August 24th, 2005, 10:22 PM
[Delphi] Building my own webserver.
Okay, situation. I happen to have Borland Delphi 2005 and want to use the Indu Internet components to build my own webserver. No IIS, no Apache. My compiled executable will just be the webserver. It's service would be pretty simple, for internal usage on a small network. One PC will be the webserver and other PC's can access it through a web interface.
It's purpose... Well, whatever I like to experiment with. The server would generate pages dynamically yet it won't support PHP, ASP or whatever other scripting language. I don't want them either. If I want to modify the site served by this server, all I would have to do is modify the sourcecode. It is for personal experiments anyway.
My question however is security-relaed, though. I will run this server on my computer and thus it is exposed to the whole Internet. Although my firewall will keep all ports closed, I do want to access this server from the outside and thus hackers could access this server too. I can make this server pretend it's IIS or Apache to obfuscate it's real face, but security through obfuscation isn't a good solution...
Of course, I can add password-protected pages and use SSL to keep things secure and perhaps some other security measures and this isn't really what I am worried about. I'm not too afraid of people browsing that site anyway since it won't contain any sensitive information. Just whatever I like to experiment with.
However, I am more worried about hackers gaining access to my system through other means. What kind of other vulnerabilities should I be aware of? Is there any security risk in these Indy components or in Delphi that could be used by a hacker to gain access to my system? Bur example, through some buffer overflow or whatever?
It would be more secure than IIS or Apache since the hackers will be less familiar with this kind of webserver, so they would have more troubles with it. But do they still have some other ways to break in once I open this single port to my system? A port that is controlled by my own application?
I don't think so but want to be sure. So that's why I ask this.