An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
3answers
119 views

Email confirmation techniques in major sites

The way I understood traditionally for email confirmations to work is the user registers to the site with their email and then to login they must verify their email. If they have not verified ...
1
vote
1answer
40 views

open redirect via POST? [duplicate]

HTTP Request(POST): per_page=security.stackexchange.com&order=questions&redirect=HTTP://security.stackexchange.com/ So when I record my request I get these 3 parameters and when I edited it ...
15
votes
2answers
2k views

Why is it insecure to store the session ID in a cookie directly?

I am learning about session middleware. You have to supply a secret or the middleware complains: app.use(session({ secret: "abc", resave: false, saveUninitialized: false, store: new ...
0
votes
0answers
63 views

Adblock Plus blocking a lot of ads on webpages that don't even have ads? [migrated]

I was just checking my own website and noticed that Adblock Plus v1.9 blocked 13 ads on one of my pages and another 4 on one other. This is interesting to me because I have no ads on my site. I'm ...
0
votes
1answer
43 views

Control access to public API

I'm working on a public API for project X. System allows to register an app_id and call API methods providing it, as usual. Now, I need to develop an official mobile client for project X that should ...
8
votes
4answers
264 views
+100

What are the drawbacks of login request throttling?

In a web application, one way to protect against password guessing attacks is to lock out accounts after a set number of failed logins. This could be done on both source IP address and username. For ...
0
votes
1answer
25 views

JWT for email validation of an account

I am thinking of using the this registration flow for my site: 1) User registers by entering email and password. 2) Enter the email and hashed password into my database 3) I then construct an ...
0
votes
2answers
38 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
1
vote
1answer
158 views

Should I trust zxcvbn with my password?

I want to measure current and future password entropy with the zxcvbn formula. Is there any way to test and detect if the input on this website is truly confidential? EDIT: 1. I found an ...
2
votes
3answers
122 views

Where is the most secure location to host an admin panel?

I have an admin panel on my site, that enables me to control the content on my website. In order for the admin panel to achieve this, I must have a connection to the site's database. I have two ...
1
vote
2answers
281 views

What do I do if I find XSS on my website?

I found reflected XSS on my website. And its fixed now. There are a lot of websites which tell how a XSS can be detected or what can be compromised but I could not find what measures should be taken ...
0
votes
1answer
81 views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
1
vote
1answer
93 views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
2
votes
0answers
65 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
1
vote
0answers
66 views

WhatsApp Password generation [closed]

Is it known how the WhatsApp-Servers generate the password for the user? My Google-Fu is not strong enough to find it out by myself. For reference (Step 6 / 2, I mean the step in which the server ...
-1
votes
0answers
32 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
1
vote
1answer
38 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
0
votes
1answer
67 views

Can servers store the mac address of the computer on the server side to prevent session hijacking?

Can servers store the mac address computer on the server side to prevent session hijacking? For example, if in the server side, the servers store the mac address and the session id as a pair and ...
0
votes
1answer
44 views

What is a good risk assessment for different types of online file references?

Personally I'm a big fan of hosting everything myself, just because of the privacy aspect. For that reason I try to use external files as least as possible. Nevertheless, I'm wondering if it is a ...
1
vote
2answers
80 views

Saving an Id on a cookie. Security point of view?

I'm developing an ASP.NET MVC 5 website, which a user can select some filters, based on those fillers the server process a result, and the user can make a order and pay for it. In my Order table i ...
0
votes
2answers
56 views

Do I require a SSL certificate for using Google Login?

I am working on a new site, and in order to avoid security hassles, I'm planning to provide Google and Facebook login to my website. Do I still need a SSL certificate or is it not necessary? ...
0
votes
0answers
46 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
1
vote
1answer
84 views

Are there any security disadvantages of using production SSL certificate in non-prod environments?

My client has a wildcard certificate *.thierdomain.com that they are using for half a dozen of production web sites. For each of theses sites there are duplicates in several environments, dev, qa, ...
9
votes
3answers
824 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
2
votes
3answers
283 views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
2
votes
1answer
77 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
3
votes
3answers
129 views

Can a browser JavaScript console ever be an issue?

I'm sure most of you are familiar with the JavaScript-based game Candy Box. As you probably know, one can cheat this game's candy system by sending commands to the console. For instance, if you ...
1
vote
1answer
90 views

Concerns discussing 'illegal' activities in a job interview [closed]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
2
votes
1answer
134 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
0
votes
1answer
37 views

How to manage a custom session in a webapp?

I was reading through the OWASP Cheat Sheet and something mentioned in the "Weak Authentication and Session Management" row did not make sense to me. It is recommended in the Design Column, that ...
1
vote
2answers
87 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
1
vote
1answer
90 views

Security of IFTTT

IFTTT looks like a powerful service but I'm also highly sceptical of its security. Could somebody give me a brief rundown of how you think it works and what the security implications are please? I've ...
0
votes
0answers
23 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
3
votes
2answers
88 views

How do we verify identity before creating a new admin account?

We are designing the security for a B2B Saas service, the user and admin accounts are based on the customer's email addresses - typically our customers are small organisations without their own in ...
0
votes
1answer
227 views

Is this a website hacking attempt, and if so, what is it trying to achieve?

I've recently seen a few strange requests made on our site, I'm wondering what they might be. Normally we get sql injection attempts like this: ...
2
votes
1answer
89 views

Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet. The web app exposes web ...
2
votes
2answers
85 views

Website being open inside 3d party domain/frame, is this a possible attack?

I recently had a huge increase in visits of a website I manage. On deeper check I discovered I had a new referral. When I opened the website I was quite surprised. It's not a just a referral, ...
5
votes
1answer
131 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think about: There ...
3
votes
2answers
130 views

web security testing - vulnerability issue

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only. While testing, I came to know that the pdf files can be downloaded by authorized users only. This ...
0
votes
0answers
72 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
1
vote
1answer
256 views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...
0
votes
1answer
74 views

sqlmap cannot find a dispatched vulnerability

I have a known sqli vulnerability that I'd like to try out with sqlmap in a web application; however, I don't believe sqlmap is able to figure this one out. Here's how the system works: Inject on a ...
0
votes
3answers
101 views

Security benefits of hosting your CMS on localhost

If I host the CMS for my online website on localhost, will that mean that no one online can access it? If not, what is the most secure way to store your CMS?
2
votes
3answers
123 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
5
votes
1answer
149 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
0
votes
3answers
290 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
1
vote
2answers
176 views

Storing encryption key in a cookie?

I have a website issue that I am addressing by storing an encryption key in a cookie. I want to describe my issue and my solution, and see if someone smarter about such things than I thinks this is a ...
2
votes
2answers
186 views

Website security checklist?

I'm building a web service (a control panel for clients) (PHP on linux apache) and trying from the design to make it the most secure as I can, Can anyone provide me with some kind of a check-list of ...
4
votes
3answers
126 views

Same Origin Policy - XHR response

I know that Same Origin Policy (SOP) prevents a page/script from one origin to read response from another origin, but it does not prevents the page/script from making a XMLHttpRequest (XHR) request to ...
13
votes
4answers
705 views

Custom socket server on the internet running as root

We are writing a custom socket server which runs on a high port. Until recently, it has been running behind a corporate firewall. Now, it has been decided that the server should be taken outside the ...