An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

3
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
4
votes
4answers
672 views

Database Security Best Practices for E-Commerce Site [duplicate]

Possible Duplicate: Securing an E-commerce site I'm developing an e-commerce site in a LAMP environment. Is it advisable to separate data on to different servers (i.e. to have one server as ...
1
vote
3answers
185 views

Information Security standards in corporations

I'm developing a web based application. I want to create it so that it could be adopted by teams within corporations and large organisations that have tight IS standards. The initial organisations ...
2
votes
1answer
298 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
4
votes
2answers
1k views

Difference between directory traversal and file inclusion

I guess the title says it all. There seems to be no obvious difference between directory traversal and file inclusion vulnerabilities. But I guess there must be some difference, since the ...
0
votes
1answer
53 views

Is there a grading standard for security that I can apply to my MVC3 web site?

I'm looking for a standardised set of tests or scoring measures I can apply to my web site to be able to quantify it's standard or level of security. I can do some research and compile a check-list ...
3
votes
4answers
792 views

Can a CSRF CAPTCHA be defeated?

One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've ...
1
vote
3answers
738 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
5
votes
1answer
430 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
3
votes
2answers
528 views

HTML Vulnerabilities

My question is three-fold. Background I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the ...
7
votes
2answers
472 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
5
votes
3answers
470 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
13
votes
3answers
303 views

Malicious QR Code and Mitigation

I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today. I scanned a QR Code on a postcard I received, and it ...
3
votes
2answers
223 views

Computer-level logging by financial institutions

I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to ...
1
vote
2answers
150 views

What due diligence is required for HTTPModules that run within IIS?

I noticed some HTTP Handlers in my Web.config that appear to intercept HTTP traffic and manipulate it. Since there has already been an exploit with a similar component produced by Microsoft, what ...
5
votes
5answers
1k views

Robots.txt security strategy?

Is there a way to basically have an allow all policy on your top level domain, and any subdomains disallow all? I would rather that my public facing app servers not get indexed, but from what I can ...
2
votes
1answer
522 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
0
votes
2answers
168 views

What is Greasemonkey / Userscripts and how does it relate to IT Security?

I came across http://userscripts.org/ and learned that it is popular among web-users to install something called "Greasemonkey" to allow client side scripts to run. What are the benefits of ...
2
votes
4answers
343 views

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

Why not? Seems like this is only used for clickjacking, the solution should be simple enough.
3
votes
3answers
616 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
1
vote
1answer
1k views

How can log poisoning be successful with a Local File Inclusion attack?

I just read a paper about Local File Inclusion on exploit-db.com, it can be found here. One technique with LFI is log poisoning as you may know already. You do an HTTP GET request that contains PHP ...
6
votes
2answers
351 views

With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?

From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
5
votes
2answers
972 views

HTML 5 Security Code Scanner

Are there code scanners in the market that scan HTML 5 code? Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
2
votes
1answer
213 views

Is 90 day expiration for unique URL too long?

A web application I've been developing has a new use case that has me searching for something easier than username/password authentication. Current users don't sign up for the service themselves ...
22
votes
5answers
3k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
2
votes
2answers
329 views

HTTP + HTTPS + One Time Pad/stream cipher

I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
4answers
952 views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
5
votes
2answers
148 views

What kind of cache-related attacks exists on the Web?

What kind of cache-related attacks exists in modern Web world? The only one I'm aware of is Cache Poisoning. Is there anything else I should be worrying about?
0
votes
3answers
2k views

Determining a reasonable session timeout limit [closed]

What's a resonable session timeout limit and how can you determine it?
1
vote
2answers
629 views

anti-CSRF tokens vs Referer and POST testing

I understand anti-CSRF tokens to be a chunk of data sent in the response that is expected to match in subsequent requests, but is not stored in cookies. For example, a form with a hidden value that ...
0
votes
3answers
3k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
8
votes
3answers
970 views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
11
votes
1answer
2k views

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
4
votes
3answers
219 views

Should user input be validated for it's length?

Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other? I think it depends on programming language of ...
2
votes
2answers
2k views

Is it safe to transfer Facebook access token via TCP?

Is it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?
6
votes
3answers
1k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...
3
votes
1answer
299 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
5
votes
6answers
903 views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
4
votes
6answers
576 views

When storing private identifying information in a web application, what is “industry standard” best practices? [closed]

I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
2
votes
4answers
1k views

Web Security Certifications

I'm looking for a certification for Web Application Security and Web Pen Testing. Via Google I found the following two: Certified Web Application Tester GIAC Web Application Penetration Tester How ...
5
votes
2answers
1k views

Antivirus for scanning anonymous file uploads

Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...
9
votes
3answers
1k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
10
votes
4answers
318 views

Should a web application return true http errors?

Exception and error information can be used by a malicious user to map out the API of an web application, so it is routine to see security checklists to advise returning only a "Please contact your ...
1
vote
2answers
988 views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
2
votes
2answers
1k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
9
votes
6answers
481 views

What are web attacks which users can run code on your servers?

I hear stories about insecure web servers and sites which people (or bots) break into and execute their own code on the server. My question is how is that possible? I heard of people putting their ...
4
votes
3answers
449 views

Secure data transmission and storage

We currently have an application that we deploy via the web, users access it by connecting to a link which opens an executable file. This file was compiled with visual foxpro. My question is - is ...
5
votes
1answer
126 views

Is it safe to allow untrusted field names in JSON?

When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
6
votes
3answers
271 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
2
votes
1answer
369 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...