Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

A server hosting an application built in PHP:

  1. Can the server be reached in other ways than through HTTP or externally?
  2. Is GET and POST only populated through the HTTP protocol?
  3. Is HTTP headers, GET and POST the only source of input for a server/web application?
  4. Is connecting to a website with telnet any different than with a browser?
  5. What other access points exist? Do they pose a security threat? Common ways to counter them?
share|improve this question

migrated from security.stackexchange.com Dec 14 '11 at 6:57

This question came from our site for Information security professionals.

add comment

1 Answer 1

up vote 6 down vote accepted

Can the server be reached in other ways than through HTTP or externally?

Well... the server itself can be accessed by different means. Depending on what services are running on the machine (as well as what ports are open).

Is GET and POST only populated through the HTTP protocol?

Yes

Is HTTP headers, GET and POST the only source of input for a server/web application?

No PUT and DELETE are also http methods.

Is connecting to a website with telnet any different than with a browser?

Basically not. Because it will also use the HTTP protocol. Unless you connect to the machine using another service (see first point)

What other access points exist? Do they pose a security threat?

Lots :-)

  • Physical access to the machine
  • Other services which are running on the machine (it's best practice to stop unused services).
  • SQL Injection
  • File inclusion
  • Password leaks
  • Through employees
  • DNS poisoning
  • many many more

Common ways to counter them?

Make sure your application is secure (don't give httpd unneeded privileges, always sanitize user input, etc). Harden your server security. Make sure you keep everything up-to-date. Regularly check your logs. Common sense. etc.

share|improve this answer
1  
Good answer; but technically cookies and sessions are also set through HTTP headers. There is a cookie/set-cookie header. Session IDs are usually also set either through a cookie or get parameters. –  Lèse majesté Dec 14 '11 at 12:56
    
You're correct. The reason I added it is because they are often used and I didn't add them to the 'real' http methods. Will clarify though. Thanks! –  PeeHaa Dec 14 '11 at 13:01
    
On a shared host it is the host's task to keep the server's software up to date and secure, is it not? I'm not sure if I would even have access to httpd or services at all. –  Seralize Dec 15 '11 at 3:38
    
It depends on the contract you have with them. Another thing you could do is check out for yourself whether there are security issues. So called pen-testing. I've used w3af.sourceforge.net in the past, but also tenable.com/products/nessus can be used. –  PeeHaa Dec 15 '11 at 8:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.