Tagged Questions
0
votes
0answers
14 views
User entered Javascript security implications [migrated]
I'm creating a web site that lets people create their own site using a subdomain. Are there any security implications by letting people add custom javascript to their pages? If so, which ones? XSS? ...
0
votes
1answer
31 views
General question as a new webmaster [closed]
I am wanting to make my own social forum for friends and workers. I will have about 10,000-15,000 users. I have never made a forum on such a high scale and to this point have only been a developer ...
1
vote
0answers
26 views
Is website security accreditation worth having?
My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
2
votes
0answers
34 views
Good security practice for writing a php/mysql web app [closed]
I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts.
It will most likely not be very likely to be attacked in any way. Still I am ...
11
votes
3answers
124 views
Is it sufficient to secure a order status page just by a random URL?
After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him.
We'd like to inform our customer about received payments, packet ...
1
vote
5answers
85 views
Website Systematically Blocking IP Addresses
I have a series of websites hosted at the same server. The issue I am having is that it keeps blocking me access from different means to the sites. Allow me to explain:
From my IP, Blocked.
From ...
0
votes
2answers
27 views
Using SSL Certification in Multiple Locations
I have some issues with respect to using SSL Certificates. I have a website hosted in UK and I also have an organisation in South Africa hosting my company application online for web access.
The ...
0
votes
1answer
41 views
how do I avoid spam domains to point to my site or IP hosting tomcat application
I can across a issue where I saw some xyz.com is pointing to mydomain.com.
I am not using Apache, nor IIS but Tomcat 7 directly.
How to I avoid such other spam domains to point to mydomain.com?
I ...
0
votes
1answer
17 views
Web server with or without Panel [closed]
I start a Web server for my company for hosting about 15 website and I didn't install a Control Panel, I do everything by command and i'm pretty comfortable with it but do you think i'm losing time by ...
1
vote
1answer
337 views
Site got hacked while many / all security leaks have been removed [closed]
I've got a website with this code appended to my php document :
<?
#8f4d8e#
...
1
vote
5answers
82 views
How do webmasters store and keep track of their passwords [closed]
I'm developing a site for the first time, and I'm trying to work out the best way to store and track all the accounts/passwords e.g. Server passwords, ftp passwords, API passwords (FB, Google, ...
6
votes
1answer
155 views
Security: Hide mysql connection details file
Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
2
votes
2answers
82 views
Any suggestions for a change detection system?
As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
2
votes
1answer
81 views
How to log username in Apache logs?
I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management.
Is the method the same in case of IIS or just applicable to ...
2
votes
1answer
255 views
Pass IMG SRC via GET and echo it? Is that really secure?
I was wondering how I can make a really simple GET and echo request more secure
The code:
$src = $_GET['src'];
echo "<img src='$src' />";
Basically, I have a URL like ...
3
votes
2answers
60 views
How to safely saving users' data and NOT get responsibility of users' data?
I am programming a website which will save up users' inputs for their next visits. For example, I might save their phone numbers. The user will know that I save their phone numbers. However, do I need ...
0
votes
0answers
44 views
Insecure Php code allow other malicious code to run [closed]
Got an email from the web host that I used for a small website. Basically they disable the website and says the php code on it was used to scan for vulnerabilitity on their shared hosting platform, ...
1
vote
1answer
23 views
Compromised private RSA key
What sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(
2
votes
2answers
90 views
How to have google index a login protected url?
For example, my site:
http://abcde.foobar.com is protected by a "single sign on" login page hosted at http://sso.foobar.com, so when a user visits "abcde", they get redirected to the "sso" login page ...
0
votes
0answers
56 views
Is ConfigServer Security & Firewall - csf, OSSEC - Open Source Security and grsecurity are developed for same purpose? [closed]
I am looking for security solution for my dedicated server. Now i am using CSF, in mean while i came to know about ossec and grsecurity.
Questions
Is all the above three stuffs are developed for ...
4
votes
2answers
83 views
What measures should I take after I find one of my scripts being vulnerable?
I maintain a few PHP-based websites for a small company on a LAMP server. The scripts include CMS such as Joomla or Wordpress, as well as SilverStripe and Drupal installations.
A week ago, I found ...
3
votes
1answer
113 views
How to remove adware pop up?
I get an ad pop up that should not be on the site. It has only appeared once.
The HTML code for the pop up window that appeared:
http://pastie.org/5674909
Here is the full HTML pastie:
...
1
vote
1answer
45 views
How to set a 1-order-per-PC limit on my website?
On my website people can order free coupons for my local service.
I would like to set a limit of 1 coupon order per PC.
Can someone suggest a way to implement this, even if the visitor would delete ...
1
vote
2answers
311 views
GWT “Big traffic change for top URL”
I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
0
votes
0answers
35 views
Phishing alert but file never existed
I got an alert from Google Webmasters. They say the following file was present in my host:
example.com/~jhostgop/identity.php
I checked my files and it never existed at all.
I've experience this ...
6
votes
4answers
179 views
Webhosting company able to unhash passwords?
Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
3
votes
3answers
154 views
Why do websites require retyping the password upon user error in a registration form?
Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype.
I'm wondering if I ...
1
vote
0answers
44 views
What is the most secure environment for multiple CMS sites? [closed]
I wish to run about 50 Joomla or WordPress low-traffic websites on 1 server, or part of a server. Each website will be managed by its own, naive owner who will have be able to access the Joomla or ...
1
vote
1answer
47 views
Multiple SSL certificates under one organization?
Now that I have my LLC formed, I intend to purchase several EV SSL certificates for a few of my popular online stores. My question is if it is possible to purchase and set up several EV SSL ...
3
votes
1answer
105 views
How to get rid of crawling errors due to the URL Encoded Slashes (%2F) problem in Apache
The Google web crawler has indexed a whole set of URLs with encoded slashes (%2F) for our site. I assume it has picked up the pages from our XML sitemap file. The problem is that the live pages will ...
1
vote
0answers
52 views
website address point to localhost
Today in firefox while surfing the internet, I opened a website it asked "This site may harm your computer" if you want to open this website add it in exception list. I added a website under exception ...
4
votes
1answer
113 views
Website still blocked after hack
I manage a website that was hacked a few months ago (I wasn't the webmaster then), it was running on Joomla. I have manages to redo the website with custom codes (php/mysql), but it still some ...
0
votes
0answers
58 views
cPanel's Web Disk - Security issues?
I'm thinking of using Web Disk (built into the later versions of cPanel) to allow a Windows or Mac computer to map a network drive that is actually a folder on our website (above the public_html ...
2
votes
2answers
110 views
Phpmyadmin http password security
Is my password sent unencrypted when using Phpmyadmin through http?
If not, is there any downside using http compared to https?
1
vote
2answers
45 views
Security risks posed by specifying technologies used
I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the ...
0
votes
0answers
37 views
How to setup IIS on Windows AIM on a Virtual Port [closed]
I want to host my web server on EC2 at Amazon Web Service. I will use a Windows AIM and IIS7.
I want to config a port (such as: 5555) for my web service and bind it to virtual port 80. so that the ...
0
votes
0answers
262 views
blocking bad bots with robots.txt in 2012 [closed]
does it still work good? I have this:
# Generated using http://solidshellsecurity.com services
# Begin block Bad-Robots from robots.txt
User-agent: asterias
Disallow:/
User-agent: BackDoorBot/1.0
...
1
vote
0answers
21 views
open source plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
4
votes
2answers
209 views
Combining a content management system with ASP.NET
I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
1
vote
2answers
97 views
1024 bit to 2048 bit certificate differences in how we access our portal
Why now that we have gone from 1024 to 2048 do we need to put the www in front of our portal site when we never used to.
1
vote
1answer
108 views
Java/1.7.0_07 as user agent
almost every day something (it should be a bot) visits all of my pages on my website (amongst other things it doesn't correctly handle spaces in urls) with Java/1.7.0_07 (or different java versions) ...
8
votes
2answers
786 views
How to find domain registrar and DNS hosting with good DNSSEC support?
Simplified problem
I want to buy a domain and make a website that is fully secured with DNSSEC.
I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
1
vote
1answer
66 views
Website address hacked, emails created but not showing in manage your account
I have a website, thebleudoor.com. It is hosted by yahoo. It gets 2000-3000 hits a day and has been for at least 5 years.
A few months ago, as admin of the website, I started getting bounced back ...
4
votes
1answer
98 views
Allowing temporary access to cpanel for freelancer
I'm currently using a2hosting's cpanel on a shared hosting account. I'd like to temporarly give access to a freelance developper so he can upload some php files, csv files and create tables in my ...
2
votes
1answer
62 views
Password protected website
I need to add a user authentication page before the actual homepage of the website.
In Joomla! I just set the website offline and the offline page loads in place of the homepage but then it's ...
4
votes
2answers
173 views
Number of page requests by any Bot in 5 secs
I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
1
vote
1answer
201 views
Good idea to use Google Sites for static content and custom PHP for dynamic
We have a site based upon Google Sites. Now we would like to create a login area (HTTPS) with a mixture of dynamic and static content. Is it a good idea to utilize Google Sites and use iFrames for the ...
0
votes
0answers
106 views
SIMPLEST way to set up password protection for a static site, with basic admin UI?
I have a static site.
I would like the simplest approach to password protecting a directory, with a basic admin UI for adding/removing users. I will have so few users that I don't care about ...
1
vote
1answer
82 views
get mysql_real_escape is giving me errors when I try and add security to my website [closed]
I tried doing this:
@ $db = new myConnectDB();
$beerName = mysql_real_escape_string($beerName);
$beerID = mysql_real_escape_string($beerID);
$brewery = mysql_real_escape_string($brewery);
$style = ...
1
vote
0answers
35 views
Are there considerations for expiring SSL certs for inactive domains?
I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity.
However, soon a few of the SSL certs for the inactive domains are set to ...
