Preventing a system from unauthorized access, modification, disruption, or destruction.
0
votes
1answer
114 views
Free forum engine with good anti-attack mechanisms [duplicate]
Possible Duplicate:
What Forum Software should I use?
I am looking for forum engine (for discussions) with good attack countermeasures built in. Windows (preferrably) or Linux. Free (as ...
1
vote
3answers
950 views
My website has been hacked/attacked, says “reported attack page”
Three days back my website http://www.ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided ...
0
votes
1answer
235 views
Developing payment gateway
I have an idea of developing internet payment gateway similar to PayPal or Webmoney. Since i'm only sophomore at Computer Science, and i've only taken intermediate programming classes, i've no idea ...
1
vote
1answer
99 views
Is there a way of listing files for a directory if it contains index.html?
On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get:
Index of /images
Parent Directory
BirdsAreHere.png
...
7
votes
3answers
173 views
How should a site respond to automated login attempts with phony usernames?
For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
1
vote
3answers
174 views
Are there any security considerations if users are allowed to upload flash files
Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
62 views
Problematic using Captcha on billing page
I have simple captcha on user page. I want make it refresh if user input incorrect captcha, I just wanna ask Should I do it or I just add a simple button to refresh it.
1
vote
1answer
98 views
What is the purpose of the appserv_root requests?
I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code.
I am pretty ...
0
votes
1answer
135 views
Why does my certificate provider ask me to disable its root certificate?
I received an SSL certificate from GoDaddy yesterday and their instructions to install the certificate seemed weird. To be precise, they asked me to disable their root certificate in server.
NOTE: ...
4
votes
2answers
179 views
Any tools for measuring the security of a site?
I'm wondering is there any tool for measuring or testing the security of a website ?
I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
3
votes
1answer
61 views
Cost effective way to provide static media content
I'd like to be able to deliver around 50MB of static content, either in about 30 individual files up to 10MB or grouped into 3 compressed files, around 5k to 20k times a day. Ideally I'd like to put ...
1
vote
1answer
481 views
Significant number of non-HTTP requests hitting my site
I'm seeing a significant number of non-HTTP requests hitting a site I just launched. They show up in the server (nginx) logs as non-ASCII and get rejected (correctly) with a 400 status. Here are ...
5
votes
2answers
168 views
Managing accounts on a private website for a real-life community
I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
1
vote
3answers
119 views
Security considerations for my first eStore
I have a website through which I am going to sell few products. It is hosted on a simple shared-hosting and does not have SSL.
On the products page, each product has a Buy Now button created from my ...
2
votes
1answer
320 views
How to improve WOT score of a site?
I don't understand why my site Trustworthiness and Vendor Reliability are considered bad by WOT.
I do not have ADS, I never spammed my site around, I do not have links that point to untrusted sites. ...
4
votes
2answers
300 views
How does amazon get away without verifying emails?
I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice ...
0
votes
1answer
1k views
Best free Vulnerability Scanners that check your websites PHP & MySQL code? [duplicate]
Possible Duplicate:
Best free Vulnerability Scanners that check your websites PHP & MySQL code?
I'm looking for a free vulnerability scanner to check whether my website has common ...
2
votes
1answer
82 views
Web Directories Monitor Script
I have some troubles with injections on my shared hosting account where I run a lot of sites with a lot of different technologies: wordpress, drupal, joomla, osticket etc...
I installed wordpress ...
4
votes
5answers
669 views
Site compromised .htaccess files everywhere
Some of the sites we're hosting are compromised by... I don't know what.
Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
0
votes
1answer
146 views
Controlling Access using htpasswd and htaccess
I've got a bit of a peculiar problem on my site. I'm using a .htaccess and .htpasswd file to protect the root of the site. This works great, but when I try to view a video file on my site, it prompts ...
9
votes
1answer
507 views
How did Google manage to crawl my 403 pages?
I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
5
votes
7answers
409 views
Hacked by our own hosting company!
OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
4
votes
2answers
1k views
How to help WikiLeaks remain up and running? [closed]
WikiLeaks is under a lot of attack. It has been ousted from DNS servers, Amazon has kicked it out. It is facing massive DDOS attacks.
