An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

4
votes
1answer
694 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
0
votes
3answers
535 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
2
votes
2answers
3k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
2
votes
2answers
230 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
1
vote
1answer
314 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
0
votes
1answer
325 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
5
votes
1answer
521 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
4
votes
4answers
1k views

Is it safe to show user a message if account is locked

I am working on a web application, security is high priority. So, if a user has failed to login more than 3 times, the account will be locked. Should I display a message to the user saying "your ...
0
votes
0answers
750 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
1
vote
1answer
424 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
0
votes
1answer
23k views

Error150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Help me guys please i'm having an problem with my google account. I can't log in it keeps saying : Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a ...
1
vote
0answers
250 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
2
votes
1answer
319 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
2
votes
3answers
2k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
3
votes
2answers
668 views

Reusing the same session-ID necessarily bad?

The question is related to session-ID management in a particular php-based web-app. The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, ...
26
votes
3answers
2k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
3
votes
1answer
337 views

Why do major sites (eBay, Github) not ask for a password when I attempt to change email addresses?

When users change their email addresses within a web application's user account, I see the following problem: An attacker (who has access to your session) could change your email address to a new one ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
0
votes
2answers
152 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
1
vote
3answers
258 views

Do obscure image URLs prevent image harvesting?

On a Web site which requires user login, and all content is viewable by any registered user, is there any point in making obscure image URLs like "1mh9cr2m78234bc23-32xy4723nxy12.jpg" to protect the ...
5
votes
3answers
1k views

Do I need to expire a session cookie when sessions are handled server-side?

The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired. When logging out, the session ...
37
votes
15answers
6k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
8
votes
2answers
943 views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
1
vote
3answers
674 views

How to expose a client's real IP address?

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?
4
votes
1answer
470 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
3
votes
2answers
1k views

Automated URL Discovering

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools. I'm using wfuzz to brute force on the URL but is that the only way? Is there any ...
1
vote
1answer
113 views

Impact of using map APIs without SSL support? [duplicate]

We are currently developing a web application which involves map APIs. Most of the map API providers don't provide any SSL support (e.g. Yahoo! doesn't). What will be the security impact of using map ...
3
votes
1answer
509 views

How can I check the iframe on my website is secure or not?

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?
-2
votes
1answer
792 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
9
votes
3answers
439 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
2
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
4
votes
1answer
886 views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
4
votes
4answers
1k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
-2
votes
1answer
97 views

Is committing credit card data to this website considered safe? [closed]

Recently i came across one donation site which gets credit card info and makes donations, like the above donation site most of the site broughts donation on their own donation page instead of ...
1
vote
2answers
154 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
5
votes
1answer
172 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...
5
votes
2answers
1k views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
3
votes
2answers
1k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
2
votes
1answer
113 views

Tagged website malware

A common occurance I've found when doing forensics on compromised websites is a pattern like this: <span>Clean code here</span> <!--0c0a22--> ... malware code here ... ...
1
vote
1answer
466 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
6
votes
2answers
288 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
-4
votes
3answers
378 views

PHP web application security [closed]

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). I think that I want to use self-signed SSL ...
4
votes
1answer
4k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
0
votes
1answer
924 views

In-office Flask app on port 80 - is it safe? [closed]

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache ...
11
votes
4answers
848 views

Sending HTTP 403 as. 200 - “Silent Identification of Admin”

A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin. Here's the scenario: Main site is target.example Attacker site is ...
11
votes
1answer
269 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
5
votes
4answers
1k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
3
votes
2answers
1k views

Encrypt web.config file using Data Protection API

I have encrypted part of my web.config file using the Data Protection API. Now, my question is, what does a hacker need in order to decrypt the web.config file? Does he require physical access to ...
0
votes
2answers
107 views

How much detail to publicise when a software vendor patches and issues an advisory? [closed]

I am interested to hear what the community's thoughts are on detail provided by a software vendor along with a fix and a security advisory. For example, let's say that some kind of severe ...
3
votes
2answers
395 views

How to intercept url to disallow Forced Browsing in simple Dynamic Web Project?

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL ...