Preventing a system from unauthorized access, modification, disruption, or destruction.
1
vote
1answer
23 views
Compromised private RSA key
What sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(
0
votes
0answers
58 views
Is ConfigServer Security & Firewall - csf, OSSEC - Open Source Security and grsecurity are developed for same purpose? [closed]
I am looking for security solution for my dedicated server. Now i am using CSF, in mean while i came to know about ossec and grsecurity.
Questions
Is all the above three stuffs are developed for ...
1
vote
1answer
45 views
How to set a 1-order-per-PC limit on my website?
On my website people can order free coupons for my local service.
I would like to set a limit of 1 coupon order per PC.
Can someone suggest a way to implement this, even if the visitor would delete ...
1
vote
3answers
952 views
My website has been hacked/attacked, says “reported attack page”
Three days back my website http://www.ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided ...
6
votes
4answers
179 views
Webhosting company able to unhash passwords?
Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
0
votes
0answers
36 views
Phishing alert but file never existed
I got an alert from Google Webmasters. They say the following file was present in my host:
example.com/~jhostgop/identity.php
I checked my files and it never existed at all.
I've experience this ...
3
votes
3answers
154 views
Why do websites require retyping the password upon user error in a registration form?
Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype.
I'm wondering if I ...
3
votes
1answer
531 views
What is the BCSI-CS-**** cookie for?
I'm undertaking an audit of the cookies we use on our external sites.
There's one cookie that's used by all the sites, and by different domains within the sites. It starts BCSI-CS- and has random ...
1
vote
1answer
88 views
extra configuration needed after installing SSL certificate?
We recently developed two rather simple PHP applications for AXA (European bank). URL's are axa.tfo.be/incentives/cipres and axa.tfo.be/incentives/zrkk (access to both sites is restricted to visitors ...
1
vote
0answers
45 views
What is the most secure environment for multiple CMS sites? [closed]
I wish to run about 50 Joomla or WordPress low-traffic websites on 1 server, or part of a server. Each website will be managed by its own, naive owner who will have be able to access the Joomla or ...
5
votes
3answers
536 views
Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?
I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app).
My thought was to create ...
4
votes
2answers
209 views
Combining a content management system with ASP.NET
I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
7
votes
3answers
937 views
Important fields in HTTP header from security perspective
What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
9
votes
3answers
2k views
what is wwws.site.com
I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example
https://wwws.site.com/login
1
vote
1answer
47 views
Multiple SSL certificates under one organization?
Now that I have my LLC formed, I intend to purchase several EV SSL certificates for a few of my popular online stores. My question is if it is possible to purchase and set up several EV SSL ...
0
votes
1answer
900 views
IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address
I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs. I have moved all my rules from my .htaccess to the Microsoft URL ReWrite module. ...
0
votes
0answers
59 views
cPanel's Web Disk - Security issues?
I'm thinking of using Web Disk (built into the later versions of cPanel) to allow a Windows or Mac computer to map a network drive that is actually a folder on our website (above the public_html ...
2
votes
2answers
111 views
Phpmyadmin http password security
Is my password sent unencrypted when using Phpmyadmin through http?
If not, is there any downside using http compared to https?
1
vote
2answers
45 views
Security risks posed by specifying technologies used
I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the ...
0
votes
0answers
264 views
blocking bad bots with robots.txt in 2012 [closed]
does it still work good? I have this:
# Generated using http://solidshellsecurity.com services
# Begin block Bad-Robots from robots.txt
User-agent: asterias
Disallow:/
User-agent: BackDoorBot/1.0
...
1
vote
0answers
21 views
open source plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
1
vote
1answer
109 views
Java/1.7.0_07 as user agent
almost every day something (it should be a bot) visits all of my pages on my website (amongst other things it doesn't correctly handle spaces in urls) with Java/1.7.0_07 (or different java versions) ...
4
votes
2answers
297 views
How would I tell if a prospective client website is under DDoS attack?
I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client.
Assuming I ...
1
vote
1answer
66 views
Website address hacked, emails created but not showing in manage your account
I have a website, thebleudoor.com. It is hosted by yahoo. It gets 2000-3000 hits a day and has been for at least 5 years.
A few months ago, as admin of the website, I started getting bounced back ...
4
votes
1answer
98 views
Allowing temporary access to cpanel for freelancer
I'm currently using a2hosting's cpanel on a shared hosting account. I'd like to temporarly give access to a freelance developper so he can upload some php files, csv files and create tables in my ...
