An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
1answer
54 views
Asynchronous vs. Synchronous authentication process
I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).
I'm at the stage where I have to design the authentication and I had a question about ...
2
votes
2answers
122 views
Allowing user to access password protected website without disclosing the password
A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
-2
votes
1answer
37 views
Using Old version of mysql connector's security issue [closed]
I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
-2
votes
0answers
49 views
Safe application hosting using LAMP [closed]
I have a Ubuntu Server with PHP, MySql/Postgres configured on it. I have a Symfony2 application, which looks something like this:
Symfony/
app/ (php app files)
src/ (php app files)
vendor/ ...
2
votes
1answer
57 views
Is it secure to use a URL to automatically authenticate to an OAuth-protected API?
I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password.
We have created an API which is protected using OAuth 2.0. I want to ...
3
votes
1answer
78 views
Online only encryption
I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires ...
-4
votes
0answers
28 views
Cryptocat Backend Database [closed]
I was reading about cryptocat and it seems behind it all is an XMPP server. Wouldn't the encrypted messages be stored in the XMPP server's database? Does anyone know if they retain these encrypted ...
1
vote
2answers
64 views
Open exploits database, with structured data (CMS name, version, etc.)
For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs)
I found some (open) exploits databases that list ...
1
vote
1answer
99 views
Site Hacked - Where to go from here? [closed]
Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory.
I ...
5
votes
2answers
147 views
Flaws in Crypto Cat
I've heard from several people that Crypto Cat has some security flaws. Has anyone performed an analysis of the system and written a whitepaper? I'm curious what the flaws specifically are and what ...
1
vote
2answers
50 views
CSRF protection with cookie and AJAX
I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question.
I have not used CodeIgniter as a programmer, but I have ...
0
votes
2answers
55 views
Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?
As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains.
In other ...
2
votes
1answer
68 views
Authenticating users on offline devices such as ipad
We are wanting to authenticate the user inside a webapp (javascript/html inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realise this ...
-2
votes
0answers
49 views
Malware on Facebook, what to do after “infection”? [closed]
I've heard about viruses that spread through and target the Facebook platform and I find it hard to comprehend. How is Facebook "complex" enough to run a virus?
On my profile there was a post I ...
6
votes
0answers
195 views
Web Authentication using PKI Certs [migrated]
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
3
votes
1answer
72 views
Secure information exchange between web applications using browser redirection
We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
7
votes
1answer
148 views
Why does Hydra return 16 valid passwords when none are valid?
I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
I assume ...
1
vote
1answer
50 views
Random pages getting created on classic asp site
In the file structure of my site, I see some randomly generated files like 'justinbieber.asp', 'justinbiebershoes.asp','guccishoes.asp' etc. I tried deleting them but they are generated again. Can ...
5
votes
2answers
55 views
Preventing fraudulent access to restriced resource on the web?
I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
0
votes
1answer
37 views
App uses html_safe method, possible issues
For one who doesn't know, .html_safe is rails method, which outputs strings as part of html document.
The problem is that string is user inputed. What did I do to prevent some bad actions - regexp ...
4
votes
1answer
67 views
Security consequence of Javascript hole in an online chat?
For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?
3
votes
1answer
67 views
Design of system based on HTTPS, Client Certificates and custom CA
I have the following system:
2 application servers. At the beginning is installed the first server and later is installed the second one.
A client access from a browser to both servers
Application ...
0
votes
2answers
88 views
Blackbox vs whitebox testing your own site?
When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
-3
votes
2answers
46 views
Idea: Safety data exchange with OTPs [closed]
I need a safety data exchange system.
My idea was:
Every person is getting an usb stick with a list of One-Time-Pads (random data by random.org). Each list/block of random data has an identifier ...
11
votes
3answers
309 views
Cross Site Scripting without special chars
I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.
The application has a filter ...
9
votes
3answers
146 views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
-1
votes
2answers
31 views
Interpreted VS Compiled web frameworks and trust
OK here is a big question. Interpreted languages have many advantages over the compiled languages when it comes to web application.
But what is the ftp server is hacked or the web hosting company ...
2
votes
2answers
107 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
-5
votes
0answers
31 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
12
votes
2answers
141 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
-5
votes
1answer
109 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
1
vote
2answers
120 views
How to allow only some specific computer systems to access website? [duplicate]
I need a process to allow only certain computer systems access to the website irrespective of the network they are using.
Much like a Licensing system, I can provide a private key or something ...
0
votes
1answer
207 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
2
votes
2answers
82 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
3
votes
4answers
122 views
How to prevent restrict access to a web application to authorized devices only?
I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.
Now ...
8
votes
2answers
180 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
3
votes
2answers
200 views
How does YouTube prevent automatic piracy?
When I visit YouTube, my browser accesses the website and begins to play whatever video I select. By its very nature, this involves YouTube sending the content of the video to my computer. Not only ...
-1
votes
1answer
61 views
Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]
Background:
WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company.
Alternative one ...
7
votes
4answers
1k views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
3
votes
4answers
323 views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
3
votes
3answers
134 views
Can I safely use an encrypted URL parameter for the session id?
I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
1
vote
1answer
57 views
Securing Downloadable Files on Website Per User
I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
14
votes
6answers
1k views
Is showing your IP address in the URL a bad practice?
Someone told me that showing your IP address in a URL (like hxxp://45.67.134.34/default.html) is easier to hack. Is that true? I could trace any domain name and get its IP number as well.
3
votes
2answers
67 views
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
23
votes
4answers
2k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
4
votes
1answer
111 views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
0
votes
2answers
97 views
How to allow only the public key owner to submit requests to my site? And what is this type of security called?
This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.
I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
3
votes
3answers
152 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
4
votes
3answers
155 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
7
votes
3answers
603 views
How can I find subdomains of a site?
One of the things I need to do from time to time is to find subdomains of a site for example.
Starting with example.com
sub1.example.com
other.example.com
another.example.com
I'm ...
