Tagged Questions
3
votes
2answers
64 views
What precaustions should be taken when the file displayed by a webpage is specified by the GET value
My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
4
votes
1answer
98 views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
2
votes
4answers
225 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
1
vote
1answer
141 views
Using a Web Server to steal NTLM credentials
I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios:
1- I set up a web server on my ...
2
votes
6answers
215 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
1
vote
1answer
179 views
bypass a regex filtration to perform an xss attack
Does the regex [\w/$!.*-]+$ stop the injection of payloads like :
"><script>alert(4)</script>
" onload="alert(4)"
...
1
vote
1answer
130 views
What is the “about:blank” context for browser security and privacy?
This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context.
What is the about:blank context?
How does ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
4
votes
3answers
148 views
Is there any way I can block (or conditionally approve of) iFrames on the client side?
Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode.
I also suspect the ...
0
votes
1answer
269 views
Websocket implication for firewalls
(I've read several questions here about websocket but apparently there's no websocket tag)
If I understand correctly websockets are using TCP trafic over port 80.
What are the implication, if any, ...
4
votes
3answers
418 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
5
votes
5answers
413 views
Why are iframes allowed at all in modern browsers?
I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
13
votes
4answers
874 views
Should sensitive data ever be passed in the query string?
Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
0
votes
0answers
68 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
1
vote
4answers
938 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
10
votes
1answer
367 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
3
votes
1answer
105 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
0
votes
3answers
89 views
Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)
Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
2
votes
1answer
157 views
Updated version of Browser Security Handbook
Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
2
votes
4answers
804 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
8
votes
2answers
185 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
2
votes
3answers
420 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
20
votes
2answers
1k views
From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?
I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work?
Please note that I am not looking for ...
2
votes
3answers
1k views
Javascript Malware: How does it work, and how can it be mitigated?
I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
6
votes
3answers
906 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
3
votes
1answer
135 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
5
votes
1answer
3k views
Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?
I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug?
I'm on a WPA2 encrypted wireless connection using Chrome ...
4
votes
1answer
588 views
How to detect cookie stuffing attacks?
So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
-1
votes
1answer
101 views
What was Microsoft trying to do when they had Windows Updates over their website? [closed]
What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
7
votes
2answers
844 views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
5
votes
3answers
665 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
1
vote
3answers
804 views
Could some one please explain - Remote Post SQL Injection
Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.
Any help would be ...
1
vote
2answers
82 views
Preventing a socially-engineered transaction
Can you explain what this blog means when it says:
Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
4
votes
4answers
5k views
Security issues using iframes
We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes.
...
5
votes
2answers
569 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
2
votes
2answers
77 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
3
votes
1answer
148 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
1
vote
1answer
309 views
Wireshark log analyzing
I have the following Wireshark log and I want to categorize the attack. I think it prints the user under apache runs and then prints the system information. From this log can we determine if the ...
7
votes
2answers
312 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
0
votes
2answers
145 views
What is Greasemonkey / Userscripts and how does it relate to IT Security?
I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run.
What are the benefits of ...
2
votes
4answers
303 views
Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?
Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
4
votes
1answer
243 views
How do I check the code of a Chrome extension to make sure it's not stealing my info?
I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
9
votes
3answers
739 views
localStorage for apps over https. What expectations are there?
I run an online gradebook. To keep student data private, I transfer all data over https.
Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
2
votes
2answers
725 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
7
votes
3answers
235 views
How do I secure my advertisement space against ad overlay browser attachments?
I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
10
votes
3answers
295 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
3
votes
3answers
211 views
Where's the security when a payment gateway let website handle Credit Card detail
Has anyone worked with eWay payment gateway before?
Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
7
votes
5answers
777 views
Websites that interactively test browser security (XSS, CSRF, Javascript, etc)
I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
