An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
1answer
53 views
Asynchronous vs. Synchronous authentication process
I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).
I'm at the stage where I have to design the authentication and I had a question about ...
2
votes
2answers
120 views
Allowing user to access password protected website without disclosing the password
A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
-2
votes
1answer
37 views
Using Old version of mysql connector's security issue [closed]
I'm using asp.net 4.0 and MySQL. Last week my hosting firm changed security level of from full to medium. MySQL connector doesn't work correctly anymore. For this reason I'm using old version of ...
3
votes
1answer
170 views
What servers or clients are immune to related-domain cookie attacks? (*.example.com)
In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com).
Lacking any tangible solution, ...
38
votes
13answers
4k views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
13
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
-2
votes
0answers
48 views
Safe application hosting using LAMP [closed]
I have a Ubuntu Server with PHP, MySql/Postgres configured on it. I have a Symfony2 application, which looks something like this:
Symfony/
app/ (php app files)
src/ (php app files)
vendor/ ...
23
votes
4answers
2k views
Is it okay to reveal database's table names?
I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
2
votes
1answer
56 views
Is it secure to use a URL to automatically authenticate to an OAuth-protected API?
I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password.
We have created an API which is protected using OAuth 2.0. I want to ...
3
votes
1answer
78 views
Online only encryption
I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires ...
1
vote
2answers
63 views
Open exploits database, with structured data (CMS name, version, etc.)
For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs)
I found some (open) exploits databases that list ...
5
votes
2answers
146 views
Flaws in Crypto Cat
I've heard from several people that Crypto Cat has some security flaws. Has anyone performed an analysis of the system and written a whitepaper? I'm curious what the flaws specifically are and what ...
-4
votes
0answers
28 views
Cryptocat Backend Database [closed]
I was reading about cryptocat and it seems behind it all is an XMPP server. Wouldn't the encrypted messages be stored in the XMPP server's database? Does anyone know if they retain these encrypted ...
6
votes
0answers
195 views
Web Authentication using PKI Certs [migrated]
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
4
votes
3answers
154 views
Does the ability for a user to choose the value of a session id cookie constitute a security flaw?
In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
10
votes
2answers
414 views
Security quiz for developers
Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
-3
votes
2answers
46 views
Idea: Safety data exchange with OTPs [closed]
I need a safety data exchange system.
My idea was:
Every person is getting an usb stick with a list of One-Time-Pads (random data by random.org). Each list/block of random data has an identifier ...
1
vote
1answer
98 views
Site Hacked - Where to go from here? [closed]
Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory.
I ...
1
vote
2answers
50 views
CSRF protection with cookie and AJAX
I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question.
I have not used CodeIgniter as a programmer, but I have ...
0
votes
2answers
55 views
Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?
As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains.
In other ...
2
votes
1answer
68 views
Authenticating users on offline devices such as ipad
We are wanting to authenticate the user inside a webapp (javascript/html inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realise this ...
-2
votes
0answers
49 views
Malware on Facebook, what to do after “infection”? [closed]
I've heard about viruses that spread through and target the Facebook platform and I find it hard to comprehend. How is Facebook "complex" enough to run a virus?
On my profile there was a post I ...
7
votes
1answer
148 views
Why does Hydra return 16 valid passwords when none are valid?
I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
I assume ...
3
votes
1answer
72 views
Secure information exchange between web applications using browser redirection
We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
1
vote
1answer
50 views
Random pages getting created on classic asp site
In the file structure of my site, I see some randomly generated files like 'justinbieber.asp', 'justinbiebershoes.asp','guccishoes.asp' etc. I tried deleting them but they are generated again. Can ...
5
votes
2answers
55 views
Preventing fraudulent access to restriced resource on the web?
I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
11
votes
3answers
306 views
Cross Site Scripting without special chars
I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client.
The application has a filter ...
0
votes
1answer
37 views
App uses html_safe method, possible issues
For one who doesn't know, .html_safe is rails method, which outputs strings as part of html document.
The problem is that string is user inputed. What did I do to prevent some bad actions - regexp ...
15
votes
2answers
1k views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
4
votes
1answer
67 views
Security consequence of Javascript hole in an online chat?
For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?
3
votes
1answer
67 views
Design of system based on HTTPS, Client Certificates and custom CA
I have the following system:
2 application servers. At the beginning is installed the first server and later is installed the second one.
A client access from a browser to both servers
Application ...
4
votes
4answers
1k views
Is client side encryption really better than server side?
Web application may encrypt all user data at client side to convince users that it can't decrypt them.
When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
0
votes
2answers
88 views
Blackbox vs whitebox testing your own site?
When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
12
votes
2answers
141 views
Does it make sense to hash a session id before passing it to an advertisement partner?
My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
9
votes
3answers
145 views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
-1
votes
2answers
31 views
Interpreted VS Compiled web frameworks and trust
OK here is a big question. Interpreted languages have many advantages over the compiled languages when it comes to web application.
But what is the ftp server is hacked or the web hosting company ...
2
votes
2answers
106 views
CSRF protection and Single Page Apps
I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token.
Should I send a CSRF ...
13
votes
2answers
2k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
-5
votes
0answers
31 views
Encrypt .war file java web application? [duplicate]
Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
-5
votes
1answer
108 views
Protect java WEB application inside the server(against reverse engineering) [closed]
I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work.
The project ...
1
vote
2answers
119 views
How to allow only some specific computer systems to access website? [duplicate]
I need a process to allow only certain computer systems access to the website irrespective of the network they are using.
Much like a Licensing system, I can provide a private key or something ...
2
votes
2answers
82 views
Is it safer to store the XSRF value inside your JavaScript?
To protect yourself against XSRF, you need to have a separate token on a page.
See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood
As the posting suggests, its best to have those ...
8
votes
2answers
180 views
Isolating Web application hosted on same web server
I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
0
votes
1answer
206 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
3
votes
4answers
117 views
How to prevent restrict access to a web application to authorized devices only?
I have developed an MVC web app.
Right now, the client using this app in office area.
The client has requested that no one should use this app on any device except the office's PC/tablets.
Now ...
3
votes
2answers
200 views
How does YouTube prevent automatic piracy?
When I visit YouTube, my browser accesses the website and begins to play whatever video I select. By its very nature, this involves YouTube sending the content of the video to my computer. Not only ...
4
votes
3answers
422 views
Could this solve SQL injection and XSS vulnerabilities?
edit I got some good responses about Frameworks but the crucial part of this is that it's built into the programming language itself, so it's literally impossible to write an XSS vulnerable or SQL ...
-1
votes
1answer
61 views
Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]
Background:
WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company.
Alternative one ...
7
votes
4answers
1k views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
3
votes
4answers
322 views
Obfuscating JavaScript code
Some Flash developers are afraid of JavaScript. Their point of view:
Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
