Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

3
votes
2answers
679 views

PCI compliance when using third-party processing

My company is outsourcing the development of our new e-commerce site to a third party web development company. The way they set up our site to handle transactions is by having the user enter the ...
2
votes
2answers
136 views

Deny access to a folder on hosting server but serve the pages

My hosting server allows to host multiple websites. The directory structure is like this root |_ www.a.com |_ www.b.com |_ www.c.com |_ www.d.com I want to put some PHP files on the www.d.com ...
6
votes
1answer
111 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
4
votes
3answers
1k views

client website compromised, found a strange .php file. any ideas?

I do support work for a web development company and I found a suspicious file today on the website of one of our clients called "hope.php" which contained several ...
1
vote
1answer
101 views

Site overthrown by Turkish hackers

Go ahead, laugh. I forgot to remove the default admin/admin account on my blog. SOmebody got in and has replaced my homepage with some internet graffiti. I've used .htaccess to replace the page with a ...
6
votes
1answer
417 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
2
votes
1answer
89 views

Are there any risks involved in Hosting your website on free webhosts?

I am planning to host my collage project web site on any such free webhost, is it secure or are there any disadvantages or risks or security issues that i may experience if i go for free web-hosting? ...
0
votes
1answer
918 views

someone was able to upload php files without ftp access to my server

I have website in PHP/MYSQL developing using CakePHP framework. Recently it was hacked and someone was able to upload some PHP and JS files and the site was down. The website FTP, control panel etc ...
1
vote
1answer
113 views

Ultimate security checklist

I'm looking for a complete security checklist that will allow me to secure my websites. After some research here is what I got: -use SSL to protect authenticated content -tighten the server TCP/IP ...
5
votes
3answers
359 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
4
votes
2answers
114 views

How to prevent stat sites from getting/publishing my traffic and hosting information?

When I recently googled my website, stat sites came up that had more info on my website than I even knew off the top of my head! Daily traffic, Nameservers, analytics id, etc. I removed google ...
0
votes
1answer
134 views

Apache webserver user setup and security issues

I have a server running Centos 5.6/PHP/MySQL etc that will only host one website all the time. New question Is there any security implication on leaving a single website hosted in the default ...
3
votes
2answers
965 views

What does this code mean that was placed in my hacked Web site?

My website was hacked, with the following code added to the end of the page: <img heigth="1" width="1" border="0" src="http://imgddd.net/t.php?id=########"> (The id had an 8 digit ...
3
votes
2answers
122 views

What are recommended password reset mecanisms?

All, I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority: 1) User friendly; ...
3
votes
2answers
205 views

I found a SQL injection bug on a public facing website, what should I do?

I found (ridiculously easy to discover) a SQL injection bug on a public facing website. I strongly suspect that in the same database are stored credit card numbers of their customers (although not ...
2
votes
1answer
406 views

How Do I Prevent Users from Accessing a Page More Then Once?

Hi I have a URL say for example http://www.xyz.com/form1.html. Now i need to hide this URL since I dont want people to keep coming back to this URL and using it. What I mean is I need this URL to be ...
1
vote
0answers
162 views

Is posting a document with a hand signature insecure? [closed]

Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
98 views

How Do You Store Website Backups?

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
10
votes
1answer
423 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
8
votes
8answers
491 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
7
votes
5answers
225 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
3
votes
1answer
2k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
1
vote
1answer
1k views

What is best practice for securing access to GMail for an enterprise?

Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate ...
2
votes
2answers
458 views

Keeping files private on the internet (.htaccess password or software/php/wordpress password)

I was asked a while ago to setup a server such that only authenticated users can access files. It was like a test server for clients to view WIP sites. More recently, I want to do something similar ...
0
votes
3answers
411 views

MODX based site has been compromised, and tagged by Google as malware

I'm the webmaster (inherited the site from the developer) for a site called kenbrook.org. The site is currently being tagged as malware infected by Google, and gives the following details: ...
3
votes
1answer
245 views

User registration usability vs security

What are cons and pros of the following: asking to repeat password asking to have a certain length-password asking to repeat e-mail address using captcha sending confirmation e-mail what do you ...
1
vote
3answers
114 views

What are some internet trends that you've noticed over the past ~10 years? [closed]

I'll give an example of one that I've noticed: the number of web sites that ask for your email address (GOOG ID, YAHOO! ID, etc.) has skyrocketed. I can come up with no legitimate reason for this ...
0
votes
2answers
366 views

block users by country in .htaccess

Is there a way to block users from a particular region. Currently I have compiled a list of over 100 IP addresses that I block in my .htaccess file. Unfortunately as the list grows I see a great ...
2
votes
1answer
179 views

A single request appears to have come from all the browsers? Should I be worried?

