An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

20
votes
2answers
2k views

How do I use Markdown securely?

How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page? I want to allow untrusted users to enter content (in Markdown ...
2
votes
2answers
219 views

Are these standard OAuth2 flows? (what are their names?)

I'm developing a B2B platform, where other developers (our customers) will build shop-front style apps that leverage our platform. We expose a REST based API which our customers either call directly ...
6
votes
1answer
648 views

Injecting ampersand to the url

Let's say there is a program sending some data to server via GET: http://server.com/gateway?value1=abc&value3=def Then the server sends these values further, adding value2: (python code) ...
3
votes
1answer
130 views

Suddenly scans for 'formvars.php'

Suddenly, starting from about yesterday-evening (gmt+2), I get lots of -what I suspect are- 'hits' from bots that are looking variations of this file: /somerealpath/includes/formvars.php I'm ...
0
votes
3answers
210 views

Is HTTPS necessary for password change if user has already logged in with HTTPS?

I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION. Is this really necessary?
3
votes
2answers
231 views

How can I report an ecommerce site in violation of security practices?

I ordered a product from a website and found that their invoice display page is completely un-protected with the order id in the query string and merely incrementing the number exposes every order. ...
1
vote
3answers
8k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
526 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
2
votes
1answer
597 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
1answer
296 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
3
votes
3answers
287 views

“Doxing” users on Social Media

I hope this question falls within the scope of the faq...I'm curious to see what kind of answers I get. Suppose the following A user is posting libel and slander on social media (lets say Twitter ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
12
votes
7answers
969 views

Where to start with security testing?

Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
0
votes
3answers
2k views

Demo of web site that is vulnerable to command injection

I'm looking for a demonstration web site that shows an example of a web site that is vulnerable to command injection: where I can inject something and get the web site to run a shell command. (This ...
1
vote
2answers
291 views

Our company needs to conduct an audit of a large ASP.NET solution that was developed for us by a development company. [closed]

What professional standards and practices are recommended for guiding such an effort?
3
votes
6answers
1k views

Best resources to learn web security attacks? [closed]

Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?
-1
votes
2answers
3k views

How could the hacker tamper with the 'configuration.php' file in my Joomla web server?

I have a web server hosting Joomla 1.5. I discovered that the Joomla configuration file configuration.php was modified by a hacker. How could he do so? Note that the file has 777 permission. Also, ...
1
vote
2answers
303 views

Really secure webmail

If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system? Obviously, there's some ...
1
vote
2answers
503 views

Appropriate strategy for preventing brute forcing of logins?

I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient. 5 failed login attempts for a particular username will cause that ...
5
votes
4answers
10k views

Security issues using iframes

We are looking to move to iframes due to technical challenges. By moving to iframes it will be easier to manage the technical issues. But we are not totally sure of security implications of iframes. ...
1
vote
3answers
225 views

Is a web application being built on an open-source platform less secure because it is open-source?

With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering, Does having access to the source code of the underlying libraries a web ...
6
votes
1answer
526 views

Google showing spam links on my site

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites. But I have used many ...
6
votes
2answers
419 views

Security issues with PHP Sandbox

I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
3
votes
2answers
9k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
17
votes
4answers
2k views

What is the point of the same-domain rule for xmlhttprequest when script tags/JSONP can cross domains?

I get that I don't want a page loaded from stackoverflow.com to be able to request gmail.com on my behalf and read my email--but this seems to be simply a cookie issue. Since JSONP bypasses ...
3
votes
2answers
168 views

Multiple extension vulnerability. Is this malicious file triggered during form preview or after it has been uploaded?

I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the ...
6
votes
2answers
2k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
8
votes
3answers
8k views

Does X-Content-Type-Options really prevent content sniffing attacks?

In Tangled Web Michal Zalewski says: Refrain from using Content-Type: application/octet-stream and use application/binary instead, especially for unknown document types. Refrain from returning ...
2
votes
2answers
841 views

Why should crossdomain.xml be present if user-uploaded files exist?

In his book Michal Zalewski says: To protect your users, include a top-level crossdomain.xml file with the permitted-cross-domain-policies parameter set to master-only or by-content-type, even if ...
3
votes
3answers
335 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
1
vote
3answers
290 views

Deploying vulnerable web application online‏

I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes. I am deploying this machine on ...
6
votes
2answers
1k views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
4
votes
2answers
145 views

Exploits inevitably “cost of doing business on the Internet”?

After yet another exploit of and malware injection into his website, host Leo Laporte of the Twit network has recently asserted/been told by his security expert that falling victim to such attacks is ...
1
vote
2answers
209 views

Why the servers stores hashed password instead of relaying on private/public key

I understand why the SSL client certificates are not widely used (need to install them, problems with shared machines etc.). On the other hand when I log into the server the password is send to it and ...
20
votes
7answers
1k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
2
votes
4answers
1k views

Without using SSL, what's the most secure way to make an AJAX request to a PHP page?

It was suggested over at stackoverflow that I try my question here. This is it verbatim: So, it's impossible to do AJAX requests securely without using SSL. I get it. You can either view-source the ...
2
votes
2answers
104 views

Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols? Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh) ...
3
votes
3answers
214 views

What security standards should be implemented in a simple web application

I am creating a web application that basically reads/writes/updates information from and to a database on a server. I am knowledgeable in computer programming, but while seeking security standards, I ...
5
votes
3answers
323 views

What fraction of web sites are vulnerable?

It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
6
votes
2answers
293 views

What fraction of vulnerabilities does black-box pentesting find?

Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all. What fraction of vulnerabilities does black-box pentesting find, ...
2
votes
3answers
270 views

Securing dropdown boxes

I have been creating selection boxes for years, yet I never knew you could modified it with firebug and submit them with nonpermitted values, of course this wouldn't happened if the code was secured. ...
1
vote
3answers
154 views

How to reverse the communication for security

I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but ...
8
votes
3answers
707 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
10
votes
2answers
908 views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
3
votes
1answer
217 views

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

In this question, I want to identify browsers, servers, or implementations that are immune from related domain cookie attacks (e.g. a.example.com vs b.example.com). Lacking any tangible solution, ...
1
vote
1answer
367 views

Web application software architecture: basic security

I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer. Let's say I have three components of a ...
2
votes
1answer
394 views

Active Directory: Should Workstations be separated from servers to protect from related domain hacks?

How should I protect domain joined hosts in the same AD domain from the Related Domain Cookie Attack? Suppose there is an AD forest called example.com. This company has a variety of internal and ...
3
votes
1answer
734 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
2
votes
2answers
152 views

For untrusted user upload sites: what should the contents of crossdomain.xml and clientaccesspolicy.xml be?

Flash has a long history of ignoring MIME types of files and reading the file directly for executable content or for cross domain execution permissions. That means a malicious user can take advantage ...
21
votes
1answer
2k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...