1
vote
2answers
35 views
Blocking path scanning
I'm seeing in my access log a number of request very suspicious:
/i
/im
/imaa
/imag
/image
/images
/images/d
/images/di
/images/dis
They part from a known resource (in the above example ...
4
votes
2answers
174 views
Number of page requests by any Bot in 5 secs
I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
7
votes
5answers
376 views
Better Spam Protection than reCAPTCHA?
I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
1
vote
1answer
204 views
Good idea to use Google Sites for static content and custom PHP for dynamic
We have a site based upon Google Sites. Now we would like to create a login area (HTTPS) with a mixture of dynamic and static content. Is it a good idea to utilize Google Sites and use iFrames for the ...
3
votes
1answer
424 views
IIS Dynamic IP Restrictions Module and Googlebot
I consider using IIS Dynamic IP Restrictions Module in order to make it hard for DoS (Denial of Service) attacks. But I am not sure how that would work out for search engine bots like Googlebot.
Any ...
1
vote
1answer
83 views
get mysql_real_escape is giving me errors when I try and add security to my website [closed]
I tried doing this:
@ $db = new myConnectDB();
$beerName = mysql_real_escape_string($beerName);
$beerID = mysql_real_escape_string($beerID);
$brewery = mysql_real_escape_string($brewery);
$style = ...
2
votes
3answers
82 views
suspicious crawler activity
I'm noticing that I get accesses
66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
2answers
2k views
What kind of information can websites collect about a user/client?
This is a multi-part question:
1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website?
I know we log IP's, and can determine your ...
1
vote
0answers
36 views
Are there considerations for expiring SSL certs for inactive domains?
I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity.
However, soon a few of the SSL certs for the inactive domains are set to ...
4
votes
4answers
571 views
PCI DSS compliance for a VPS using Centos
I have a VPS with linode, great hosting by the way.
I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it.
But I have a ...
2
votes
2answers
385 views
Is making my PHP files read-only a useful security measure?
Up until now I've been "protecting" my website's PHP files by making them read-only with chmod.
Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time?
I'm ...
3
votes
2answers
128 views
Where should I redirect (removed) phishing pages
I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
0
votes
0answers
74 views
Where can I hire a trustworthy professional PHP programmer? [closed]
please delete the question as it is closed
1
vote
1answer
178 views
MCrypt Module, Rijndael-256
An outside company is redoing our company Intranet. During some basic usage I disovered that the "User Edit" screens, with the "Password: *" boxes have the password in plain text, with the text box ...
2
votes
3answers
78 views
How to safely collect bank account from website?
I want to collect bank account information from my customers on my website.
I'd like to do that trough a form, then I will download it to a PC, print it, and then delete it from the website. Or ...
3
votes
1answer
351 views
Is this safe? <a href=http://javascript:…>
I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://.
For example, is it possible to append javascript: ... ...
0
votes
3answers
195 views
Need private personal access to ~three PHP pages
I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...
0
votes
0answers
75 views
my website have been hacked/attacked [closed]
My website www.alittlepresent.co.uk was attacked yesterday morning and i have cleaned everythign off the FTP and reinstalled fresh copy of mybackup however they have done it again. is therea way of ...
7
votes
1answer
140 views
Is there any good reason I would want my website to be framed?
I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
0
votes
2answers
149 views
How does one block unsupported web browsers?
Web browsers with an end of life no longer receive security updates which not only makes them vulnerable to the end user, but I imagine its not safe for the server's which receive visits by them ...
7
votes
2answers
160 views
Does the 'Server' header serve any purpose?
For example, when I dump the response header for my server I get:
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Is this used for anything? Is ...
3
votes
1answer
418 views
Does MSIE recognise StartCom as an SSL Certificate Authority?
Ok, so I'm thinking about getting in on the SSL action, so that my sites can be secure etc, and after hours of shopping for the best priced certificate, I find out that StartSSL offer a free one.
One ...
3
votes
3answers
152 views
Is there a way to scan websites externally for the recent PHP CGI flaw?
The recent PHP CGI flaw exposed (CVE-2012-1823) has me wondering if some of the legacy sites that I've inherited might be vulnerable. (see Physorg article)
Does anybody know of a means to externally ...
1
vote
1answer
120 views
How to deal with malicious domain redirections?
It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
1
vote
0answers
32 views
Security concerns for hosting a .NET website [closed]
Is the default configuration of Windows Server 2003 with IIS 6 and .NET 4 sufficient for security if I keep up to date with security updates? (assuming my code does not create any security holes).
