The [Open Web & Application Security Project (OWASP)][1] is an international, open-source, application security project which supports the informed use of security technology via tools and information. [1]: http://www.owasp.org/

learn more… | top users | synonyms

79
votes
8answers
9k views

Why should you redirect the user to a login page after a password reset?

The OWASP Forgot Password Cheat Sheet suggests: Whenever a successful password reset occurs, the session should be invalidated and the user redirected to the login page I'm failing to understand ...
18
votes
3answers
913 views

Any comments or advice on OWASP-2013 top 10 number A9

In this iteration of the OWASP top 10 application security vulnerabilities list (https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project), a new category 'A9 Using Components with Known ...
15
votes
5answers
2k views

Application security training for developers [closed]

I am trying to establish an application security group within an organization and although there is a plethora of courses for penetration testers, i fail to find an equal amount of training courses ...
14
votes
2answers
620 views

Detecting attempts to attack a website?

I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to the attacker when he tries to break into my website. Is there any resource ...
13
votes
6answers
2k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
12
votes
5answers
8k views

How to validate if a JavaScript library is secure?

I'm the main developer for an Open Source JavaScript library. That library is used in the company I work for, for several clients. Every now and then there is a client that feels paranoid about ...
10
votes
3answers
3k views

How do I get started using ESAPI WAF?

I've been to the OWASP Enterprise Security API (Java Edition) Google Groups page and found this information missing.
8
votes
5answers
640 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
7
votes
2answers
829 views

How dangerous are direct references to database keys?

An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows: “A direct object reference occurs when a developer ...
7
votes
2answers
282 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
6
votes
5answers
8k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
6
votes
2answers
284 views

Concerns and Gotcha with Secure Programming Standards Development

I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
6
votes
1answer
236 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
6
votes
2answers
3k views

CSRF prevention in PHP

Two questions. Where does one download the PHP version of OWASP's CSRF Guard? The following URL says to check Git: https://www.owasp.org/index.php/PHP_CSRF_Guard All I see on Git however is ...
5
votes
2answers
3k views

How to properly validate HTTP redirects?

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: Validate data from redirects (An attacker may submit malicious ...
5
votes
4answers
2k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
5
votes
3answers
260 views

How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)

I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio. You can see the video at Real-time ...
5
votes
0answers
14k views

Getting started with OWASP ESAPI + JavaEE - simple TestProject [closed]

This question was originally asked on stackoverflow I hope that here in this Security forum I find more people because hopefully some people are using the esapi stuff? I have a little JavaEE ...
4
votes
2answers
96 views

Why do ID attributes need stricter validation?

According to OWASP XSS Prevention Cheat Sheet, one should Strictly validate unsafe attributes such as background, id and name I understand that background could contain data: urls, and can ...
4
votes
1answer
1k views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
4
votes
2answers
257 views

Is it worth following OWASP AppSensor for an open source web application?

I'm thinking of following OWASP's AppSensor project to build application-level intrusion detection into an existing open source web application. I think there is some value in using AppSensor to ...
4
votes
2answers
550 views

Is there a spreadsheet/template for Mapping WebServices Authorization Rules?

I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed. In the past I have created a couple of these (some even ...
3
votes
3answers
2k views

Clearing/changing session id on logout

While reading through the newes OWASP ASVS standard (still beta) I have found a requirement V2.6 saying Verify that the session id is changed or cleared on logout. I do not see a clear point ...
3
votes
3answers
545 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
3
votes
3answers
343 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
3
votes
2answers
911 views

List of Top security risk/attack scenarios for android application [closed]

WHat are the possible security risk/attack scenarios for android application. This is with regards to the OWASP top 10 Mobile Security threats discussed here: ...
3
votes
1answer
946 views

Are .NET WebServices vulnerable to CSRF?

While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF. There isn't ...
3
votes
1answer
38 views

How does the same-origin-policy protect against PUT/DELETE CSRF?

