Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

3
votes
1answer
439 views

Is this safe? <a href=http://javascript:…>

I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://. For example, is it possible to append javascript: ... ...
0
votes
3answers
205 views

Need private personal access to ~three PHP pages

I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...
7
votes
1answer
151 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
0
votes
2answers
407 views

How does one block unsupported web browsers?

Web browsers with an end of life no longer receive security updates which not only makes them vulnerable to the end user, but I imagine its not safe for the server's which receive visits by them ...
8
votes
2answers
249 views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
3
votes
1answer
735 views

Does MSIE recognise StartCom as an SSL Certificate Authority?

Ok, so I'm thinking about getting in on the SSL action, so that my sites can be secure etc, and after hours of shopping for the best priced certificate, I find out that StartSSL offer a free one. One ...
3
votes
3answers
237 views

Is there a way to scan websites externally for the recent PHP CGI flaw?

The recent PHP CGI flaw exposed (CVE-2012-1823) has me wondering if some of the legacy sites that I've inherited might be vulnerable. (see Physorg article) Does anybody know of a means to externally ...
1
vote
1answer
152 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
1
vote
0answers
33 views

Security concerns for hosting a .NET website [closed]

Is the default configuration of Windows Server 2003 with IIS 6 and .NET 4 sufficient for security if I keep up to date with security updates? (assuming my code does not create any security holes).
1
vote
0answers
145 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
5
votes
4answers
459 views

How to protect SHTML pages from crawlers/spiders/scrapers?

I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers. I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
6
votes
1answer
105 views

What secure domain registry services exist?

I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
1
vote
2answers
178 views

Proper password handling for login

I have read a lot about PHP login security recently, but many questions on Stack Overflow regarding security are outdated. I understand bcrypt is one of the best ways of hashing passwords today. ...
1
vote
0answers
34 views

White hat security community [closed]

A while ago I remember there existed a community of savvy people who would probe a server for common vulnerabilities, this was a voluntary project but not even google can help me find it, I was hoping ...
4
votes
1answer
166 views

Best way to protect public facing development environments?

We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house. But here's the ...
0
votes
1answer
369 views

How to deal with attacks on Zend Framework web site? site currently down

This is my first question on this "forum" please be indulgent with me if my questions are somewhat too simplistic for you. i joined this community in order to improve myself and help others.Thank you. ...
2
votes
1answer
314 views

DNS name/host-header specific url-pattern/security-constraint, to not require SSL with Tomcat6

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml: <security-constraint> <web-resource-collection> ...
3
votes
1answer
108 views

SiteAdvisor advice?

At the time I submitted my site for testing with McAfee's Site Advisor as I noticed my site received a bad review as a spam/scam site. See here . From a development perspective, how important are ...
6
votes
2answers
145 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
1
vote
1answer
2k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
3
votes
2answers
1k views

Is Someone Hijacking My Site?

I'm quite baffled by this issue and I have absolutely no idea what could be causing it. I have a Wordpress website that has been working fine, until for some reason, the admin panel started to screw ...
1
vote
1answer
478 views

Is the php method md5() secure? Can it be used for passwords? [closed]

So executing a php script causes the form values to be sent to the server, and then they are processed. If you want to store a password in your db than you want it to be a cryptographic hash(so ...
1
vote
2answers
369 views

How to fix some damages from site hack?

My site had been hacked. I found vulnerability,fixed it, and removed shell scripts. But hacker had uploaded thousands of web pages on my web server. after I removed those pages I got over 4 thousand ...
1
vote
3answers
897 views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
4
votes
2answers
338 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
5
votes
2answers
178 views

Managing accounts on a private website for a real-life community

I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
2
votes
1answer
275 views

How to monitor outgoing server activity to detect malware?

I have a website that has previously been victim of malware. I restored the site from an old backup and have made every effort to lock down the server. I have no way to be absolutely certain that the ...
5
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
2
votes
3answers
2k views

How to restrict site access to all countries except mine with .htaccess?

I used this tool to download list in ".htaccess allow" format to allow traffic from my country and restrict all others but it's still accessible when visiting from bunch of foreign proxies. I'm ...
7
votes
3answers
117 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
3
votes
1answer
100 views

Do I need an SSL Certificate?

