An application that is accessed over a network such as the Internet or an intranet using a browser.
10
votes
1answer
330 views
Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?
Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
1
vote
1answer
204 views
How do security questions work? [duplicate]
Possible Duplicate:
Do security questions subvert passwords?
Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he ...
13
votes
3answers
1k views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
10
votes
4answers
357 views
How should I secure a contact form that appears on every page of a website?
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
11
votes
3answers
667 views
Elaborate websockets security
I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved:
...
4
votes
6answers
539 views
What might be the legal and policy consequences of traffic sniffing?
I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
4
votes
2answers
266 views
Attack vectors in POSTing variables from one php script to the next?
I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
11
votes
5answers
978 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
12
votes
4answers
494 views
How to protect off-the-shelf web applications?
As an exercise, please consider the following:
If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
5
votes
6answers
716 views
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code.
Sometimes though, the avoidance of ...
3
votes
2answers
1k views
How to protect from new Javascript Injection technique that doesn't use eval()?
There is a new Javascript injection technique that is generating chatter on the forums mentioned here
Here is the code sample:
String.prototype.code = function(){ return (new Function('with(this) { ...
5
votes
4answers
317 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
8
votes
2answers
471 views
Recent Facebook XSS exploit details
There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
5
votes
2answers
125 views
Protection against synthetic queries
Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in ...
40
votes
6answers
6k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
4
votes
1answer
1k views
Are there any tools for automated penetration testing of Silverlight applications?
I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps.
Specifically, I'm looking for a tool that can cope with ...
3
votes
3answers
106 views
Encrypting a fixed format message with commands and transmitting over the internet
Linked to: Encrypting a fixed format message?
I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
4
votes
3answers
380 views
It is safe to buy a domain if I get this message in Firefox?
Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
3
votes
3answers
190 views
How do you make sure a pdf is deleted after being viewed in the browser?
For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
3
votes
2answers
157 views
Encrypting a fixed format message?
I'm planning to send across TWO pieces of information over the internet from machine A
A site identifier which will be like:
$SiteName = "EXAMPLE" (in plaintext)
Encoded text which will be like:
...
1
vote
2answers
759 views
Thoughts on Tiny Encryption Algorithm (TEA, anyone)?
I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites.
Specifically, using the code presented at PHP-einfach.de
Does anyone have any experiences / thoughts / ...
1
vote
1answer
185 views
Securing clients side scripts
Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
6
votes
3answers
153 views
What indicators did OWASP use to end up with OWASP Top 10?
I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ...
Knowing that each of these ...
8
votes
2answers
513 views
MIME sniffing protection
As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
5
votes
2answers
361 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
13
votes
4answers
748 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
5
votes
2answers
589 views
Generating one-time tokens from API-key?
I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site.
I intend to distribute secret API-keys to ...
3
votes
2answers
145 views
What is the benefit of combining different web log files with different formats?
What is the benefit of combining different web log files with different formats in terms of web application security? In other words, how does combining iis log file with apache log file help in ...
5
votes
3answers
272 views
Web server file sniffing
What is it called when a user tries several attempts to figure out the files and folder structure on a web server?
For example, the attacker will run http://example.com/test.jpg to determine if ...
3
votes
3answers
288 views
Is Content Security Policy an approach that is worth to support?
Mozilla Firefox 4.0 supports something called Content Security Policy that disables the interpretation of embedded Java Script. Only external Java Script files that are referenced using a script tag ...
4
votes
7answers
275 views
Malicious Websites
Just wanted to get everyone's opinion on this. In Information Security, you get various alerts about particular machines on your network going to sites and/or IPs that have been flagged as ...
1
vote
2answers
312 views
AntiXSS for ASP.NET 1.1
Unfortunately, a client of mine still has an application based on ASP.NET 1.1.
Yes yes, I know - horribly insecure, support ending, and on and on... I've already been through that with them.
...
4
votes
2answers
593 views
P3P HTTP Headers and Session ID's
Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
3
votes
2answers
657 views
When should I not use CSRF protection for a form?
By default, I have CSRF protection for all my forms using a token.
However I noticed another web application that has a similar function to one of my forms. ANd they did not use CSRF token.
So I ...
13
votes
4answers
790 views
Is AJAX fundamentally insecure?
Possible Duplicate:
How to do Ajax securely?
At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
8
votes
3answers
660 views
How do I secure my SaaS startup?
I came across this question
I like to offer my startup also for security advice.
Objective: building a SaaS web application that allows businesses to quickly open up online stores akin to Yahoo! ...
0
votes
4answers
118 views
Safely changing text links to HTML anchors
I'm trying to change text links to real anchors. So for example I want to change http://example.com to <a href="http://example.com">http://example.com</a>.
Since this is a user given ...
2
votes
2answers
399 views
What CSS is considered Safe or Unsafe within a multi tenant website?
I'm reading the Azure Patterns and Practices multi-tenant guidance and in there it says
Cascading style sheets Behaviors are
one feature that the Surveys site will
not support.
What CSS ...
4
votes
2answers
142 views
What boxed solutions exist for taking care of Authentication? Mostly focused around websites
The Internet is generally plagued by websites that break basic rules of security, then there's a middle tier where website try to secure passwords... but they do it incorrectly. And finally, there's ...
6
votes
7answers
832 views
What chars should I not allow in passwords?
I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
15
votes
4answers
2k views
How to hijack a session?
Despite the blatant title of the question, this is actually for a genuine purpose.
My site uses PHP code like this:
$select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'";
...
1
vote
2answers
1k views
Should CSRF 'Double Submit Cookie' technique have a different seed value for the cookie versus the HTTP POST?
I'm reading about the OWASP double submit cookies method of protection and there it states that the cookie value between the header and form should match.
That seems to be somewhat of a risk, as the ...
3
votes
3answers
780 views
Altering a $_SESSION variable in PHP via XSS?
Not sure if what I'm saying makes sense... but is it possible for me to alter a $_SESSION variable from outside the target PHP script?
One of our scripts uses a $_SESSION variable and I'm not sure if ...
0
votes
1answer
166 views
Replicating javascript actions from different website (XSS?)
I've got html / javascript code on my site like this:
<a ...
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
7
votes
3answers
505 views
Security attacks on PHP web applications
I know about following security attacks on php applications (html,php,js).
XSS
SQL Injection
CSFR
Session Hijacking /Fixation
Code Injection
Remote file injection
Should i know about any other or ...
