An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
0answers
2 views

How can I tell if a user is access website with a forged IP?

there is a username (USERX). It's a suspended user. It it appearing in my user login files. It always appears in the middle of someone elses attempt (USERA) to reset their password, and WITH USERA's ...
0
votes
1answer
30 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
0
votes
2answers
15 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
0
votes
0answers
35 views

Calling a HTTPS web service [on hold]

Background I have a Java application, one part of it is to call a HTTPS web service regarding payment (offered by a company called PayPoint). The application is sitting on a IBM Websphere server. ...
1
vote
0answers
16 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
1
vote
1answer
105 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [on hold]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
0
votes
1answer
50 views

Java desktop app vs web service [on hold]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
0
votes
2answers
135 views

Is this the most secure encryption/hashing system? [on hold]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...
42
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
1
vote
1answer
71 views

How to pen-test RAP applications

Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google ...
-2
votes
2answers
114 views

Is it illegal to access a public file that contain private information? [closed]

There is a website that I was testing to see if they have any vulnerability. To my surprise I found that one of the folders, like /docs with index of /, and they have a file that will contain all ...
1
vote
2answers
325 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
1
vote
2answers
90 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
0
votes
2answers
50 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
0
votes
0answers
32 views

Confused about SSL certificates needed for Windows proxy [migrated]

I am completely new to security, and I'm confused about what kind and how many SSL certificates I need. I have a REST API server running on a windows server 2012. It's currently listening to HTTP ...
1
vote
3answers
113 views

Trouble understand login vulnerabilities

I'm testing my own web page with the following vulnerabilities. #1: Form escapes ' to \' So if a user tries to enter the following information: username: 'or'1=1 password: m username will ...
0
votes
0answers
48 views

Firefox stopped working with our app after 36.0.1 [migrated]

We have a web application that works on all browsers and firefox before 36.0.1 Have done all the typical things, clearing cache, reinstalling ff, etc. Multiple different machine from different ...
3
votes
1answer
146 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
1
vote
1answer
74 views

What is the safest way to encrypt a password that can be decrypted at a later time?

In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text. What would be the best ...
-1
votes
1answer
48 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
0
votes
0answers
10 views

FIDO U2F tokens Web Browsers compatibilty [migrated]

I'm trying to integrate U2F Authentication in GWT project and I need to know if is this solution compatible with all new web browsers (Firefox, Internet Explorer, Safari...)? Normally in Google Chrome ...
1
vote
0answers
45 views

Pre-internet encryption for a rest application

I have a project idea that I want to code. There will be a huge gain for my user to be able to use it over a website and on their mobile device. The problem is the data will contains financial data ...
0
votes
1answer
49 views

How does a reverse proxy change the security posture of a web server residing in the DMZ? [closed]

How does the reverse proxy change internal and external security posture with a reverse proxy compared to not having a reverse proxy? For example, you have a publicly accessible iis server, what is ...
1
vote
0answers
17 views

WAF at Transparent Mode [migrated]

I want to use Mod Security as transparent mode. Mod security WAF should be between server and client and client provided with only server's ip address to access the site. The client should not aware ...
0
votes
2answers
73 views

Contact form without validation

one of our web page is a contact form eg name, email, and a textbox for sending comments. It seems like if we leave all of those text fields blank and click the submit button, it still went through ...
4
votes
4answers
371 views

How strong is visualCaptcha?

I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives: Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right ...
0
votes
1answer
66 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
2
votes
3answers
135 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
1
vote
1answer
82 views

Detecting web app attacks by parsing log files [duplicate]

Following up on this question as the answers are now 5 years old: Can I detect web app attacks by viewing my Apache log file? My boss has tasked me with analyzing our access.log and error.log files ...
2
votes
4answers
185 views

What would you call an attack where authenticated user modifies other users information on web app?

Authenticated user on web app, using other people's id to update or change their information. So basically the web app is not checking for person who is logged in against the person who he/she is ...
0
votes
1answer
47 views

Feasibility of creating an in-memory web app (that runs from a CD-rom on a web server) for sharing self-destructing messages

This question is about a hypothetical in-memory web application that is used for exchanging encrypted messages that passively self-destruct in X amount of minutes. Here the messages would be stored ...
0
votes
0answers
25 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
0
votes
1answer
44 views

Making a Judgement on a User's IP Usage

We have a click exchange-type web application that allows users to receive stats boosts within a game. Stats boosts are based off unique IP addresses which poses a problem for users who use proxies or ...
0
votes
2answers
94 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
0
votes
2answers
88 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
1
vote
2answers
75 views

ruby on rails pentesting web applications

I am currently testing a RoR web application, but I am honestly at a bit of a loss, I have never gone up against a RoR application before and I was wondering if there were any specific tools I could ...
3
votes
1answer
57 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
1
vote
1answer
80 views

Preventing XXE Injection

I've stumbled upon an exploit method which I haven't really had time to investigate before. XML eXternal Entity is said to be susceptible of a server-side type of injection. I can specify a Document ...
4
votes
2answers
44 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
2
votes
1answer
55 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
4
votes
2answers
106 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
4
votes
3answers
287 views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize ...
1
vote
1answer
34 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
1
vote
1answer
101 views

mail.google.com identity doesn't match

I got This website doesn't supply identity information in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using ...
2
votes
1answer
62 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
1
vote
2answers
67 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
3
votes
2answers
53 views

Issues with using TLS Session Id for Web App Session?

Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere. This seems useful in that I don't have to worry ...
3
votes
3answers
129 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
3
votes
4answers
1k views

Is it secure to have source code for website public? [duplicate]

I am working on a website and would like to have it under revision control. I have used git for earlier projects before and I like it. This project though is a website written in Django. I am totally ...
2
votes
1answer
36 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...