Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,392
questions
2
votes
1
answer
163
views
Webhook sending Purchase Details to handling Purchases from a Third Pary Service Secure?
I'm developing a mobile application for a client that sells digital courses on a service called Teachable that hosts their website and handles the purchase process for them. My client wants to keep ...
- 121
2
votes
1
answer
3k
views
XSS attack on websites that allows JS file upload?
Consider a website example.com that allows users to upload arbitrary JS files, that are then stored on the server and served to visitors with a JS content type. Could an attacker use this to perform ...
- 65.6k
4
votes
1
answer
3k
views
Can WebAssembly execution be disabled in browsers?
I've recently found out about this new technology, which recently became a World Wide Web Consortium recommendation and also that now almost all main browsers support it and it is enabled by default, ...
- 169
0
votes
1
answer
1k
views
Sending httpOnly cookie also in HTTP response body
I've done some researches on this topic, and I found this question on SE:
Sending session cookie inside the HTTP response body
But this answered my question just in part.
On login, my server will ...
- 103
0
votes
1
answer
6k
views
IP retrieval without visiting the site or clicking the link
There are sites like grabify and iplogger.org which allow you to get the IP of the person who has clicked the link. Logs are also generated by various bots when you send a message via Twitter, ...
- 3
2
votes
2
answers
473
views
How does password-append OTP validation work?
Recently when I was changing some Amazon account settings, I've noticed that they provide an option to validate the OTP by appending it to the password. How would this work, if the password is one-way ...
- 205
12
votes
2
answers
3k
views
Secure HTTP Headers - where should be implemented, WAF or code level?
I have a REST API exposed to the Internet and another application with form-based authentication. These apps are behind a Web Application Firewall.
Question is, where I should implement the below ...
- 151
35
votes
4
answers
10k
views
Is a public /admin route a security flaw?
I have a web application built in a classic MERN stack (MongoDB, Express, React, Node) and I want to create an admin route, so I figured I could just do it with a [url]/admin route.
Could that be a ...
2
votes
1
answer
392
views
What is the most unique data identifier for a phone user that cannot be repeated?
I'm currently developing an Android (and probably iOS in the future) application for my company.
I was wondering what is the most unique data identifier to authenticate the users. A data that cannot ...
- 559
29
votes
6
answers
12k
views
Poor error handling source code review
I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions:
1) Poor Error Handling: Overly Broad Throws
The methods in program1....
- 449
0
votes
1
answer
158
views
Does hiding php error messages increase security of the web app? [duplicate]
Many PHP frameworks such as Codeigniter on production environment opt-out to hide any PHP related error message. Also, that applies on other PHP frameworks as well such as Symphony and Laravel (with ...
2
votes
4
answers
253
views
Adding to the query string via input
I have a form that takes multiple input fields and makes an API request via GET.
The fields are not properly sanitizing input and I am able to add arbitrary parameters to the query string by ...
- 189
39
votes
7
answers
14k
views
Is it a security vulnerability to tell a user what input characters are valid/invalid?
For input validation on a website, are there any security concerns with disclosing to the user exactly what characters are valid or invalid for a given field?
CWE-200: Information Exposure says one ...
- 487
1
vote
1
answer
213
views
Security in web sockets
Scope: penetration testing of web server with critical information in it (user management).
I had an argument with my college about security in web sockets and I got stuck with him in one topic, ...
1
vote
0
answers
1k
views
How to abuse eval() in PHP
I'm trying to bypass a page that has an eval() and it works like this:
POST /anything.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
...
- 11
2
votes
1
answer
120
views
Code Change That Resulted in Database Fields and Values Exposed
At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system.
I've noticed that with one of the recent changes, you can now see ...
- 123
2
votes
2
answers
4k
views
SQL injection using URL query string (web application/php server)
Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
- 123
20
votes
3
answers
5k
views
How does Widevine, FairPlay, and other DRM's work under the hood?
I am trying to understand how DRM works under the hood. There doesn't seem to be much information about it on the web so I figured I would ask here.
After some attempted research, I found it ...
- 670
1
vote
1
answer
275
views
Public Digital Signature Validation with JWE
After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, ...
3
votes
2
answers
354
views
Testing web applications from an end user's perspective
I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable.
...
- 31
21
votes
8
answers
9k
views
Is PGP for user authentication a good idea?
I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication.
How I'm doing it right now
My current concept is modeled ...
- 329
3
votes
1
answer
247
views
Database Security - Encryption & Searching
I am completely new to cryptography but have been trying to make myself familiar with the concepts and applications. I have a project where I believe cryptography to be beneficial.
Project Info:
DB =...
- 309
0
votes
2
answers
282
views
Is there an impact of CRLF injection on static sites?
I found CRLF injection on a site but it doesn't has any login, session or anything or that sort. I wonder if there's any way to prove impact of CRLF injection here.
Something that I think can be done ...
- 1
1
vote
1
answer
4k
views
Storing third party API tokens in a database
Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
- 13
0
votes
1
answer
224
views
Is there a vulnerability other than XSS which can result in client side script execution?
If the intention of attacker is to execute an arbitrary client side script in the context of a web application, is XSS the only possible attack other than compromising the server with an RCE or a sub-...
