An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
1answer
93 views

Web App Protection and Sign On

I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and ...
5
votes
4answers
1k views

How should a webmaster manage all her passwords and keys?

I have several private keys that I use to ssh into AWS, dreamhost, github, etc. I have passphrases for all of these private keys that are too complex to remember. I have mysql passwords that my ...
2
votes
2answers
554 views

Do SPA applications have different security considerations than HTML5 sites?

I'm looking into Single Page Applications that are used for both mobile development (PhoneGap) and regular websites. Since the application can load from a offline copy, can run from ...
3
votes
2answers
231 views

Risks for a new type of website login feature

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a ...
4
votes
1answer
955 views

HIPAA: How am I required to secure PHI database access creds on my web server?

Assuming I have a database of PHI that my web application needs to access, how am I required to secure the credentials on the webserver that the web application uses to access this database? Is ...
0
votes
3answers
912 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
2
votes
2answers
5k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
2
votes
2answers
267 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
1
vote
1answer
343 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
1
vote
1answer
548 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
5
votes
1answer
613 views

What techniques do web services use to identify password theft?

I've noticed that some web services use a security scheme in which log-in attempts that have some unusual characteristics trigger extra authentication steps. For example when I try to login to my ...
4
votes
4answers
2k views

Is it safe to show user a message if account is locked

I am working on a web application, security is high priority. So, if a user has failed to login more than 3 times, the account will be locked. Should I display a message to the user saying "your ...
0
votes
0answers
765 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
1
vote
1answer
592 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
0
votes
1answer
27k views

Error150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Help me guys please i'm having an problem with my google account. I can't log in it keeps saying : Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a ...
1
vote
0answers
402 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
2
votes
1answer
551 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
2
votes
3answers
3k views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
3
votes
2answers
1k views

Reusing the same session-ID necessarily bad?

The question is related to session-ID management in a particular php-based web-app. The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, ...
28
votes
3answers
3k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
3
votes
1answer
383 views

Why do major sites (eBay, Github) not ask for a password when I attempt to change email addresses?

When users change their email addresses within a web application's user account, I see the following problem: An attacker (who has access to your session) could change your email address to a new one ...
2
votes
3answers
2k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
0
votes
2answers
171 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
1
vote
3answers
318 views

Do obscure image URLs prevent image harvesting?

On a Web site which requires user login, and all content is viewable by any registered user, is there any point in making obscure image URLs like "1mh9cr2m78234bc23-32xy4723nxy12.jpg" to protect the ...
5
votes
3answers
2k views

Do I need to expire a session cookie when sessions are handled server-side?

The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired. When logging out, the session ...
40
votes
15answers
7k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
8
votes
2answers
1k views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
1
vote
3answers
845 views

How to expose a client's real IP address?

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?
3
votes
1answer
577 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
5
votes
2answers
3k views

Automated URL Discovering

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools. I'm using wfuzz to brute force on the URL but is that the only way? Is there any ...
1
vote
1answer
159 views

Impact of using map APIs without SSL support? [duplicate]

We are currently developing a web application which involves map APIs. Most of the map API providers don't provide any SSL support (e.g. Yahoo! doesn't). What will be the security impact of using map ...
3
votes
1answer
763 views

How can I check the iframe on my website is secure or not?

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?
-3
votes
1answer
1k views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
9
votes
3answers
516 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
3
votes
2answers
2k views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
4
votes
1answer
1k views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
5
votes
4answers
2k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
-2
votes
1answer
105 views

Is committing credit card data to this website considered safe? [closed]

Recently i came across one donation site which gets credit card info and makes donations, like the above donation site most of the site broughts donation on their own donation page instead of ...
1
vote
2answers
181 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
5
votes
1answer
213 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...
5
votes
2answers
2k views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
3
votes
2answers
3k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
2
votes
1answer
120 views

Tagged website malware

A common occurance I've found when doing forensics on compromised websites is a pattern like this: <span>Clean code here</span> <!--0c0a22--> ... malware code here ... ...
1
vote
1answer
655 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
6
votes
2answers
354 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
-5
votes
3answers
542 views

PHP web application security [closed]

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). I think that I want to use self-signed SSL ...
4
votes
1answer
6k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
0
votes
1answer
1k views

In-office Flask app on port 80 - is it safe? [closed]

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache ...
12
votes
4answers
1k views

Sending HTTP 403 as. 200 - “Silent Identification of Admin”

A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin. Here's the scenario: Main site is target.example Attacker site is ...
11
votes
1answer
316 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...