Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
2answers
48 views

Security risks posed by specifying technologies used

I am developing on-line tools for non-commercial use, which are hosted on dedicated hardware. I would like to include logos indicating the technologies I used (Apache or Python for example), at the ...
1
vote
0answers
26 views

open source plugins,scripts store information? [closed]

I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin. If so, is there any plugin which can detect which website ...
5
votes
2answers
441 views

Combining a content management system with ASP.NET

I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
1
vote
2answers
114 views

1024 bit to 2048 bit certificate differences in how we access our portal

Why now that we have gone from 1024 to 2048 do we need to put the www in front of our portal site when we never used to.
2
votes
1answer
179 views

Java/1.7.0_07 as user agent

almost every day something (it should be a bot) visits all of my pages on my website (amongst other things it doesn't correctly handle spaces in urls) with Java/1.7.0_07 (or different java versions) ...
12
votes
2answers
4k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
1
vote
1answer
71 views

Website address hacked, emails created but not showing in manage your account

I have a website, thebleudoor.com. It is hosted by yahoo. It gets 2000-3000 hits a day and has been for at least 5 years. A few months ago, as admin of the website, I started getting bounced back ...
4
votes
1answer
259 views

Allowing temporary access to cpanel for freelancer

I'm currently using a2hosting's cpanel on a shared hosting account. I'd like to temporarly give access to a freelance developper so he can upload some php files, csv files and create tables in my ...
2
votes
1answer
65 views

Password protected website

I need to add a user authentication page before the actual homepage of the website. In Joomla! I just set the website offline and the offline page loads in place of the homepage but then it's ...
4
votes
2answers
755 views

Number of page requests by any Bot in 5 secs

I am writing a script that will block any bot that requests page(s) for example X times in the past 5 secs. I need to find the X here. Do you guys know some approx values I can use?
1
vote
1answer
438 views

Good idea to use Google Sites for static content and custom PHP for dynamic

We have a site based upon Google Sites. Now we would like to create a login area (HTTPS) with a mixture of dynamic and static content. Is it a good idea to utilize Google Sites and use iFrames for the ...
0
votes
0answers
260 views

SIMPLEST way to set up password protection for a static site, with basic admin UI?

I have a static site. I would like the simplest approach to password protecting a directory, with a basic admin UI for adding/removing users. I will have so few users that I don't care about ...
1
vote
1answer
176 views

get mysql_real_escape is giving me errors when I try and add security to my website [closed]

I tried doing this: @ $db = new myConnectDB(); $beerName = mysql_real_escape_string($beerName); $beerID = mysql_real_escape_string($beerID); $brewery = mysql_real_escape_string($brewery); $style = ...
1
vote
1answer
52 views

Are there considerations for expiring SSL certs for inactive domains?

I have a few domains that have effectively been "retired" though our company plans to keep them registered in perpetuity. However, soon a few of the SSL certs for the inactive domains are set to ...
3
votes
1answer
2k views

What is the BCSI-CS-**** cookie for?

I'm undertaking an audit of the cookies we use on our external sites. There's one cookie that's used by all the sites, and by different domains within the sites. It starts BCSI-CS- and has random ...
2
votes
2answers
913 views

Is making my PHP files read-only a useful security measure?

Up until now I've been "protecting" my website's PHP files by making them read-only with chmod. Is this a useful security tactic? Or is it some "old wive's tale" and I'm wasting my time? I'm ...
5
votes
4answers
2k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
1
vote
1answer
262 views

MCrypt Module, Rijndael-256

An outside company is redoing our company Intranet. During some basic usage I disovered that the "User Edit" screens, with the "Password: *" boxes have the password in plain text, with the text box ...
2
votes
3answers
92 views

How to safely collect bank account from website and without an external gateway payment system

I want to collect bank account information from my customers on my website. I would like to do this using a online form, then I will download it to a PC, print it and then delete it from the website. ...
3
votes
1answer
1k views

How to protect Google Ads from yontoo layers runtime?

Since sometime I have observed that Google Ads on any website including my blog (http://blogs.digitss.com) gets replaced with something similar to uploaded image below. I am sure it's happening with ...
7
votes
1answer
157 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
0
votes
3answers
208 views

Need private personal access to ~three PHP pages

I would like secure access to the text output by three PHP scripts (the text output is JavaScript and html) . The security level is much less then financial data but important none-the-less. I have ...
0
votes
2answers
654 views

How does one block unsupported web browsers?

Web browsers with an end of life no longer receive security updates which not only makes them vulnerable to the end user, but I imagine its not safe for the server's which receive visits by them ...
3
votes
1answer
908 views

Does MSIE recognise StartCom as an SSL Certificate Authority?

