benrifkah
  • 201
  • 1
  • 6
2
votes
1 answer

Security risks by hosting a Nextcloud on home PC via virtual server

I found this question I want to host a server from my home computer; safe? that indicates that hosting anything connected to the open web on a private is a great security risk. As I am totally new to this topic, I wonder if tunneling the traffic via…
Lehue
  • 135
  • 4
1
2 3