An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

-3
votes
0answers
28 views

Basics required to do XSS [on hold]

I am new to information security , so i want to know that what are the requirements of penetration testing of web application and How to learn XSS?
1
vote
2answers
56 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
-1
votes
0answers
46 views

Request on port 843 to fnes.amazon.com only on the login page of amazon [on hold]

I wonder if anybody knows why amazon, only on their login pages (both for amazon.com and for aws console login) does a request on port 843. This request is apearantly to name fnes.amazon.com My ...
-1
votes
0answers
19 views

Drawbacks of OpenVAS [on hold]

Delibrate on any major vulnerability detection capability missing in OpenVAS compared to its commercial alternative solutions. Please.
-1
votes
0answers
30 views

How to install webgoat on ubuntu with lamp server [closed]

Can any one give me the breif instructions for how to install Webgoat on Ubuntu 14.04 (not a server) step wise I am facing problem with setting java_home variable to java 1.5 jdk
3
votes
2answers
325 views

How to keep someone from analyzing our site?

For the past days some script kiddie has been scanning our site with w3af and some basic manual checks. Although I know the site is "secure" because I analyze it almost everyday, I'm not perfect and ...
3
votes
1answer
127 views

How secure are Google (Drive) Web Forms?

My child's school is using a Google Web Form to collect student and parent information, including occupations, addresses, maiden name, birthdays, contact information, and who the child resides with. ...
1
vote
0answers
45 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
1
vote
2answers
135 views

Can my University see what Stack exchange account I am logged into?

I have to log into an account to use the university internet, so I imagine they can see all the sites I view, but can they see what account I am logged into, and can I do anything to hide this?
0
votes
0answers
37 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
1
vote
1answer
74 views

Securely send password to script as parameter

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively. ...
4
votes
2answers
135 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
13
votes
3answers
3k views

Is encrypting SALT with given user's password more secure?

I'm learning about web security. I understand that passwords are hashed with salt. Why aren't the salts encrypted with same user's password? Cloudn't this make password cracking much harder? ...
0
votes
1answer
64 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
100 views

Execute a remote PHP shell which is inside a file I dont have permission to access

Hi need some help here. I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ ...
-2
votes
1answer
63 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
1
vote
1answer
85 views

Is Payment using an iframe more secure than using as Javascript library?

Traditionally most Payment providers only provide Hosted Payment Sites via redirect or iframe. But now an increasing number is also supporting payment integration via a Javascript library. I imagine ...
1
vote
1answer
34 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
1
vote
2answers
71 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
1
vote
2answers
78 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
2
votes
1answer
77 views

How does Mylar ensure encrypted data remains secure even if the live app code is compromised

Because Mylar does the decryption in the browser, the key is never stored on the server. Nice. This moves the threat to the browser, where, if the attacker is able to get a malicious script to be ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
5
votes
4answers
543 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
54
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
1
vote
1answer
193 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
2answers
80 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
-1
votes
0answers
31 views

Considerations for distributed authentication with online/offline app?

I am developing an application that will exist across three groups of machines: 1) A central web server. This is a publicly available site accessible via http. 2) Browser-based clients. Any number ...
1
vote
3answers
120 views

Where can I find a list of frowned upon usernames for web sites?

There are some usernames that shouldn't be allowed to register on online services, for example: administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin As far as ...
1
vote
5answers
100 views

Reply to email or text as verification?

I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
1
vote
3answers
117 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
1
vote
3answers
94 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
0
votes
1answer
99 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
0
votes
2answers
64 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
2
votes
1answer
120 views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
0
votes
0answers
32 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
1
vote
2answers
63 views

Need explanation on local file inclusion?

So few days ago a friend fixed an lfi on his site , and he sent me the url used , it was base 64 encoded url but not usual ../../../etc/passwd , It is : Li4vLi4vZXRjL3Bhc3N3ZAAucG5n Now decoded on ...
9
votes
1answer
473 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
0
votes
2answers
166 views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the ...
1
vote
5answers
163 views

Why after a website password reset am I asked to login again?

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
-2
votes
3answers
106 views

How to identify if my site is vulnerable to DOS/DDOS attacks? [closed]

I am hosting a site on a hosting server. How to identify whether my site is vulnerable to DOS/DDOS attacks?
1
vote
3answers
182 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
0
votes
0answers
85 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...
0
votes
2answers
68 views

What methods can be used to verify identity against a database?

I have a database with individual contact data for students... this data includes name, address, phone number, birthdate, etc. (no social... that would have made this too easy apparently, ha ha) I ...
0
votes
2answers
85 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
0
votes
1answer
163 views

How were hackers able to alter the text of my pages without a form or querystring?

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend. Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. ...
-1
votes
2answers
62 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
0
votes
0answers
32 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
0
votes
2answers
107 views

How to ensure that only my single page app can make requests to an API

I have a REST API that can potentially serve multiple web clients. I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this? ...
1
vote
2answers
90 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...