Collaborate Disseminate
Iam using apache2 on ubuntu 18.04 server running modsecurity 2.x
Appserver 192.168.4.4
WAF server 192.168.4.3
App Server /var/www/html/index.php
<?php
echo “hello”;
?>
Here is a simple rule blocking response … Continue reading modsecurity rule RESPONSE_BODY not working [migrated]
Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this:
<IfModule mod_headers.c>
Header set Strict-Transport-Security “max-age=63072000; includeSubDomains; preload”
Hea… Continue reading HSTS and TLS redirection: What is the correct order?
“It was a cold and windy night, but the breeze of ill omen blowing across the ‘net was colder. The regular trickle of login attempts suddenly became a torrent of IP addresses, all trying to break into the back-end of the Joomla site I host. I poured another cup of …read more
I would like to know if this configuration is vulnerable to host header injection. I think it isn’t, because it’s listening on localhost, but I’m not sure.
<VirtualHost 127.0.0.1:[% port %]>
ServerName [% server_na… Continue reading 127.0.0.1 host header injection
Why is it that server admins do not code sign the contents of their webservers (all php, css, js, etc.) and have Apache / NGINX / whatever server software refuse to execute or serve any code / content unless it has been digi… Continue reading Why is digital signature enforcement on webservers not common practice?
In the Drupal logs on my dev site there are “page not found” reports that are obviously from a bot trying out well known urls (e.g. /wp-login). But I have set up apache basic auth and I am the only person who knows the passwo… Continue reading Drupal logs are reporting 404s from bot visits but I have apache basic auth set up
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I’m not certain that this is where the virus is coming from but I don’t see what else it could be.
Is it possible to get a virus t… Continue reading Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
A look at the complicated business of funding open source software development. Continue reading The Internet Was Built on the Free Labor of Open Source Developers. Is That Sustainable?
I am trying to setup HSTS for my website but running into some problems regarding HSTS and the use of the www. sub domain. What I would like is for all HTTP and HTTPS traffic to redirect to https://www.example.co.uk.
I have … Continue reading HSTS issues when redirecting to www. sub domain
How do I detect brute force attack is attempted in my web application either for user login or admin login hosted in apache server.
Continue reading Brute force attack detection mechanism from apache access_log files [on hold]