Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

6
votes
1answer
598 views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
4
votes
4answers
261 views
3
votes
2answers
134 views

Implications on automatically “open” third party domain aliasing to one of my subdomains

I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users. In this portal users cooperate in a wiki way to build some "kind of software". These software ...
2
votes
2answers
216 views

Any suggestions for a change detection system?

As a webdesigner/webmaster I'm taking care of various websites. Recently one client's website got "hacked". It turned out that at their office one computer got infected by a trojan, that spied the ftp ...
4
votes
1answer
141 views

Website still blocked after hack

I manage a website that was hacked a few months ago (I wasn't the webmaster then), it was running on Joomla. I have manages to redo the website with custom codes (php/mysql), but it still some ...
2
votes
1answer
1k views

How to log username in Apache logs?

I need some help regarding how to log the user-name into apache logs. I'm building a use-case for Security Information Event Management. Is the method the same in case of IIS or just applicable to ...
0
votes
0answers
228 views

SIMPLEST way to set up password protection for a static site, with basic admin UI?

I have a static site. I would like the simplest approach to password protecting a directory, with a basic admin UI for adding/removing users. I will have so few users that I don't care about ...
1
vote
1answer
601 views

SSL on multiple directories

I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
4
votes
2answers
98 views

What measures should I take after I find one of my scripts being vulnerable?

I maintain a few PHP-based websites for a small company on a LAMP server. The scripts include CMS such as Joomla or Wordpress, as well as SilverStripe and Drupal installations. A week ago, I found ...
5
votes
1answer
2k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
1
vote
1answer
201 views

www.foobar.com works but foobar.com results in a 'Server not found' error

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file: <VirtualHost *:80> ServerName foobar.com ServerAlias ...
4
votes
5answers
869 views

Site compromised .htaccess files everywhere

Some of the sites we're hosting are compromised by... I don't know what. Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
2
votes
1answer
457 views

Tell apache to point to a subfolder as default starting point for public

What would be the different methods of telling Apache to serve up httpdocs/public instead of httpdocs as the default starting point? I want to be able to have my includes and logs directories behind ...
1
vote
2answers
546 views

How to block malicious requests before they reach Apache?

I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
2
votes
1answer
500 views

Pass IMG SRC via GET and echo it? Is that really secure?

I was wondering how I can make a really simple GET and echo request more secure The code: $src = $_GET['src']; echo "<img src='$src' />"; Basically, I have a URL like ...
3
votes
2answers
97 views

How to safely saving users' data and NOT get responsibility of users' data?

I am programming a website which will save up users' inputs for their next visits. For example, I might save their phone numbers. The user will know that I save their phone numbers. However, do I need ...
1
vote
2answers
694 views

GWT “Big traffic change for top URL”

I recently received an email from GWT saying that one of my URL's traffic has suddenly dropped. As it turned out the traffic to the whole site has drastically dropped, from some 300+ unique visitors ...
1
vote
1answer
28 views

Compromised private RSA key

What sorts of problems can be caused by a compromised private RSA key? Is this even that big of a deal? I'm getting very little specific info on Google. :(
1
vote
1answer
67 views

How to set a 1-order-per-PC limit on my website?

On my website people can order free coupons for my local service. I would like to set a limit of 1 coupon order per PC. Can someone suggest a way to implement this, even if the visitor would delete ...
7
votes
4answers
213 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
4
votes
3answers
303 views

Why do websites require retyping the password upon user error in a registration form?

Many times, when you fill out a registration form and miss a required field, the form reloads with all the fields filled out except for the password which you have to retype. I'm wondering if I ...
3
votes
1answer
2k views

What is the BCSI-CS-**** cookie for?

I'm undertaking an audit of the cookies we use on our external sites. There's one cookie that's used by all the sites, and by different domains within the sites. It starts BCSI-CS- and has random ...
1
vote
0answers
74 views

What is the most secure environment for multiple CMS sites? [closed]

I wish to run about 50 Joomla or WordPress low-traffic websites on 1 server, or part of a server. Each website will be managed by its own, naive owner who will have be able to access the Joomla or ...
5
votes
3answers
811 views

Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app). My thought was to create ...
4
votes
2answers
406 views

Combining a content management system with ASP.NET

I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
7
votes
3answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
10
votes
3answers
3k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
1
vote
1answer
58 views

Multiple SSL certificates under one organization?

