The [Open Web & Application Security Project (OWASP)][1] is an international, open-source, application security project which supports the informed use of security technology via tools and information. [1]: http://www.owasp.org/

learn more… | top users | synonyms

-2
votes
0answers
39 views

Http splitting attack via webgoat [on hold]

I'm trying to do the webgoat http splitting attack, I'm using firefox and burp suite. Note that I have already read the question that is already posted (Why is this response splitting attack not ...
0
votes
3answers
111 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
2
votes
1answer
43 views

OWASP WebGoat Warning Meaning

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted: WARNING 1: While running this program your machine will be extremely ...
0
votes
0answers
41 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
3answers
108 views

Is there a fine for not doing penetration / vulnerability test [closed]

If a company needs to be PCI compliant are there any fines levied on them if they don't do pen/vulnerability testing, if yes, is it an automatic fine, or is it only if they are caught. Understanding ...
0
votes
1answer
62 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
3
votes
2answers
71 views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...
2
votes
1answer
63 views

how about using OWASP dependency check tool to address Top 10 2013-A9-Using Components with Known Vulnerabilities [closed]

I know the OWASP dependency check tool is really good in finding vulnerable dependencies and I have used it personally for experimental purposes. But, has anybody used it at an enterprise level, like ...
0
votes
1answer
75 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
0
votes
2answers
118 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
2
votes
1answer
1k views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...
2
votes
1answer
77 views

How to prevent browser from rendering malacious content if request or response is hacked

We are currently working on OWASP security fixes and we identified one attack scenario for which we are trying to figure out a possible solution: User hits a valid HTTPRequest to our application. ...
2
votes
0answers
42 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [closed]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
1
vote
2answers
147 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
0
votes
1answer
182 views

Is OWASP ESAPI .NET Edition really used? Is this project still alive?

I have just seen that the last release has been pushed out in 2009 and that raised my doubts.
-1
votes
3answers
2k views

Sample test cases for all owasp top 10 vulnerabilities

I am looking for sample test cases for all 10 vulnerabilities to exploit those scenarios. I would highly appreciate if any one share or share the link for test cases for a web application with all 10 ...
1
vote
0answers
157 views

Which OWASP modsecurity crs version to install on apache 2.2.22

Hello I am considering installing owasp mod_security crs on an ubuntu 12.04.4 which comes with apache 2.2.22. On the github page I have seen many version's but all tutorials were using 2.2.7 First I ...
0
votes
1answer
1k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
0
votes
2answers
170 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
3
votes
3answers
1k views

Clearing/changing session id on logout

While reading through the newes OWASP ASVS standard (still beta) I have found a requirement V2.6 saying Verify that the session id is changed or cleared on logout. I do not see a clear point ...
0
votes
3answers
478 views

PHP Object Injection Prevention - OWASP

So I was just reading up on the OWASP site about PHP Object Injection. According to their site, the suggested fix is to not use serialze and unserialize but to use json_* (json_encode and ...
1
vote
1answer
175 views

Are HTML Entities inherently unsafe?

When submitting HTML that contains entities to the OWASP HTMLSanitzer, entities are converted. For example: BEFORE: <p>blah blah blah &diams;</p> The resulting HTML ends up ...
3
votes
3answers
278 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
-1
votes
2answers
725 views

Is there a difference between Broken Access Control and Insecure Direct Object reference? [closed]

According to me,if this difference is correct,it is that for exploiting a broken access control you don't necessarily need to be logged into the application,but for exploiting insecure direct object ...
1
vote
2answers
1k views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
2answers
5k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
2
votes
3answers
271 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
2
votes
3answers
407 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
1
vote
1answer
310 views

attack signatures [closed]

I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I ...
1
vote
1answer
246 views

Why should I run OWASP Broken Web Applications Project as host only or NAT?

We have a hard time getting VMWare to work in bridged mode. We can get it to work in Bridged mode. Why is it so important to run it with host only or NAT?
4
votes
1answer
1k views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
18
votes
3answers
810 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
5
votes
4answers
1k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
4
votes
2answers
210 views

Is it worth following OWASP AppSensor for an open source web application?

I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application. I think there is some value in using AppSensor to ...
6
votes
2answers
675 views

How dangerous are direct references to database keys?

An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows: “A direct object reference occurs when a developer ...
1
vote
1answer
248 views

Understanding nibbles & encoding using owasp EnDe tool?

I'm using owasp EnDe web-based tool to understand nibbles and encoding in general. This online utility in my knowledge is the best free resource avaiable for anyone who is interested to learn encoding ...
2
votes
1answer
163 views

Is there something like the OWASP top 10 for BizTalk applications?

I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?
1
vote
3answers
701 views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
10
votes
5answers
5k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
15
votes
5answers
1k views

Application security training for developers [closed]

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
7
votes
5answers
586 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
6
votes
5answers
6k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
4
votes
2answers
2k views

How to properly validate HTTP redirects?

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: Validate data from redirects (An attacker may submit malicious ...
1
vote
1answer
371 views

Exclude file names from mod_security patterns

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page. For example, one problem ...
5
votes
3answers
224 views

How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)

I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio. You can see the video at Real-time ...
3
votes
2answers
833 views

List of Top security risk/attack scenarios for android application

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
3
votes
2answers
472 views

Is there a spreadsheet/template for Mapping WebServices Authorization Rules?

I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed. In the past I have created a couple of these (some even ...
5
votes
0answers
13k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
2
votes
1answer
831 views

Are .NET WebServices vulnerable to CSRF?

While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF. There isn't ...