Preventing a system from unauthorized access, modification, disruption, or destruction.
1
vote
2answers
404 views
How to block malicious requests before they reach Apache?
I have a RESTful web service that gets hit by a large number of requests coming from various IPs with dummy logins and random inputs. I have already denied these requests at the HTTP level (using the ...
9
votes
1answer
294 views
Why chmod 777 is not secure?
chmod 777 file change the permissions of the file file to read, write,
and execute for all.
Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
1
vote
2answers
59 views
Account suspension on SMS [closed]
Hy Hello all, I have an idea to implement but I hate to copy if it is been used by any other website(s). My idea is about suspending an account using text SMS. The description follows.
When a user ...
1
vote
1answer
54 views
How can a website survive an untrusted environment?
Let's say I have an internal website that holds pretty important data (well, contest strategies for stuff like FIRST), which I am bound to host on a Windows server with literally no security. I can't ...
2
votes
0answers
125 views
Fake Windows Security Alert [closed]
I have a website which is redirecting users to a fake windows security alert and I'm not to sure how to get rid of it. What's weird is that it's only happening in IE and that it seems to happen the ...
1
vote
1answer
72 views
Anonymous website [duplicate]
Possible Duplicate:
How hard is to be the anonymous owner of a website?
Is it possible to setup a website anonymously?
I want to setup a domain and hosting but I don't want people to be ...
2
votes
2answers
111 views
Hacking resources
I'm currently developing a web application which has a lot of javascript working behind it. Before I deploy it (which will take a couple of months), I want to make sure that it is atleast a bit ...
2
votes
3answers
82 views
suspicious crawler activity
I'm noticing that I get accesses
66.249.66.198 - - [01/Jul/2011:17:13:46 +0200] "GET /img/clip.incubus.torrent.phtml HTTP/1.1" 404 143 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; ...
3
votes
2answers
295 views
PCI compliance when using third-party processing
My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
110 views
Deny access to a folder on hosting server but serve the pages
My hosting server allows to host multiple websites.
The directory structure is like this
root
|_ www.a.com
|_ www.b.com
|_ www.c.com
|_ www.d.com
I want to put some PHP files on the www.d.com ...
5
votes
1answer
86 views
Is it necessary for a web developer to know how to hack website?
I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
298 views
client website compromised, found a strange .php file. any ideas?
I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
2
votes
3answers
963 views
Do internal intranet websites need to be secure?
The question is in the title.
Does an internal site need to have https security?
For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
1
vote
1answer
90 views
Site overthrown by Turkish hackers
Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
5
votes
1answer
238 views
A bounce-rate attack to manipulate SEO?
This is a question to experienced people that might help us shed some light on the issue.
We noticed a very strange behavior on our site, in Google Analytics.
Some dude from Finland, namely, from ...
2
votes
1answer
74 views
Are there any risks involved in Hosting your website on free webhosts?
I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting?
...
0
votes
1answer
250 views
someone was able to upload php files without ftp access to my server
I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
92 views
Ultimate security checklist
I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got:
-use SSL to protect authenticated content
-tighten the server TCP/IP ...
4
votes
4answers
572 views
PCI DSS compliance for a VPS using Centos
I have a VPS with linode, great hosting by the way.
I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it.
But I have a ...
5
votes
2answers
318 views
Online gift certificates: Systems to avoid fraud
What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)?
I'm looking to ...
4
votes
2answers
102 views
How to prevent stat sites from getting/publishing my traffic and hosting information?
When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc.
I removed google ...
0
votes
1answer
114 views
Apache webserver user setup and security issues
I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time.
New question
Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
111 views
What are recommended password reset mecanisms?
All,
I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority:
1) User friendly;
...
4
votes
4answers
402 views
How to protect SHTML pages from crawlers/spiders/scrapers?
I have A LOT of SHTML pages I want to protect from crawlers, spiders & scrapers.
I understand the limitations of SSIs. An implementation of the following can be suggested in conjunction with any ...
5
votes
3answers
537 views
Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?
I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app).
My thought was to create ...