Now that I have my LLC formed, I intend to purchase several EV SSL certificates for a few of my popular online stores. My question is if it is possible to purchase and set up several EV SSL ...
0
votes
1answer
1k views

IIS7.5 + Wordpress + Restrict Access to wp-login.php by client IP address

I am moving from an Apache host to IIS. One of my sites in Wordpress (running Multi-site) which give me multiple blogs. I have moved all my rules from my .htaccess to the Microsoft URL ReWrite module. ...
2
votes
2answers
253 views

Phpmyadmin http password security

Is my password sent unencrypted when using Phpmyadmin through http? If not, is there any downside using http compared to https?
1
vote
2answers
47 views

Security risks posed by specifying technologies used

I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the ...
1
vote
0answers
26 views

open source plugins,scripts store information? [closed]

I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin. If so, is there any plugin which can detect which website ...
2
votes
1answer
164 views

Java/1.7.0_07 as user agent

almost every day something (it should be a bot) visits all of my pages on my website (amongst other things it doesn't correctly handle spaces in urls) with Java/1.7.0_07 (or different java versions) ...
4
votes
2answers
413 views

How would I tell if a prospective client website is under DDoS attack?

I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client. Assuming I ...
1
vote
1answer
71 views

Website address hacked, emails created but not showing in manage your account

I have a website, thebleudoor.com. It is hosted by yahoo. It gets 2000-3000 hits a day and has been for at least 5 years. A few months ago, as admin of the website, I started getting bounced back ...
4
votes
1answer
225 views

Allowing temporary access to cpanel for freelancer

I'm currently using a2hosting's cpanel on a shared hosting account. I'd like to temporarly give access to a freelance developper so he can upload some php files, csv files and create tables in my ...
1
vote
2answers
41 views

Blocking path scanning

I'm seeing in my access log a number of request very suspicious: /i /im /imaa /imag /image /images /images/d /images/di /images/dis They part from a known resource (in the above example ...
4
votes
2answers
628 views

Number of page requests by any Bot in 5 secs

I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
7
votes
5answers
612 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
1
vote
1answer
415 views

Good idea to use Google Sites for static content and custom PHP for dynamic

We have a site based upon Google Sites. Now we would like to create a login area (HTTPS) with a mixture of dynamic and static content. Is it a good idea to utilize Google Sites and use iFrames for the ...
4
votes
1answer
1k views

IIS Dynamic IP Restrictions Module and Googlebot

I consider using IIS Dynamic IP Restrictions Module in order to make it hard for DoS (Denial of Service) attacks. But I am not sure how that would work out for search engine bots like Googlebot. Any ...
1
vote
1answer
160 views

get mysql_real_escape is giving me errors when I try and add security to my website [closed]

I tried doing this: @ $db = new myConnectDB(); $beerName = mysql_real_escape_string($beerName); $beerID = mysql_real_escape_string($beerID); $brewery = mysql_real_escape_string($brewery); $style = ...
2
votes
3answers
93 views

suspicious crawler activity

I'm noticing that I get accesses 66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
1
vote
2answers
4k views

What kind of information can websites collect about a user/client?

This is a multi-part question: 1) What kind of information can websites collect about someone (someone's computer or device) when they visit your website? I know we log IP's, and can determine your ...
4
votes
4answers
953 views

PCI DSS compliance for a VPS using Centos

I have a VPS with linode, great hosting by the way. I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it. But I have a ...
2
votes
2answers
837 views

Is making my PHP files read-only a useful security measure?

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod. Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time? I'm ...
3
votes
2answers
146 views

Where should I redirect (removed) phishing pages

I was unfortunately the victim of a PHP exploit. Looking through my webserver logs, people are still attempting to reach the URL used in the phish. I want to redirect them to a site that will educate ...
1
vote
1answer
256 views

MCrypt Module, Rijndael-256

An outside company is redoing our company Intranet. During some basic usage I disovered that the "User Edit" screens, with the "Password: *" boxes have the password in plain text, with the text box ...
3
votes
1answer
529 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
0
votes
3answers
205 views

Need private personal access to ~three PHP pages

I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...