An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

21
votes
2answers
9k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
427 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
-4
votes
1answer
186 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
5
votes
1answer
55 views

Should different web apps running on VDS each have their own user account?

I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application? If I run applications as ...
8
votes
6answers
3k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
2
votes
1answer
90 views

What is this hardened computer called? [closed]

After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software. What is this hardened computer called?
6
votes
3answers
443 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
30
votes
7answers
1k views

Dealing with excessive “Carding” attempts

We are currently setup using Magento on a LAMP stack for our e-commerce platform. As of a month or two ago we began noticing a lot of carding attempts against our website. All attempted transactions ...
2
votes
4answers
3k views

What is the danger of Reflected Cross Site Scripting?

What is the danger of Reflected Cross Site Scripting? I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
2
votes
2answers
382 views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
1answer
184 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
0
votes
1answer
262 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
7
votes
3answers
3k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
3
votes
1answer
122 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
2
votes
2answers
154 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
4
votes
4answers
927 views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
-1
votes
2answers
123 views

Should I use salt to authenticate data?

I have a client and a server. The client makes a request containing userId, cardId, position (on the card) A hacker could just do the same http request with the next position. So I think about ...
5
votes
3answers
267 views

How to store chat conversations on my website?

I am making a site where members are able to have one-to-one chats, and I'm not sure how should I process conversation texts. Should I store the text in a .txt file or directly in a database? I also ...
1
vote
2answers
2k views

SQL Injection tool (Mac OS X)

Do you know any software for searching (analyze) SQL injection (on website) from Snow Leopard ? I have found some that can run from Linux or Windows. I understand that most Linux (console) ...
8
votes
1answer
792 views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
6
votes
4answers
2k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
1k views

How to secure a server backend

I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
1
vote
5answers
1k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
2
votes
3answers
253 views

Usernames - Should their length be limited? [duplicate]

Possible Duplicate: Is there any added security benefit to username complexity requirements? Are there any good security reasons for a web application to limit the length of a username? If ...
3
votes
1answer
195 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
13
votes
4answers
3k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
3
votes
2answers
769 views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
1
vote
2answers
410 views

Application of Bayesian network for Web Application Security

How can a Bayesian network be used to perform attack analysis of web traffic? I read an interesting article on its application. "Web Application Defense with Bayesian Attack Analysis" but I was not ...
1
vote
1answer
382 views

Lots of 'unidentified exploits' detected with w3af

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a ...
5
votes
1answer
29k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
4
votes
2answers
953 views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" ...
-1
votes
2answers
181 views

What are the security advantage of new redirecting method used by Gmail and Facebook?

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?
2
votes
2answers
259 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
3
votes
3answers
1k views

Isn't microtime() or mt_rand() sufficient for password reset?

In Can anyone provide references for implementing web application self password reset mechanisms properly? it is mentioned to use strong cryptographic randomness to generate the reset token that is ...
1
vote
1answer
189 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
-3
votes
2answers
327 views

How is banking softwares used over the internet [closed]

I'm developing a banking software using php and that will be used over the internet. What are some of the security steps I should take in db design, programming, hosting...? thanks.
0
votes
1answer
203 views

Understanding CSRF vulnerability in Web Application?

I want to understand what is CSRF vulnerability. I use authorization system in my web application and found CSRF. What should we do to solve it? Actually I want to create simulation for this ...
2
votes
1answer
524 views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
1
vote
2answers
133 views

Looking for a taxonomy of web attacks

I am working on semantic representation of firewall rules but could not find a good taxonomy of Web attacks in terms of HTTP protocol. I do find web attack classification i.e XSS attack, SQL attack.
4
votes
5answers
963 views

Is it dangerous to allow user to view a file directory via web browser?

I have a URL which displays all of the pdf files at a given dir by visiting the following site location : http://www.mysite.com/allpdffiles/ Does this present any security vulnerabilities?
-4
votes
4answers
307 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...
1
vote
2answers
310 views

Session management: Are the features of application server enough?

HTTP is a stateless protocol. However, when the user logs into a web application, he likes that some session information be preserved, such that he does not have to login again when he wants to go ...
4
votes
1answer
888 views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
-1
votes
1answer
116 views

What was Microsoft trying to do when they had Windows Updates over their website? [closed]

What was Microsoft trying to do when they had Windows Updates over their website? Now it's completely integrated into the operating system and it seems much smoother. The Linux and Mac I've used got ...
2
votes
4answers
236 views

Is there an access-control model defined in terms of application structure?

I'm working on the access control component of a complex web application. One of the goals is to have a strictly defined model for who can do what, but I can't find an existing model that meets our ...
1
vote
1answer
254 views

How reliable/secure is QCaptcha?

QCaptcha is an alternative way to protect a website from bots. It required a drag and drop action like this: Question How reliable is this implementation when compared to others mentioned on ...
0
votes
1answer
54 views

Considerations when displaying OpenID and WS-* output to an end user

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure. I would like to create a page that decryption the current session's OpenID or WS-* token, ...
7
votes
2answers
753 views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
2
votes
2answers
300 views

What is cross-site-scripting? [duplicate]

Possible Duplicate: Can anybody explain XSS to an idiot? First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different. On SO ...
3
votes
5answers
848 views

Is it wrong to collect and store IP addresses?

I am developing a PHP analytics program. I am using IP addresses to get its corresponding country. I was wondering if its OK to store both the IP address and Country or if its better if I just store ...