3
votes
2answers
185 views
I found a SQL injection bug on a public facing website, what should I do?
I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
3
votes
2answers
926 views
What does this code mean that was placed in my hacked Web site?
My website was hacked, with the following code added to the end of the page:
<img heigth="1" width="1" border="0"
src="http://imgddd.net/t.php?id=########">
(The id had an 8 digit ...
0
votes
3answers
163 views
File Access Permission
I need to upload a file to site with PHP code. How to set permission for upload folder if I want to users cant access to file by URL but PHP code read this file ?
1
vote
0answers
134 views
Is posting a document with a hand signature insecure? [closed]
Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
91 views
How Do You Store Website Backups?
I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive.
I was thinking of ...
4
votes
2answers
131 views
what is website security verification?
I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means.
I saw this and I am a bit ...
9
votes
1answer
245 views
Is an externally-hosted subdomain a security risk?
A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
1
vote
1answer
6k views
.htaccess password protection generates 500 internal server error
I have created a .htpasswd file using htaccess tools of which I have uploaded to the root of my web hosting space (/public_html is my web root).
I created a .htaccess file which referenced the ...
2
votes
1answer
799 views
How do I save user uploaded files outside of the web folder but use them on my page?
I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
3
votes
1answer
351 views
Is this safe? <a href=http://javascript:…>
I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://.
For example, is it possible to append javascript: ... ...
2
votes
1answer
243 views
How Do I Prevent Users from Accessing a Page More Then Once?
Hi
I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
3answers
62 views
Website security
I have a website which uses membership/roles for security. However, I really want this site to be secure. My concern is one day something happens to server and the membership/roles is turned off.
Is ...
1
vote
1answer
558 views
What is best practice for securing access to GMail for an enterprise?
Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate ...
2
votes
2answers
328 views
Keeping files private on the internet (.htaccess password or software/php/wordpress password)
I was asked a while ago to setup a server such that only authenticated users can access files. It was like a test server for clients to view WIP sites. More recently, I want to do something similar ...
8
votes
8answers
337 views
What are the reasons to have a two step login? (Username on one page, password on the second.)
So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
9
votes
3answers
2k views
what is wwws.site.com
I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example
https://wwws.site.com/login
0
votes
3answers
298 views
MODX based site has been compromised, and tagged by Google as malware
I'm the webmaster (inherited the site from the developer) for a site called kenbrook.org. The site is currently being tagged as malware infected by Google, and gives the following details: ...
2
votes
2answers
121 views
Implications on automatically “open” third party domain aliasing to one of my subdomains
I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users.
In this portal users cooperate in a wiki way to build some "kind of software".
These software ...
3
votes
1answer
203 views
User registration usability vs security
What are cons and pros of the following:
asking to repeat password
asking to have a certain length-password
asking to repeat e-mail address
using captcha
sending confirmation e-mail
what do you ...
1
vote
3answers
105 views
What are some internet trends that you've noticed over the past ~10 years? [closed]
I'll give an example of one that I've noticed: the number of web sites that ask for your email address (GOOG ID, YAHOO! ID, etc.) has skyrocketed.
I can come up with no legitimate reason for this ...
0
votes
2answers
272 views
block users by country in .htaccess
Is there a way to block users from a particular region. Currently I have compiled a list of over 100 IP addresses that I block in my .htaccess file. Unfortunately as the list grows I see a great ...
2
votes
1answer
179 views
Is SimplePHPBlog a secure blogging engine?
Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database).
My problem with it is that the content directory where the texts files are stored ...
2
votes
1answer
151 views
A single request appears to have come from all the browsers? Should I be worried?
I was looking over my site access logs when I noticed a request with the following user agent string:
"Mozilla/5.0 (Windows; U; Windows NT
5.1; en-US; rv:1.9.2.12) Gecko/20101026
...
2
votes
1answer
314 views
Trigger IP ban based on request of given file?
I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore.
As such with major public vulnerabilities, it seems ...
3
votes
5answers
2k views
Disallow robots.txt from being accessed in a browser but still accessible by spiders?
We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't ...
