2

A server hosting an application built in PHP:

  1. Can the server be reached in other ways than through HTTP or externally?
  2. Is GET and POST only populated through the HTTP protocol?
  3. Is HTTP headers, GET and POST the only source of input for a server/web application?
  4. Is connecting to a website with telnet any different than with a browser?
  5. What other access points exist? Do they pose a security threat? Common ways to counter them?
Improve this question

1 Answer 1

Reset to default
6

Can the server be reached in other ways than through HTTP or externally?

Well... the server itself can be accessed by different means. Depending on what services are running on the machine (as well as what ports are open).

Is GET and POST only populated through the HTTP protocol?

Yes

Is HTTP headers, GET and POST the only source of input for a server/web application?

No PUT and DELETE are also http methods.

Is connecting to a website with telnet any different than with a browser?

Basically not. Because it will also use the HTTP protocol. Unless you connect to the machine using another service (see first point)

What other access points exist? Do they pose a security threat?

Lots :-)

  • Physical access to the machine
  • Other services which are running on the machine (it's best practice to stop unused services).
  • SQL Injection
  • File inclusion
  • Password leaks
  • Through employees
  • DNS poisoning
  • many many more

Common ways to counter them?

Make sure your application is secure (don't give httpd unneeded privileges, always sanitize user input, etc). Harden your server security. Make sure you keep everything up-to-date. Regularly check your logs. Common sense. etc.

Improve this answer
4
  • 1
    Good answer; but technically cookies and sessions are also set through HTTP headers. There is a cookie/set-cookie header. Session IDs are usually also set either through a cookie or get parameters.
    – Lèse majesté
    Commented Dec 14, 2011 at 12:56
  • You're correct. The reason I added it is because they are often used and I didn't add them to the 'real' http methods. Will clarify though. Thanks!
    – PeeHaa
    Commented Dec 14, 2011 at 13:01
  • On a shared host it is the host's task to keep the server's software up to date and secure, is it not? I'm not sure if I would even have access to httpd or services at all.
    – Seralize
    Commented Dec 15, 2011 at 3:38
  • It depends on the contract you have with them. Another thing you could do is check out for yourself whether there are security issues. So called pen-testing. I've used w3af.sourceforge.net in the past, but also tenable.com/products/nessus can be used.
    – PeeHaa
    Commented Dec 15, 2011 at 8:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.