Under these circumstances what can WikiLeaks do to remain afloat?
...
3
votes
4answers
223 views
7
votes
3answers
936 views
Important fields in HTTP header from security perspective
What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
3
votes
3answers
158 views
Are files in a hidden directory safe?
I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
2
votes
2answers
388 views
Restrict access to web directory with .htaccess
Let me just say that doing this sort of thing with .htaccess files has never been a strong point for me. Let's say that I have a directory in my web root: /dir/data
Within that directory let's say ...
1
vote
1answer
403 views
Google Analytics shows 0 Visits?
I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday).
Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...?
How ...
1
vote
1answer
690 views
iFrames from Skydrive: yes, no, how
I have a two-pronged question.
First: SEO Concerns aside, should I be concerned about using iFrames on my site as far as viruses etc go? I am using skydrive to host my images and it provides an ...
1
vote
1answer
318 views
scorecardresearch dot com: weird tracking pixel
I'm seeing very weird behaviour in relation to this domain and a tracking image. On a specific page on our site, I'm seeing a script that's being added dynamically, apparently via flash (I wasn't even ...
2
votes
1answer
116 views
Looking for usability studies of user authentication methods and interfaces, do you know of any?
Been having issues with stackexchange creating weird usernames for me and grouping them with my account, it appears to be a known issue, and emailed the stackexchange team... which leads me to my ...
1
vote
1answer
131 views
Are there security risks involved in moving from a CMS that uses SQL to one that uses XML?
I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out ...
0
votes
2answers
539 views
Godaddy - folder with password protection
Godaddy windows shared hosting on IIS6, but will probably migrate to IIS7 soon.
Is there easy way to setup folder with password protection, so when I try to access secure folder, login dialog pops ...
6
votes
3answers
330 views
Using two salts for user authentication?
When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
7
votes
2answers
428 views
Does SSL really matter for most websites?
I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL.
I've read plenty of ...
4
votes
2answers
374 views
HTTP for one part of the site, HTTPS for other
We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS?
For example, WordPress (which I know) is located at http://foo.com, but we want to have ...
4
votes
3answers
263 views
SSL versus EV SSL
As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
1
vote
2answers
218 views
HTTP Server invalid request/connection throttling
I have a custom HTTP server.
When F5 is held down in a browser the server gets slammed with requests.
How can I detect and limit these (or any other) invalid connections?
It seems that I would have ...
7
votes
2answers
160 views
Does the 'Server' header serve any purpose?
For example, when I dump the response header for my server I get:
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Is this used for anything? Is ...
3
votes
5answers
253 views
Variable IPs: How variable are they? Best practices for tracking
There are a lot of questions on StackOverflow relating to session security / session hijacking, but there doesn't seem to be a really good solution to the problem. The three most common suggestions ...
5
votes
2answers
2k views
How can I secure an installation of MediaWiki?
I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
11
votes
6answers
2k views
How Can I Secure A VPS Installation?
What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
5
votes
4answers
397 views
404 page echoing request URI - security risk?
I just noticed the default 404 page on one of my hosting accounts displays the requested URI.
<!--#echo var="REQUEST_URI" -->
I faintly remember hearing or reading that this is a potential ...
6
votes
5answers
4k views
Identify “non-secure” content IE warns about
As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
3answers
236 views
How to fix a site that Google tells you is infected
I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
6
votes
1answer
4k views
Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates
Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
1
vote
5answers
603 views
How to prevent iframe virus? What are all the measures can be taken once affected by it?
Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website?
I ...
6
votes
3answers
168 views
How would you establish user credibility for your web app?
One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
1
vote
1answer
219 views
How can I allow robots access to my sitemap, but prevent casual users from accessing it?
I am storing my sitemaps in my web folder. I want web crawlers (Googlebot etc) to be able to access the file, but I dont necessarily want all and sundry to have access to it.
For example, this site ...
9
votes
5answers
158 views
Is PCI compliance scrutinised?
After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
