Webserver Security (Part I) (
Page 1 of 6 )
This first article in a two-part series deals with tools to find security holes in webservers and workstations. Some of the topics covered are: port scanning, finding NFS security holes, and using lsof.If you examine the security problems reported with stolen credit card numbers or
web server defacements in the last few months, it becomes obvious that many web
applications have been slapped together with little care or planning for
security. What are the most common problems leading to insecure webservers and
how does one avoid them? How can one as a customer or end user recognize if a
server fullfills the most elemental security requirements?
An analysis of
the reported security flaws shows that most problems belong into one of three
categories:
- The server offers services to the public it was not intended to offer.
- The server keeps supposedly private data in publicly accessible areas.
- The server trusts data from untrustworthy sources.