I was looking over my site access logs when I noticed a request with the following user agent string: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 ...
1
vote
0answers
296 views

Does the Adblock Plus extension prevent malicious code from downloading/executing? [closed]

Firefox and Chrome are my favourite browsers. The main reason is an extension called Adblock Plus. Basically, it blocks all the ad networks if you subscribe to one of the lists, like EasyList. Does it ...
0
votes
1answer
142 views

Free forum engine with good anti-attack mechanisms [duplicate]

Possible Duplicate: What Forum Software should I use? I am looking for forum engine (for discussions) with good attack countermeasures built in. Windows (preferrably) or Linux. Free (as ...
0
votes
1answer
254 views

Developing payment gateway

I have an idea of developing internet payment gateway similar to PayPal or Webmoney. Since i'm only sophomore at Computer Science, and i've only taken intermediate programming classes, i've no idea ...
1
vote
1answer
129 views

Is there a way of listing files for a directory if it contains index.html?

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get: Index of /images Parent Directory BirdsAreHere.png ...
7
votes
3answers
215 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
1
vote
3answers
266 views

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
66 views

Problematic using Captcha on billing page

I have simple captcha on user page. I want make it refresh if user input incorrect captcha, I just wanna ask Should I do it or I just add a simple button to refresh it.
1
vote
1answer
416 views

scorecardresearch dot com: weird tracking pixel

I'm seeing very weird behaviour in relation to this domain and a tracking image. On a specific page on our site, I'm seeing a script that's being added dynamically, apparently via flash (I wasn't even ...
1
vote
1answer
150 views

What is the purpose of the appserv_root requests?

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code. I am pretty ...
0
votes
1answer
145 views

Why does my certificate provider ask me to disable its root certificate?

I received an SSL certificate from GoDaddy yesterday and their instructions to install the certificate seemed weird. To be precise, they asked me to disable their root certificate in server. NOTE: ...
1
vote
1answer
755 views

Significant number of non-HTTP requests hitting my site

I'm seeing a significant number of non-HTTP requests hitting a site I just launched. They show up in the server (nginx) logs as non-ASCII and get rejected (correctly) with a 400 status. Here are ...
1
vote
3answers
143 views

Security considerations for my first eStore

I have a website through which I am going to sell few products. It is hosted on a simple shared-hosting and does not have SSL. On the products page, each product has a Buy Now button created from my ...
4
votes
2answers
348 views

How does amazon get away without verifying emails?

I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice ...
-1
votes
1answer
2k views

Best free Vulnerability Scanners that check your websites PHP & MySQL code? [duplicate]

Possible Duplicate: Best free Vulnerability Scanners that check your websites PHP & MySQL code? I'm looking for a free vulnerability scanner to check whether my website has common ...
2
votes
1answer
98 views

Web Directories Monitor Script

I have some troubles with injections on my shared hosting account where I run a lot of sites with a lot of different technologies: wordpress, drupal, joomla, osticket etc... I installed wordpress ...
0
votes
1answer
155 views

Controlling Access using htpasswd and htaccess

I've got a bit of a peculiar problem on my site. I'm using a .htaccess and .htpasswd file to protect the root of the site. This works great, but when I try to view a video file on my site, it prompts ...
10
votes
1answer
679 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
4
votes
2answers
1k views

How to help WikiLeaks remain up and running? [closed]

WikiLeaks is under a lot of attack. It has been ousted from DNS servers, Amazon has kicked it out. It is facing massive DDOS attacks. Under these circumstances what can WikiLeaks do to remain afloat? ...
2
votes
2answers
436 views

Restrict access to web directory with .htaccess

Let me just say that doing this sort of thing with .htaccess files has never been a strong point for me. Let's say that I have a directory in my web root: /dir/data Within that directory let's say ...
1
vote
1answer
472 views

Google Analytics shows 0 Visits?

I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday). Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...? How ...
1
vote
1answer
1k views

iFrames from Skydrive: yes, no, how

I have a two-pronged question. First: SEO Concerns aside, should I be concerned about using iFrames on my site as far as viruses etc go? I am using skydrive to host my images and it provides an ...