Collaborate Disseminate
I am improving the security on my php website. I am not using any frameworks or cms. The credentials are currently stored in plain text in the relevant php files. While researching, I came across this question Why use .ENV? What’s wrong wi… Continue reading What is the most up-to-date secure method for storing .ENV variables?
On a nginx web-server running the following config is to possible to change $_SERVER[‘REMOTE_ADDR’] remotely?:
user www;
pid /run/nginx.pid;
error_log /dev/stderr info;
events {
worker_connections 1024;
}
http {
server_tokens off… Continue reading Changing $_SERVER[‘REMOTE_ADDR’] remotely
I recently discovered during a penetration test that the HSTS was returned by the application but in this format:
"Strict-TransportSecurity"
Instead of:
"Strict-Transport-Security"
Does this format mean that the header … Continue reading Is this HSTS HTTP Response Header Misconfigured?
My code is that
if (in_array($file_ext, $extensions)) {
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $file_tmp);
if ($mime == ‘application/msword’ || $mime == ‘image/gif’ … Continue reading why the internal server error occured when using finfo_file function? [closed]
Recently wordpress site on centos 7 server is hacked and WSO shell was uploaded.
Ive checked other sites and nothing was changed, Im using centos web panel and the root password also was not changed.
I had also modsecurity on my nginx- fir… Continue reading How to recover a hacked site with WSO Shell [duplicate]
(This is a duplicate of my question here). I want to know if this hypothetical setup is reasonably secure to the point where it can’t be conventionally hacked remotely over Tor, from which it is accessible, and for it to be hacked the atta… Continue reading Would this HTTP server setup be reasonably secure?
I know that forward proxy can enhance security by replacing client IP’s address with proxy server IP address. So, the web server or anyone else cannot identify the client identity who’s requesting a website.
However, can the reverse proxy … Continue reading How reverse proxy works?
I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and 0 to 9. The same happens without the g… Continue reading Unclear attack(?) on web server: GET requests for tar files
What exactly is web server attack methodology?
I found that the webserver attack methodology is as follows:
Information Gathering
Web server Footprinting
Website Mirroring
Session Hijacking
Web server password hacking
Vulnerability Scanni… Continue reading what is web server attack methodology? [closed]
I am interested in exposing web content to strangers on the internet (Reddit, Discord, ..).
This content I wish to reside on the same web server under which personal web content resides.
(None of this content yet exists, and I’m not set on… Continue reading Confidentially seperating web content under single IP address