14
votes
3answers
537 views

Why CSRF Token has to be a Cryptographically Strong Random number, in Double Submit Cookies method?

I was just going through the OWASP's Cheat Sheet for CSRF Prevention. In the Double Submit Cookies method, I saw this the site should generate a (cryptographically strong) pseudorandom value ...
4
votes
2answers
255 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
-1
votes
1answer
155 views

Cross site scripting in url? [duplicate]

I currently have a xss problem in this site. https://bbcpanningen.cupweb6.nl:1311/servlet/OMSALogin?msgStatus="><script>alert("hello") </script> But I don't understand how an ...
0
votes
3answers
370 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
7
votes
5answers
520 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
2
votes
1answer
127 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
4
votes
2answers
395 views

OWASP Top 10? How about OWASP Top 1000?

Many people are aware of the "OWASP Top 10". I'm wondering if OWASP (or any similar authority) has gone above and beyond just the top 10 most commons attacks and made a larger list (e.g. the "OWASP ...
6
votes
3answers
175 views

What indicators did OWASP use to end up with OWASP Top 10?

I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ... Knowing that each of these ...
3
votes
2answers
449 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
9
votes
3answers
879 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
0
votes
4answers
141 views

Safely changing text links to HTML anchors

I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>. Since this is a user given ...
32
votes
2answers
8k views

When the use of a AntiForgeryToken is not required /needed?

I'm running a rather large site with thousands of visits every day, and a rather large userbase. Since I started migrating to MVC 3, I've been putting the AntiForgeryToken in a number of forms, that ...
-1
votes
4answers
4k views

SQL injection for a username/password form?

This is how user validation happens on my site: if(!empty($_POST['username']) && !empty($_POST['password'])) { $query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
1
vote
2answers
2k views

Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?

I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match. That seems to be somewhat of a risk, as the ...
4
votes
1answer
645 views

How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?

What is CSRF? I need a basic definition that is not just lifted from Wikipedia. I understand SQL injection, XSS, cookie poisoning, but I just cannot wrap my mind around this. I am using a ...
62
votes
4answers
7k views

Can anybody explain XSS? [closed]

I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I never fully understand how XSS ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
14
votes
7answers
1k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
10
votes
7answers
1k views

Whitelisting DOM elements to defeat XSS

As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single ...
16
votes
2answers
1k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
16
votes
4answers
2k views

Does stored procedure prevent SQL Injection in postgreSQL

Is it true that stored procedure will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...
5
votes
2answers
827 views

How does OWASP ESAPI protect against direct object reference vulnerabilities?

What other good solutions are there? From the Area51 proposal
39
votes
5answers
4k views

New XSS cheatsheet?

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
19
votes
4answers
10k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
25
votes
6answers
374 views

User input data, is filtering enough or should it be parsed?

In a webapplication there could be two approaches to migate XSS attacks. All the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with only ...