I've read the OWASP guide for cross-site request forgery and it states that "other HTTP methods", such as PUT and DELETE could be theoretically used for CSRF. However with the same-origin-policy ...
3
votes
1answer
39 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to white list all the APIs and static resources of an application. Although from the security ...
3
votes
1answer
2k views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
2
votes
5answers
374 views

What is the security flaw in the following code?

I am reading OWASP Testing Guide v3. The following passage: Example 1: Magic Parameters Imagine a simple web application that accepts a name-value pair of “magic” and then the value. For ...
2
votes
2answers
330 views

owasp esapi php implementation for xss attacks

I searched extensively for good materials for prevention of xss attacks using OWASP ESAPI. But could not find any beginner material. I found a blog for basic security but not explicitly for XSS ...
2
votes
1answer
137 views

how about using OWASP dependency check tool to address Top 10 2013-A9-Using Components with Known Vulnerabilities [closed]

I know the OWASP dependency check tool is really good in finding vulnerable dependencies and I have used it personally for experimental purposes. But, has anybody used it at an enterprise level, like ...
2
votes
2answers
6k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
2
votes
1answer
189 views

Is there something like the OWASP top 10 for BizTalk applications? [closed]

I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?
2
votes
1answer
69 views

Are PHP magic methods really necessary for PHP object injection?

I'm trying to understand the PHP Object Injection flaw in vBulletin 5.1.x (CVE 2015-7808) and I stumbled across the requirements for Object Injection as stated by OWASP: The application must have ...
2
votes
2answers
282 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
2
votes
1answer
86 views

How to find known vulnerability in third party javascript [closed]

Currently i am using owasp dependency-check to find and mitigate known security issue in third party jar. Is there any similar tool/app to check known security issue in third party javascript?
2
votes
1answer
128 views

OWASP WebGoat Warning Meaning

I am just starting with WebGoat. On their GitHub page [https://github.com/WebGoat/WebGoat], they have this warning posted: WARNING 1: While running this program your machine will be extremely ...
2
votes
1answer
116 views

How to prevent browser from rendering malacious content if request or response is hacked

We are currently working on OWASP security fixes and we identified one attack scenario for which we are trying to figure out a possible solution: User hits a valid HTTPRequest to our application. ...
2
votes
1answer
1k views

Mod_security for Apache2 blocks cURL!

I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
2
votes
1answer
42 views

Bypass char filtering - security shephard

I'm stuck in the XSS part of the security shephard OWASP app. I am not looking for someone to tell me the solution, I just need to learn how to find it myself, I'm a bit rusty on XSS. So what I know ...
2
votes
1answer
253 views

Securing the backend of your web application?

We are grappling with how to architect are back end for security. Some of the recommendations I've seen look like this: Source Some will have another firewall between the application server and ...
2
votes
0answers
45 views

Advice on if I should talk at my local user group about NIST, InfoSec etc [closed]

I have been toying with the idea for a while now about doing my first talk, on my last project I was building a Risk Management portal for information security so I had to read all about Risk ...
1
vote
3answers
833 views

Testing Web Application Firewall Configuration (ModSecurity)

What is the best way of testing my Firewall configuration as i have deployed the Core Rule set provided by the OWASP. But my rule configuration was giving me too many false positives which i resolved ...
1
vote
1answer
273 views

Is OWASP ESAPI .NET Edition really used? Is this project still alive?

I have just seen that the last release has been pushed out in 2009 and that raised my doubts.
1
vote
1answer
375 views

Why should I run OWASP Broken Web Applications Project as host only or NAT?

We have a hard time getting VMWare to work in bridged mode. We can get it to work in Bridged mode. Why is it so important to run it with host only or NAT?
1
vote
3answers
208 views

Is this code javascript vulnerable to DOM based XSS?

Code : <script> document.theform.reference.onchange = function(){ var id = document.theform.reference.selectedIndex; var url = document.theform.reference[id].value; ...
1
vote
1answer
44 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...