Tagged Questions
0
votes
2answers
55 views
Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?
As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains.
In other ...
3
votes
1answer
72 views
Secure information exchange between web applications using browser redirection
We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
0
votes
1answer
206 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
23
votes
4answers
2k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
7
votes
3answers
423 views
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?
How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?)
LivingSocial - 50 Million Users Exposed
Zappos - 24 Million ...
2
votes
1answer
139 views
How to hide victim pop-up in clickjacking?
I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
0
votes
3answers
149 views
get vs post which is more secure? [duplicate]
i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
1
vote
2answers
583 views
HTML encoding to protect against XSS
While going through some references about protection against XSS i found that it is a good practice to encode data (entered by users) before using it to generate a dynamic page. I was not able to find ...
6
votes
3answers
334 views
What is the next step of this file upload attack?
Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
4
votes
3answers
238 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
8
votes
4answers
725 views
Is $_SERVER[ ] a safe source of data in PHP?
Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
Thanks.
OVERVIEW OF RESPONSES:
So it seems there is a consensus that some ...
2
votes
4answers
275 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
1
vote
1answer
44 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
52
votes
10answers
3k views
Does disabling right click have any impact on security?
On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?
1
vote
1answer
115 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
7
votes
2answers
279 views
What unique risks does MVC model binding bring to a website? What additional vigilance is needed?
From what I understand, "model binding" is where a website based on ASP.NET MVC or Ruby on Rails (there are others...) takes parameters in HTTP's GET statement and passes them as variables to code ...
0
votes
1answer
153 views
Generating Web Application Security Profile
Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. ...
5
votes
6answers
741 views
What does it actually mean when someone says their website is hacked?
I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means.
To me the only way to get control of website is get the FTP ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
6
votes
1answer
163 views
What responsibility do I have in continuing another developer's work?
My question is related to this one. I did not found anything googling around and that is why I am asking.
This question
I am the sole web developer for a firm, and I manage everything, from ...
0
votes
3answers
106 views
Does including decorative HTTP headers into server reply pose extra security risk?
Suppose I reconfigure my HTTP server to add the following HTTP header into every reply:
X-Hello: Hello!
or some other presumably funny text.
Can this have any negative effect on the server ...
1
vote
1answer
130 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
1
vote
4answers
421 views
Is it necessary to scan users' file uploads by antivirus?
Web application allows users to upload files. Is it necessary to scan those files by antivirus?
I'd want to hear answer in two scenarios:
Type of file isn't checked when uploading. They are stored ...
7
votes
4answers
166 views
Limited JavaScript app scenario: Attack vectors and mitigation
I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
0
votes
2answers
743 views
IS Maltego is the best forensic/intelligence solution out there? [closed]
i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web .
please recommend me the best software out there ... and if you ...
4
votes
2answers
379 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
0
votes
0answers
161 views
GWAPT - Training Experiences/Questions [closed]
I'm heavily considering the GWAPT certificate, I'm wondering:
http://www.giac.org/certification/web-application-penetration-tester-gwapt
Has anyone done the online version of it? What is it like? Is ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
3
votes
1answer
71 views
Is it possible to verify identity of site that sent request to you?
I'm developing a JS widget that can be embedded by 3rd party websites. When widget is shown, it sends request to my site. When this request is received, I know that it was shown to the user and pay ...
7
votes
5answers
397 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
1
vote
2answers
72 views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
4
votes
1answer
161 views
How to use postMessage securely
postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication.
What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
5
votes
4answers
593 views
Protecting against CSRF when a form is being submitted via an AJAX call
I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
3
votes
2answers
347 views
Is Drupal's filter_xss enough for filtering HTML?
Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input?
If not, what should be used instead when using Drupal 7?
This questuion is a duplicate of Drupal's built-in ...
-4
votes
4answers
261 views
Should companies use Crowd Source Audit Platform for Manual Penetration Test?
As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues?
LE: So most of you guys downgrade, and said it's wrong to have ...
1
vote
2answers
198 views
Session management: Are the features of application server enough?
HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
7
votes
2answers
894 views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
1
vote
5answers
395 views
Security risks of hosting user-supplied images?
I have a program that will accept and fetch images from urls. It will check if the extension is .png, .jpg, etc...
I will fetch these files and store them, they will be shown to users in a gallery ...
2
votes
5answers
284 views
Can web application do anything to prevent risk from client-side malware?
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
10
votes
2answers
414 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
1
vote
1answer
327 views
LFI or RFI from XSS?
Could XSS lead us to the Local File Include or Remote File Include?
I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.
1
vote
1answer
185 views
JS frontend for RESTful backend vs authorization
I'm building web-app. And i have concern about security issues.
In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
1
vote
1answer
412 views
Example of attack trees in the web application security analysis
Here I am again asking for some informations about attack trees usage in web application analysis.
For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
1
vote
1answer
192 views
Using Tokens to Keep Users Logged In
I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
1
vote
2answers
263 views
Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
Imagine button after clicking which browser sends XHR http request with GET method. Characteristics:
after executing request sensitive action is performed
sensitive information is sent in GET ...
4
votes
3answers
303 views
Is there a security risk in existence of those HTTP headers in responses?
The following HTTP headers can be seen in responses on some sites:
Age: 12
Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ==
Via: 1.1 tacoma:3128 (squid/2.7.STABLE9)
X-Cache: MISS from tacoma
X-Cache-Lookup: ...
15
votes
2answers
1k views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
3
votes
4answers
797 views
XSS : Content-type: application/json
Background information
- Application responds to request to a particular URL with content-type: application/json
JSON response contains a parameter from the request
Escapes the quote with a slash
...
10
votes
7answers
632 views
Where to start with security testing?
Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
1
vote
2answers
193 views
Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]
What professional standards and practices are recommended for guiding such an effort?