Ok, so I'm thinking about getting in on the SSL action, so that my sites can be secure etc, and after hours of shopping for the best priced certificate, I find out that StartSSL offer a free one. One ...
1
vote
0answers
34 views

Security concerns for hosting a .NET website [closed]

Is the default configuration of Windows Server 2003 with IIS 6 and .NET 4 sufficient for security if I keep up to date with security updates? (assuming my code does not create any security holes).
2
votes
1answer
1k views

Fail2Ban & Port-Scanning

Is there any filter built into Fail2Ban to temporarily ban any IP addresses which attempt port scanning activities (provided that iptables logs these activities)?
1
vote
1answer
164 views

Permissions & File Structure w/ nginx & multiple sites

I am using nginx for the first time as a long time Apache user. I setup a Linode to test everything and to eventually port over my websites. Previously I had /home/user/www (wwwroot) I am looking ...
1
vote
2answers
188 views

Proper password handling for login

I have read a lot about PHP login security recently, but many questions on Stack Overflow regarding security are outdated. I understand bcrypt is one of the best ways of hashing passwords today. ...
1
vote
0answers
36 views

White hat security community [closed]

A while ago I remember there existed a community of savvy people who would probe a server for common vulnerabilities, this was a voluntary project but not even google can help me find it, I was hoping ...
1
vote
2answers
509 views

“only secured content is displayed”

I have a question, I just had a SSL certificate installed on my drupal site using shared hosting... and on the front page now it says "only secured content is displayed" in IE. How do I find which ...
1
vote
1answer
695 views

SSL on multiple directories

I have a website that is http, but has a port set up for https for a specific directory that is for the shopping cart. Now I'd like to use our SSL on a different directory in the same site as well. ...
2
votes
1answer
488 views

Tell apache to point to a subfolder as default starting point for public

What would be the different methods of telling Apache to serve up httpdocs/public instead of httpdocs as the default starting point? I want to be able to have my includes and logs directories behind ...
4
votes
1answer
183 views

Best way to protect public facing development environments?

We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house. But here's the ...
0
votes
1answer
504 views

How to deal with attacks on Zend Framework web site? site currently down

This is my first question on this "forum" please be indulgent with me if my questions are somewhat too simplistic for you. i joined this community in order to improve myself and help others.Thank you. ...
2
votes
1answer
379 views

DNS name/host-header specific url-pattern/security-constraint, to not require SSL with Tomcat6

I am needing to enable SSL on an application hosted through Tomcat6 and I have added the following to the tomcat web.xml: <security-constraint> <web-resource-collection> ...
3
votes
3answers
280 views

Is there a way to scan websites externally for the recent PHP CGI flaw?

The recent PHP CGI flaw exposed (CVE-2012-1823) has me wondering if some of the legacy sites that I've inherited might be vulnerable. (see Physorg article) Does anybody know of a means to externally ...
3
votes
3answers
217 views

How to deal with malicious domain redirections?

It is possible for anybody to buy a domain name containing negative terms and point it to someone's website in order to damage their reputation. For instance someone could buy the domain ...
2
votes
1answer
822 views

How to properly deny Railo directory access through Apache

I've been battle tested on this and failed to achieve my goal which is to deny all access to all directories except the Public directory and only allow access to all all other directories with ...
1
vote
2answers
4k views

prevent IIS from executing scripts in a specific directory

I have a php web application that allows file uploads to a specific directory. I would like to prevent the execution of any file that is uploaded into that directory whether it is ASP, PHP, or ...
1
vote
1answer
655 views

Is the php method md5() secure? Can it be used for passwords? [closed]

So executing a php script causes the form values to be sent to the server, and then they are processed. If you want to store a password in your db than you want it to be a cryptographic hash(so ...
1
vote
3answers
534 views

I own a domain name. Can people view my personal registered info?

Is my information protected? Or can someone tell where I live by my domain name? Why do hosting services offer a protected information service for extra money? How can I view that information?
1
vote
1answer
203 views

www.foobar.com works but foobar.com results in a 'Server not found' error

I have just setup a minimal (hopefully secure? - comments welcome) apache website using the following configuration file: <VirtualHost *:80> ServerName foobar.com ServerAlias ...
1
vote
2answers
391 views

How to fix some damages from site hack?

My site had been hacked. I found vulnerability,fixed it, and removed shell scripts. But hacker had uploaded thousands of web pages on my web server. after I removed those pages I got over 4 thousand ...
1
vote
3answers
1k views

How to prevent Google from finding my admin index page?

I am running a website but for some days i stopped it and put the under-construction page because the Index of admin page is visible to the outside world through the Google search. One of my friend ...
5
votes
1answer
2k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
4
votes
2answers
388 views

How to use the private and public keys?

I am new to ssl certificates, i wanted to learn about ssl certificates, and I generated private and public keys myself while logged into cpanel, I wonder how to use those and generate a secured ...
10
votes
2answers
571 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
2
votes
3answers
3k views

How to restrict site access to all countries except mine with .htaccess?

I used this tool to download list in ".htaccess allow" format to allow traffic from my country and restrict all others but it's still accessible when visiting from bunch of foreign proxies. I'm ...
7
votes
3answers
123 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
4
votes
2answers
431 views

How would I tell if a prospective client website is under DDoS attack?

I have a person asking me whether the DDoS Mitigation Service they're using is worth it. This is out of my expertise, but clearly at some point someone sold this service to the client. Assuming I ...