An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

3
votes
1answer
119 views

Online only encryption

I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires ...
3
votes
1answer
113 views

Designing a secure information system

Could someone please provide me with some guidance for a system I am designing... A general overview of the system is that it is to store information on staff and "customers" - this information ...
3
votes
4answers
375 views

Open exploits database, with structured data (CMS name, version, etc.)

For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs) I found some (open) exploits databases that list ...
0
votes
1answer
393 views

Site Hacked - Where to go from here? [closed]

Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory. I ...
7
votes
3answers
1k views

Flaws in Crypto Cat

I've heard from several people that Crypto Cat has some security flaws. Has anyone performed an analysis of the system and written a whitepaper? I'm curious what the flaws specifically are and what ...
1
vote
2answers
450 views

CSRF protection with cookie and AJAX

I would like to note that I've read the other question with an embarrassingly similar title and it does not contain an answer to my question. I have not used CodeIgniter as a programmer, but I have ...
0
votes
2answers
271 views

Are there any HTTP servers that can detect two cookies with the same name, but issued from different subdomains?

As a follow up to the Related Domain Cookie Attack question, I'd like to see if there are any servers that are able to detect instances where multiple cookies are sent from multiple domains. In other ...
4
votes
1answer
923 views

Authenticating users on offline devices such as ipad

We are wanting to authenticate the user inside a webapp (JavaScript/HTML inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realize this ...
3
votes
1answer
240 views

Secure information exchange between web applications using browser redirection

We're implementing a web application (US) that needs to exchange sensitive information with a third-party web application (THEM). The way we'd like it to work is that an end user clicks a hyperlink, ...
12
votes
3answers
10k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
1
vote
1answer
130 views

Random pages getting created on classic asp site

In the file structure of my site, I see some randomly generated files like 'justinbieber.asp', 'justinbiebershoes.asp','guccishoes.asp' etc. I tried deleting them but they are generated again. Can ...
5
votes
2answers
107 views

Preventing fraudulent access to restriced resource on the web?

I'm working on a web application along with a web API and I've been warned against what seems to be a basic vulnerability: not checking that the user making an action has sufficient privileges on the ...
0
votes
1answer
88 views

App uses html_safe method, possible issues

For one who doesn't know, .html_safe is rails method, which outputs strings as part of html document. The problem is that string is user inputed. What did I do to prevent some bad actions - regexp ...
4
votes
1answer
120 views

Security consequence of Javascript hole in an online chat?

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat? What is the worst thing they could do?
4
votes
1answer
174 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
0
votes
2answers
808 views

Blackbox vs whitebox testing your own site?

When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
14
votes
3answers
3k views

Cross Site Scripting without special chars

I'm testing a web application and I found a XSS vulnerability. I can break a tag and inject some code to the application but nothing potentialy dangerous for the client. The application has a filter ...
10
votes
3answers
251 views

What simple security considerations can I / should I make for a read-only API?

Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
-1
votes
2answers
154 views

Interpreted VS Compiled web frameworks and trust

OK here is a big question. Interpreted languages have many advantages over the compiled languages when it comes to web application. But what is the ftp server is hacked or the web hosting company ...
7
votes
2answers
4k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
14
votes
2answers
668 views

Does it make sense to hash a session id before passing it to an advertisement partner?

My company runs a webshop. We work with a partner that gives discount vouchers to our customers after they buy (the vouchers can be used in other online shops) and also gives vouchers for our shop to ...
-4
votes
1answer
640 views

Protect java WEB application inside the server(against reverse engineering) [closed]

I have a web application running on Glassfish 3.1.2 servlet container and I need a way to protect the compiled java classes. I have tried to obfuscate the source code but it didn't work. The project ...
2
votes
2answers
2k views

How to allow only some specific computer systems to access website? [duplicate]

I need a process to allow only certain computer systems access to the website irrespective of the network they are using. Much like a Licensing system, I can provide a private key or something ...
2
votes
2answers
146 views

Is it safer to store the XSRF value inside your JavaScript?

To protect yourself against XSRF, you need to have a separate token on a page. See: Coding Horror: Preventing CSRF and XSRF Attacks, by Jeff Atwood As the posting suggests, its best to have those ...
4
votes
4answers
7k views

How to prevent restrict access to a web application to authorized devices only?

I have developed an MVC web app. Right now, the client using this app in office area. The client has requested that no one should use this app on any device except the office's PC/tablets. Now ...
8
votes
2answers
522 views

Isolating Web application hosted on same web server

I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
4
votes
2answers
605 views

How does YouTube prevent automatic piracy?

When I visit YouTube, my browser accesses the website and begins to play whatever video I select. By its very nature, this involves YouTube sending the content of the video to my computer. Not only ...
0
votes
1answer
83 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
6
votes
5answers
5k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
3
votes
3answers
469 views

Can I safely use an encrypted URL parameter for the session id?

I'm planning to send a user's session ID as a URL parameter which will be AES encrypted. I don't think my app has any link sharing problems. Is this idea feasible? Is it safe?
1
vote
1answer
82 views

Securing Downloadable Files on Website Per User

I have an ASP.NET website serving up private PDF documents. The PDFs are stored unencrypted on a share on the internal network. The user logs in and navigates to the download page. The web server ...
15
votes
6answers
4k views

Is showing your IP address in the URL a bad practice?

Someone told me that showing your IP address in a URL (like hxxp://45.67.134.34/default.html) is easier to hack. Is that true? I could trace any domain name and get its IP number as well.
3
votes
2answers
73 views

What precaustions should be taken when the file displayed by a webpage is specified by the GET value

My website shows some files based on the get value in the URL. For example http://www.mysit.com/navigate.php?d=firstpage.html The thing is navigate.php knows which folder to look in and it's not in ...
25
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
4
votes
1answer
159 views

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
0
votes
2answers
165 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
3
votes
3answers
411 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
4
votes
2answers
230 views

Does the ability for a user to choose the value of a session id cookie constitute a security flaw?

In the context of a web application, a user connects to this application and a session id cookie is set to authenticate the user for next requests. As the cookie is actually present before submitting ...
11
votes
3answers
14k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
2
votes
3answers
335 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
11
votes
3answers
593 views

Is stripping out < and > characters an effective way of preventing XSS?

I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks. ...
8
votes
3answers
643 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
2
votes
1answer
240 views

Securely notify users about account changes

I am developing a web application (using PHP) and I am wondering what the best way is to notify users that someone updated their account information? The information that can be updated includes: ...
3
votes
4answers
3k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
4
votes
2answers
5k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
8
votes
3answers
15k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
11
votes
1answer
708 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
2
votes
1answer
427 views

How to hide victim pop-up in clickjacking?

I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up ...
1
vote
1answer
672 views

WAF SQL evasion using HPF technique

I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discuss two techniques HPP (HTTP parameter ...