I'm thinking about building an app that lets users upload images to sites like Flickr. They would need to enter their password to do this. I would send the data through PHP, do I need to get a SSL ...
0
votes
1answer
65 views

Can I host my PHP app in such a way that users can verify the source code being used by the server?

I have worked with one other person created a mobile-optimized web proxy to the League of Legends Tribunal (a peer review system). Riot Games, the creators of LoL, made a really nice web interface ...
2
votes
2answers
63 views

Securing Access to Server [closed]

We have servers at an ISP and a firewall in place. At our main office, we have a VPN. For an added layer of security, I'm thinking a good model may be to have developers connect to the corporate VPN ...
2
votes
2answers
413 views

Should WHMCS hacking attemps that never succeed be important to me?

I have WHMCS and I use it with no problem for my hosting purposes. Almost every 2 or 3 days, I can see a spam with malicious content submitted as a new ticket that tries to hack. The last one was: ...
4
votes
3answers
207 views

Are files in a hidden directory safe?

I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
0
votes
2answers
535 views

Hacked .htaccess - Inconsistent Results

At present a large number of .htaccess files are being created in various website folders throughout the site. Current .htaccess files are also being modified to include the following (cleaned up) ...
1
vote
1answer
727 views

How to integrate Paypal Direct Payment (i.e. Paypal Pro) with custom shopping cart application?

I've written a basic shopping cart application that is fully functional except for the payment process. I have decided to use PayPal Direct Payment, or "PayPal Pro," but am unsure of how to integrate ...
0
votes
1answer
45 views

Content Delivery Policy setup

I want to secure my website using a Content Security Policy. I'm came up with the following policy: X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; ...
2
votes
2answers
105 views

Should I store address in encrypted form?

What are the general rules relating to address fields and others. I only store password in encrypted form, the rest are not. Email is also used during login. Can someone give me a suggestion related ...
2
votes
1answer
2k views

How can mixed content compromise an entire HTTPS session?

Google Chrome is probably one of the stricter browsers out there in terms of highlighting SSL errors. Most browsers will point out when you are viewing an HTTPS page which loads insecure ...
2
votes
2answers
49 views

How transparent is a randomly named directory or file? [duplicate]

Possible Duplicate: Are files in a hidden directory safe? Let's pretend that I have a website and want to keep personal notes on it. If I make a directory like mysite.com/84eW93e7 or ...
2
votes
3answers
358 views

What is necessary to implement HTTPS?

I'm an iPhone Developer and I've recently got into web development. At the moment I have two sites on the internet, and on one of them, I have a very simplistic CMS I've made. Firstly, do I need to ...
1
vote
1answer
349 views

Should I make pages on my website accessible by the admin only? How do I do it?

In my website idea I have got a number of pages that should be accessible by the admin only. Is this a good practice? (amateur alert) Also how do I protect these pages? I know about if ...
2
votes
2answers
113 views

Hacking resources

I'm currently developing a web application which has a lot of javascript working behind it. Before I deploy it (which will take a couple of months), I want to make sure that it is atleast a bit ...
2
votes
1answer
351 views

Configuring directory access on a server. .htaccess and alternatives?

I have written a small PHP package/site-template (should I say). It contains a directory data/ that contains some important files that the users should not be able to see. These file should however ...
35
votes
9answers
2k views

Tools to check for common vulnerabilities?

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
2
votes
1answer
2k views

Force directory listing even if index.html is present

I have some files in my /www/ directory. Is it true that by simply putting an index.html into that directory, the rest of the files are now "protected from public"? Could an outside hacker still force ...
1
vote
0answers
93 views

Just bought a domain, setting up a couple server applications for the first time [closed]

I recently bought a domain, mainly for website experimentation, game servers and a ventrillo server. I'm running all this from my home computer, and I am using freedns.afraid.org as my dns nameserver. ...
0
votes
1answer
201 views

How to protect the contact us page from spammers? Even using captcha, validation etc I sitll receive spam letters

I have on my site, every field validation + captcha protection + math validation + server scripting validation, but still this a spammer keeps sending me spam mails. Is there any better smarter ...
1
vote
2answers
113 views

Opensource package for securly allowing users to log in and provide information

I have a site written in mostly php and html. I also have a sql database of personal information like names and addresses. I would like my users to be able to log in to my website with a login I can ...