- 3,951
1
vote
1
answer
338
views
Security Risk of outbound web calls [closed]
What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
- 111
0
votes
1
answer
102
views
Understanding patch for my report
I reported a flaw to the security team and they changed the UIDs from regular integers to hash kind of a thing. Like this, XXXX-XXXX-and-so-on
I still want to try and bypass things but I don't ...
- 1
2
votes
1
answer
2k
views
Is there any way to pretend like we are routing our request via cloudflare? [closed]
There is this Web App which uses cloudflare and to bypass certain things I had to find a way to access the actual web server directly. I tried numerous things and finally I think I have found the ...
- 21
2
votes
1
answer
126
views
Is there a way to access the local DB from external webapp?
I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to ...
3
votes
1
answer
2k
views
Is SQL Injection possible in this case (REGEXP)?
I'm on a website which have a program, there is a search input for keywords.
When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
- 31
0
votes
2
answers
290
views
Too much requests on the Nginx Server [closed]
I'm receiving a lot of requests like these
[server] zcat access*gz | grep 404 | awk '{print $1" "$7}' | sort | uniq -c | less
:
2 103.193.242.137 /MCLi.php
1 103.193.242.137 /Moxin.PHP
...
- 101
20
votes
3
answers
2k
views
How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?
About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and ...
- 303
15
votes
2
answers
6k
views
What is the impact of leaked recaptcha secret key?
Due to server configurations, our recaptcha secret key was publicly readable.
The key has been updated to a new one, but what is the actual impact of a malicious user getting a hold of the key?
...
- 273
2
votes
1
answer
7k
views
Session id in custom header
Is there a way to perform session fixation attack with XSS present if session id is passed in request header?
As far as I see it, theoretically there are three ways to do so:
intercept request on ...
- 123
1
vote
1
answer
111
views
Should we do request manipulation or network packet manipulation for SDN vulnerability analysis? [closed]
I am planning to do vulnerability analysis of a Software Defined Network. Since the connection between the business apps and the controller of the SDN would be done over the application layer, I would ...
- 11
0
votes
1
answer
193
views
Is RFI still a viable attack vector?
So, I know Remote File Inclusion bugs are practically dead within modern PHP applications since register_globals and allow_url_includes are disabled by default in php.ini (ever since php5x I believe?) ...
- 51
-3
votes
1
answer
197
views
What led to the prominence of storing JWTs in localstorage?
Could somebody explain how and why a majority of new webapps are storing their JWTs/tokens in localStorage? It doesn't seem to be by chance, anyone familiar with this history and perhaps factors from ...
- 149
0
votes
2
answers
313
views
What practical damage a compromised/malicious third-party JavaScript can cause?
It is well-known that third-party JavaScript inclusion is risky, I wonder what actual damage can be caused if the third-party script is malicious. Of course the script can cause as much damage as ...
- 715
8
votes
2
answers
2k
views
Why are cookies sent with HTML page's cross domain requests but not with JS's XHR?
When we write a HTML page with form tag and an action attribute and a submit button. As soon as we click on submit a request is sent (with cookies) to the URL which was the value of action attribute.
...
- 81
1
vote
2
answers
736
views
How do we secure image parsing libraries against buffer overflow?
New to buffer overflow through image parsing. How can one design a secure library that parses images, and ensure there are no security vulnerabilities in it? It is common knowledge that image parsing ...
- 25
-2
votes
1
answer
156
views
Security without Login
I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item.
Point to be noted
...
-1
votes
1
answer
227
views
Passing data from Mobile APP (Android / iOS) to the web UI of the application
We want token of the user generated in Mobile App SignIn to be transferred to the WebUI what would be the better approach for sharing confidential data to the WebUI.
Do we follow something like https:...
- 99
27
votes
4
answers
4k
views
Secure Implementation of Password Database
Disclaimer I am not a security professional, just a programmer trying to do my best. Additionally, this is my first post to this community so I appologise if this question is too broad.
The ...
- 381
44
votes
7
answers
6k
views
Will the same JavaScript fetched by HTTP and HTTPS be cached separately by the browser?
Say that a web server supports both HTTP and HTTPS. If a browser fetches the same JavaScript with a HTTP GET and a HTTPS GET, and the JavaScript is cache-able, will the browser cache two copies of the ...
- 715
3
votes
1
answer
858
views
XSS chained with CSRF = Stored XSS?
I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense.
I would say that it can stand true, ...
- 141
1
vote
2
answers
10k
views
Why is it not possible to spoof referer and origin header with XHR?
Technically speaking, it is possible to spoof both headers using an intercepting proxy but that's useless because we are doing it ourselves as an attacker.
When we send an ajax request using JS from ...
- 11
0
votes
1
answer
205
views
Someone is logging into my webserver [duplicate]
For a week someone has been logging into my webserver. Yesterday I mentioned this to the hosting company. They tell me to use an "IP blocker".
I am doing that, but today I looked for more logins. The ...
- 1
1
vote
1
answer
389
views
How to identify malicious Wordpress user agents
I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress ...
- 385
0
votes
0
answers
97
views
Is it a good practice to implement admin pages in a mobile application?
So let's say there's a page on the website that shows the admin all the messages that came in from the users since he last logged in.
And it's implemented on the mobile application, with checks in ...
- 1
1
vote
2
answers
293
views
Securing Client-Server Architecture with VPN or a SSL-connection?
I developed a mobile application that runs on our company's mobile terminals. The mobile application connects to the company servers via GSM network.
We had a meeting to decide how to secure the ...
- 849