The [Open Web & Application Security Project (OWASP)][1] is an international, open-source, application security project which supports the informed use of security technology via tools and information. [1]: http://www.owasp.org/

learn more… | top users | synonyms

5
votes
3answers
98 views

Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?

Latest edition of OWASP Top 10 for web application was in 2013 and for mobile applications, it is 2016. Why is it so? Can we say that the pattern in the web application vulnerabilities is settled? ...
0
votes
1answer
33 views

Is there a way to calculate the complexity of an XSS-vector?

Is there a way to calculate/estimate the complexity of an XSS vector? I would like to consider a "XSS-vector complexity score" in the risk = likelihood * impact formula1. In my opinion the likelihood ...
0
votes
2answers
93 views

Need help understanding OWASP Vulnerabilities [closed]

I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
1
vote
2answers
32 views

CVSS v3: Deciding Scope parameter for a few owasp top 10 vulnerabilities

I am trying to score owasp top 10 on cvss v3 and I am having difficulties assigning "Scope" parameter for some. Please correct the below list if there are some faults. (not in order) 1) SQL ...
3
votes
2answers
234 views

Disclosure of end user files / Installation of Trojan horses via XSS

I've stumbled upon following examples of XSS attacks on OWASP: "Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs..." Link to the example: https://...
0
votes
1answer
27 views

Reflecting user input within a JavaScript variable

I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference. Imagine the ...
4
votes
2answers
44 views

How do I turn off automated testing in OWASP ZAP?

I am trying to find out how to turn off the automated scanner in ZAP. I am not even sure if it is on. How and where can I tell if the scanner is on? I just want it to be a pure proxy for the time ...
1
vote
3answers
363 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
0
votes
1answer
2k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
2
votes
2answers
69 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
3
votes
2answers
93 views

How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?

Is there an accurate method or formula to convert risk scores between the OWASP Risk Rating Methodology (Overall Risk Severity) and the CVSS v1, v2 and v3 models) base score)? As well as converting ...
0
votes
0answers
74 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
4
votes
1answer
76 views

How relevant is OWASP ASVS? [closed]

How relevant is the OWASP application security verification standard? Have you had it as a requirement made by business? What other application security standards relevant to business are there? I did ...
2
votes
1answer
176 views

Viewing HTTPs Traffic - ZAP Proxy / MacOS / iOS App

I've noticed a curious oddity with some traffic sniffing from my Apps on my iPhone. I've installed the ZAP Proxy CA Cert on the device, but I've noticed I can sniff some App traffic, and others I can'...
3
votes
2answers
104 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g.,...
2
votes
1answer
95 views

Bypass char filtering - security shephard

I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS. So what I know ...
3
votes
1answer
63 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
1
vote
2answers
431 views

Can the OWASP ZAP check XSS for REST API

I have a web application and I used OWASP ZAP for checking XSS. I tried two cases as example bellow: URL: localhost:8888/test/login login page HTML: <!DOCTYPE html> <html> <head> &...
1
vote
1answer
84 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
3
votes
1answer
46 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to white list all the APIs and static resources of an application. Although from the security ...
2
votes
1answer
192 views

Is there something like the OWASP top 10 for BizTalk applications? [closed]

I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?
1
vote
0answers
229 views

Zap and Tamper Data is not getting any of the POST request

I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac. I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST ...
0
votes
0answers
28 views

Handling assertions in responses statuses 302 in ZAP

After configuring all form Authentication in ZAP, I have faced an issue to assert successful login in ZAP. The response will arrive with the status "302" moved temporary EX: > HTTP/1.1 302 ...
1
vote
0answers
94 views

How to check if /run timeout /T 5 remote command execution worked in page html?

I was scanning a website using Zed Attack Proxy, when I found it is vulnerable to remote command execution, specifically timeout with the Referer header (shown in the request below). I have no idea ...
0
votes
1answer
729 views

Exploit SQL injection in OWASP ZAP

I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, ...
2
votes
1answer
96 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
2
votes
1answer
1k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
2
votes
2answers
383 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
1
vote
0answers
291 views

Help with setting up OWASP ZAP Authentication

So I have recently been working on security testing with OWASP ZAP. However I have hit a road block in that I can't get the (ajax) spider to test within an authorized area of the single page ...
7
votes
1answer
285 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
79
votes
8answers
9k views

Why should you redirect the user to a login page after a password reset?

The OWASP Forgot Password Cheat Sheet suggests: Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page I'm failing to understand ...
3
votes
1answer
3k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
1
vote
1answer
101 views

HSTS Policy being enforced *sometimes*

I've implemented an HSTS policy for our site. I have the header being served on our main domain and it's sent on the very first response from the server. (From the response that serves the 304 ...
2
votes
1answer
338 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
1
vote
3answers
4k views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
14
votes
2answers
623 views

Detecting attempts to attack a website?

I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to the attacker when he tries to break into my website. Is there any resource covering/...
2
votes
1answer
116 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
2
votes
5answers
400 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
2
votes
2answers
6k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
2
votes
2answers
422 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
2
votes
1answer
163 views

OWASP WebGoat Warning Meaning

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted: WARNING 1: While running this program your machine will be extremely ...
0
votes
0answers
81 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query (...
0
votes
3answers
116 views

Is there a fine for not doing penetration / vulnerability test [closed]

If a company needs to be PCI compliant are there any fines levied on them if they don't do pen/vulnerability testing, if yes, is it an automatic fine, or is it only if they are caught. Understanding ...
4
votes
2answers
116 views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...
0
votes
1answer
92 views

HSTS implementation [closed]

I have a little doubt on using HSTS, as per this video, once HSTS is implemented , all the URLs will be going in HTTPS, but as we all know in using SSL we need pre-specified encryption algorithms and ...
2
votes
1answer
166 views

how about using OWASP dependency check tool to address Top 10 2013-A9-Using Components with Known Vulnerabilities [closed]

I know the OWASP dependency check tool is really good in finding vulnerable dependencies and I have used it personally for experimental purposes. But, has anybody used it at an enterprise level, like ...
0
votes
1answer
123 views

OWASP + Atomic ModSecurity Rulesets - Too much?

Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be ...
0
votes
2answers
154 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
1
vote
1answer
4k views

application/json Content-Type character set

According to the OWASP Application Security Verification Standard: V11.3 Verify that every HTTP response contains a content type header specifying a safe character set (e.g., UTF-8). According ...