0
votes
5answers
219 views

Are all URL shorteners unsecure/vulnerable?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
2
votes
2answers
120 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
0
votes
2answers
278 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
1answer
40 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
1
vote
3answers
902 views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
1
vote
2answers
871 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
0
votes
1answer
66 views

How to pass an email address securely to a web application X embedded inside a web application Y

The scenario I'm trying to address is this: There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain). When X is ...
0
votes
4answers
918 views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
1
vote
1answer
177 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
17
votes
5answers
2k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
0
votes
1answer
184 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
4
votes
3answers
703 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
1
vote
2answers
125 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
20
votes
11answers
7k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
7
votes
2answers
10k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
84
votes
2answers
47k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
4
votes
4answers
304 views

Security risk of adding a HTTP Header with server identifier

We are about to deploy a web application to a web farm of quite a few web servers. During our testing we have found issues happening in one of the servers but not in others. Most of them because of ...
0
votes
4answers
462 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
6
votes
3answers
359 views

What sort of delay will deter a robot from crawling my site?

I use what I believe is the standard method of identifying bad bots that do not respect my robots.txt (i.e. disallowing crawling the bad-bots subdirectory, then logging those who still go there). So ...
0
votes
2answers
1k views

How valid is this statement “SSL sit between application layer and network layer”

taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
0
votes
3answers
130 views

Does including decorative HTTP headers into server reply pose extra security risk?

Suppose I reconfigure my HTTP server to add the following HTTP header into every reply: X-Hello: Hello! or some other presumably funny text. Can this have any negative effect on the server ...
9
votes
2answers
477 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
18
votes
2answers
11k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
1
vote
2answers
137 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
1
vote
1answer
306 views

What are security risks of serving user uploaded files without Content-Disposition?

Imagine a server that serves untrusted user-provided files and allows other users to download them. Under some circumstances server can be tricked to return responses to download file requests without ...
8
votes
2answers
2k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
0
votes
2answers
619 views

How to encode letters in multipart/form-data to include CR/LF characters?

Part of HTTP request that should be sent to server with Content-Type: multipart/form-data; looks like: ------WebKitFormBoundaryQ7KGYev31biaJTW8 Content-Disposition: form-data; name="subject" ...
1
vote
1answer
5k views

How to use http-get-form in THC-Hydra?

I've been messing with Hydra (Brute Force) to solve the "Damn Vulnerable Web App" brute force section but the problem is when I use http-get-form it said: Warning: child 1 seems to have died, ...
1
vote
2answers
356 views

Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?

Imagine button after clicking which browser sends XHR http request with GET method. Characteristics: after executing request sensitive action is performed sensitive information is sent in GET ...
4
votes
3answers
493 views

Is there a security risk in existence of those HTTP headers in responses?

The following HTTP headers can be seen in responses on some sites: Age: 12 Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ== Via: 1.1 tacoma:3128 (squid/2.7.STABLE9) X-Cache: MISS from tacoma X-Cache-Lookup: ...
17
votes
4answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
2
votes
2answers
360 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
2
votes
2answers
1k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
7
votes
5answers
8k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
8
votes
5answers
1k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
6
votes
7answers
901 views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
3
votes
2answers
490 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
8
votes
9answers
378 views

What is the proper way to view the sourcecode of a website?

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true? Does this mean the webserver may issue alternate source from the original? Lastly, is ...
8
votes
1answer
713 views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
17
votes
2answers
2k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
6
votes
3answers
3k views

Can I block the true IP address using X-Forwarded-For header in IIS?

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address. Can I use the X-Forwarded-For header with ...
2
votes
1answer
1k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
35
votes
6answers
3k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
3
votes
3answers
267 views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
10
votes
8answers
2k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
10
votes
6answers
2k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
70
votes
7answers
26k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?