2
votes
2answers
89 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
1
vote
1answer
166 views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
5answers
155 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
0
votes
1answer
76 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
2
votes
1answer
128 views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
19
votes
4answers
1k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
1
vote
1answer
154 views

How to check whether a link is safe or not? [closed]

I've been working on a task to find threats in a social network called Skyrock. For which, I've managed to retrieve a significant amount of URLs by crawling various user profiles and parsing the data ...
15
votes
5answers
1k views

Security of an initial redirection from http://example.com to https://example.com

Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo>. I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now ...
78
votes
8answers
5k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
0
votes
1answer
193 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
1
vote
1answer
235 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
3
votes
1answer
2k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
4
votes
3answers
356 views

In what way is a partially encrypted webpage insecure?

What are the potential vulnerabilities that might arise if a webpage is only partially encrypted. I can think of 2 possibilities: You can change the non-encrypted parts of the page (HTML, CSS, ...
3
votes
1answer
192 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
4
votes
1answer
110 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
3
votes
2answers
70 views

What precaustions should be taken when the file displayed by a webpage is specified by the GET value

My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
4
votes
1answer
144 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
2
votes
4answers
2k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
1
vote
1answer
255 views

Using a Web Server to steal NTLM credentials

I am trying to design an attack vector against an organization in which the pen tester (myself), steals NTLM credentials through HTTP. I am thinking of these scenarios: 1- I set up a web server on my ...
3
votes
6answers
356 views

Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?

I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case. Is there a way to determine and display the state of HTTPS on a page ...
1
vote
1answer
800 views

bypass a regex filtration to perform an xss attack

Does the regex [\w/$!.*-]+$ stop the injection of payloads like : "><script>alert(4)</script> " onload="alert(4)" ...
1
vote
1answer
461 views

What is the “about:blank” context for browser security and privacy?

This blog is describing a way to hide the referer header in various situations. Specifically he is referring to things that run in the about:blank context. What is the about:blank context? How does ...
1
vote
1answer
91 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
4
votes
3answers
934 views

Is there any way I can block (or conditionally approve of) iFrames on the client side?

Given that iFrames are used in many common exploits, I'd like to conditionally disable iFrames except for sites that require it such as GMail, or MasterCard SecureCode. I also suspect the ...
0
votes
1answer
2k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...
7
votes
3answers
1k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
6
votes
5answers
3k views

Why are iframes allowed at all in modern browsers?

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
15
votes
4answers
2k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
4
votes
5answers
8k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
10
votes
1answer
572 views

How can I embed iframe securely without restricting its functionality?

I'd want to embed an iframe from untrusted site into web application. Iframe: should be able to run Javascript and browser plugins (Flash, etc.) should not be able to access my web application ...
3
votes
1answer
222 views

How can I use certificates to secure my webservices? What is available to javascript?

I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
0
votes
3answers
113 views

Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)

Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
2
votes
1answer
274 views

Updated version of Browser Security Handbook

Google's Browser Security Handbook is a brilliant resource for web application security, and in particular, for understanding how browsers behave. It discusses many issues, and contains tables ...
8
votes
4answers
641 views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
2
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
9
votes
2answers
413 views

User-specific Subdomains : JavaScript security

If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
2
votes
3answers
1k views

How to block the websites on client machines

In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like: ...
20
votes
2answers
1k views

From a technical standpoint, how does the zero-day Internet Explorer vulnerability discovered in September 2012 work?

I'm looking for an answer that explains the issue from the prespective of a developer/engineer. What is exactly being exploited and why does it work? Please note that I am not looking for ...
2
votes
3answers
3k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
7
votes
3answers
3k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
3
votes
1answer
195 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
13
votes
4answers
3k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
5
votes
1answer
29k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
4
votes
1answer
884 views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
-1
votes
1answer
116 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
8
votes
2answers
2k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
6
votes
3answers
1k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
1
vote
3answers
891 views

Could some one please explain - Remote Post SQL Injection

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here. Any help would be ...
1
vote
2answers
89 views

Preventing a socially-engineered transaction

Can you explain what this blog means when it says: Something to think about when it comes to transaction signatures – demonstrating the need to keep the entire process off the PC (in this case) ...
5
votes
4answers
9k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...