An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
1answer
795 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
0
votes
1answer
102 views

Security design behind google's application specific password [duplicate]

When using Google's two-step verification with services that can't use it, such as mail clients on smartphones and desktops, the solution is to create application-specific passwords for those services....
2
votes
2answers
3k views

Data protection laws and regulation for storing IP addresses for registered users [closed]

I have a website, large amounts of this site can only be accessed if the user logs in. I would like to use the users IP addresses as a means to determine where they are when they access certain pages. ...
0
votes
1answer
396 views

Potential problem in public Maven repository

Problem This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository: http://repo.grails.org/grails/simple/codehaus-cache/com/ If you ...
0
votes
1answer
163 views

Is it reasonable to use a security proxy when integrating two web applications?

Background: We're in the process of integrating two web applications. The other one, application A, is a publicly accessible Internet service, which is provided by a third party and which offers Web ...
9
votes
4answers
381 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
1
vote
2answers
120 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
0
votes
2answers
2k views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...
0
votes
1answer
194 views

Starting out, where should I be looking for vulns? Big bounty sites vs. smaller projects? [closed]

I'm an amateur web application security enthusiast with what I would say is an intermediate level of knowledge at this point. I'm interested in finding full time work as a web app pen tester. Up ...
1
vote
2answers
139 views

Any vulnerabilities in allowing users to choose path of S3 file?

I'm building a web app that uses S3. In some of our operations, we're creating a file on S3 with a path that's directly dependent on user input, so an attacker might cause a file to be created on S3 ...
1
vote
1answer
627 views

XSS attack vector without forward slash?

is there an XSS attack vector that allows the inclusion of a external .js file without having to use forward slashes? let's say the path of the file is somewebsite.com/js/xss.js Is there a way to ...
1
vote
1answer
115 views

What makes it difficult for Facebook to implement restriction/ACL for accessing uploaded photo? [closed]

Facebook claims to allow restrict sharing to friends, certain network, or even custom when I upload photos. But it appears that this security is only in effect for the page where the photo is ...
0
votes
1answer
70 views

Security implications of putting virtual hosts source code in /var/www/[domain]

A friend pointed out that putting virtual hosts as sub folders of the default /var/www was a bad idea. (linux example path; this applies to all OS) I see that it's possible to reach the virtual hosts ...
0
votes
1answer
52 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
0
votes
2answers
616 views

Is it possible to modify a support .js file in a web application by injection?

Let's say there is a web application needing a JavaScript support file .js to be loaded in the head of the html document. <!DOCTYPE html> <html> <head> <meta http-equiv="...
1
vote
3answers
3k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
1
vote
1answer
3k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
2
votes
1answer
3k views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
0
votes
1answer
251 views

Removing Unnecessary Services & Packages in a MySQL Ubuntu 12.04 Server [closed]

As part of hardening a MySQL 5.6 server running on Ubuntu 12.04 LTS, unnecessary services and packages will have to be removed. For a server that is serving only as a MySQL server, what services and ...
1
vote
2answers
162 views

Is Temporary XSS a Problem?

I use a site on a regular basis so I wanted to make sure it was secure. One of the things I checked was that when I changed my first name to <img src="http://blah.blah/blah/blah.notanextension" ...
10
votes
1answer
3k views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
4answers
156 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
1
vote
3answers
131 views

Make firewall management public?

A friend of mine installed a new firewall software at his company. Sometimes he works from home, and also has to maintain the firewall. The firewall management software is a web site. My friend made ...
5
votes
3answers
519 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
4
votes
3answers
197 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
6
votes
1answer
128 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
10
votes
4answers
578 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
2
votes
1answer
2k views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
0
votes
1answer
1k views

Cookie+session based CSRF protection

Consider the following scenario: 1. When user visits a webapp, server:     a) initialize the session;     b) generates CSRF token;     c) ...
3
votes
3answers
1k views

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
61
votes
10answers
18k views

Bad practice to have a “god” password?

Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
2
votes
2answers
7k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
12
votes
4answers
3k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
3
votes
2answers
2k views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
2
votes
3answers
714 views

How can I prevent my database from being compromised if my CakePHP app is compromised?

I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
0
votes
1answer
485 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
3
votes
3answers
590 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' --...
2
votes
2answers
255 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
2
votes
1answer
3k views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
1
vote
2answers
864 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least secure,...
3
votes
4answers
1k views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
0
votes
1answer
1k views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || (is_array($...
79
votes
5answers
37k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
6
votes
2answers
1k views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
1
vote
1answer
461 views

attack signatures [closed]

I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I ...
5
votes
2answers
622 views

Has there been any documented cases where hackers have hijacked the phone number to a business?

Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls ...
6
votes
2answers
31k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another page....
23
votes
4answers
12k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
1
vote
2answers
226 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
3
votes
2answers
1k views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...