Skip to main content

Cytrus Logic

CytrusUSA
Menu

Web Server Default Banners

Web server default banners are when web servers like Apache, Nginx, and others are configured to show their server type, version number, and operating system. Hackers can use a simple method to get this information. This information is sent in the headers of the HTTP request and looks like this: HTTP/1.1 200 OK Date: Thu, […]

What is the Strict-Transport-Security Security Header

Imagine if you are in a coffee shop and using public wifi. A hacker is also in the same coffee shop on the same wifi. You are purchasing something off of an insecure website. Little do you know that the hacker on the same wifi network is monitoring your traffic with a packet sniffer(a tool […]

How to Prevent Content-Type Sniffing

Content-Type Sniffing is used to protect against MIME vulnerabilities. This happens when a user uploads a file but disguises it as something else. This is potentially dangerous because a malicious file could be upload to the server and then inject malicious code. The Content-Type Sniffing makes sure that files are served as the MIME file […]

What is XSS Protection?

XSS protection is a security header that stops a page from loading when a XSS attack is detected. This header is supported in Chrome.IE, and Safari. An XSS(Cross-site scripting) attack is when malicious code is inserted into a benign site typically in the form of a browser side script. A hacker can use XSS to […]

Directory Listing Enabled Error

Web servers can be configured to automatically list the contents of directories that do not have an index page. This allows people to be able to see sensitive directories and files that are supposed to be private. This can lead to vulnerabilities. It gives hackers information about your files that they should not have.

What is the Trace Method?

The ‘TRACE’ is an HTTP request used for debugging which echo’s back input back to the user.  This method allows the possibility for hackers to steal Cookies, and possibly website credentials. TRACE requests can be disabled by making a change to the Apache server configuration file.