An application that is accessed over a network such as the Internet or an intranet using a browser.
14
votes
5answers
647 views
What is better, an established framework or a homebrew solution?
Recently, a website related to our university was hacked along with many others. This led to a general discussion1 on how to secure the website in the future.
Anyway, there is one point that was ...
13
votes
7answers
3k views
Why do people still use/recommend MD5 if it is cracked since 1996?
It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996
Therefore we suggest that in the future MD5 should no longer be implemented in ...
13
votes
4answers
875 views
Should sensitive data ever be passed in the query string?
Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
13
votes
5answers
2k views
Preventing information disclosure from browser back button/history?
I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario:
The primary user logs off the application, but does not close the ...
13
votes
7answers
262 views
Is a “security measure” that doesn't provide a security benefit actually harmful?
If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful?
As an example, consider a login page where the user is asked to enter their ...
13
votes
4answers
790 views
Is AJAX fundamentally insecure?
Possible Duplicate:
How to do Ajax securely?
At my workplace many people believe that AJAX is fundamentally insecure. I am under the impression that AJAX is exactly as secure as any other ...
13
votes
4answers
748 views
Web Security Cheatsheet / ToDo list
Can anyone suggest a cheatsheet or ToDo list of web site and application security?
A local small business owner prompted a question about web security, basically her company website just got XSS ...
13
votes
3answers
1k views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
12
votes
6answers
526 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
12
votes
4answers
1k views
Why users want to disable cookies?
I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
12
votes
2answers
1k views
What does this injected code do?
One of my sites has just been hacked as this code has been inserted into random(?) files and places within the files.
Does anyone understand what it is trying to do? I would welcome anything that may ...
12
votes
4answers
494 views
How to protect off-the-shelf web applications?
As an exercise, please consider the following:
If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
12
votes
2answers
638 views
How to not reveal that you are using PHP?
I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are ...
12
votes
4answers
361 views
Is it safe to store and replay user-provided mime types?
If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
12
votes
5answers
3k views
Disable insecure/dangerous PHP functions
Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
12
votes
2answers
161 views
Would suggesting a random passphrase during sign-up hurt overall security?
I've been looking for ways to improve security and security awareness for both internal and external clients and I happened upon the idea of generating a one-time, random "password suggestion" on the ...
12
votes
2answers
919 views
How do I use Markdown securely?
How do I use the Markdown library safely? What do I need to do to make sure that its output is safe to include into my web page?
I want to allow untrusted users to enter content (in Markdown ...
12
votes
2answers
494 views
How can I test my web application for timing attacks?
race conditions, etc.
Are there automatic tools for this? What manual techniques should I use?
From the Area51 proposal
12
votes
6answers
791 views
Securely building a local pentest lab in a VM
I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
12
votes
1answer
607 views
What is a Web Application Firewall?
What is a Web Application Firewall (WAF) and what are some of the things to look for in an effective one? Why would you deploy a WAF instead of just an IPS?
12
votes
3answers
293 views
Are there any decent web app security scanners that can integrate with a build server?
I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great.
What I'd really like to do is find a decent web app ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
11
votes
5answers
1k views
Solution to allow JavaScript input but prevent XSS
We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
11
votes
4answers
280 views
Sensitive information was placed in a publicly accessible folder. Who is responsible and how to proceed?
Background
We have an IT staff who manages our server and a web developer who is not on the IT staff and has no root access to the server. All involved do very high quality work and I do not consider ...
11
votes
4answers
4k views
What is the correct way to implement anti-CSRF form tokens?
I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet.
I've created tokens as a md5 of username, form info and a salt and stored it ...
11
votes
4answers
1k views
How to know which database is behind a web application?
I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack ...
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
11
votes
4answers
367 views
What are the most important security checks for new web applications?
I'm wondering what are the top priority security checks you should make befor launching a new webapp?
I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
11
votes
3answers
274 views
Malicious QR Code and Mitigation
I just started reading a little on QR code, so I'm not entirely familiar with QR Code capabilities, but a thought crossed my mind today.
I scanned a QR Code on a postcard I received, and it ...
11
votes
3answers
458 views
Does signing out of a website ensure no-one can cookie hack?
If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it?
While I'm logged in, is it possible for someone who has access to my ...
11
votes
2answers
8k views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
11
votes
5answers
984 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
11
votes
3answers
2k views
How should web app developers defend against JSON hijacking?
What is the best defense against JSON hijacking?
Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested:
If the ...
11
votes
3answers
667 views
Elaborate websockets security
I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved:
...
11
votes
3answers
497 views
Getting a manual security code review done - What to watch out for?
We have a PHP application that we want to get code reviewed from an external security consultant, but I'm not clear on "how to" go about that process.
We did specify what kind of tests he should be ...
11
votes
3answers
290 views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
10
votes
7answers
623 views
Where to start with security testing?
Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
10
votes
4answers
264 views
Should a web application return true http errors?
Exception and error information can be used by a malicious user to map out the API of an web application, so it is routine to see security checklists to advise returning only a "Please contact your ...
10
votes
7answers
646 views
Should we force user to HTTPS on website?
Should we force website from HTTP to HTTPS , one of the method is using .htaccess:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
But what I notice is that some ...
10
votes
4answers
357 views
How should I secure a contact form that appears on every page of a website?
My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
10
votes
3answers
390 views
Is stripping out < and > characters an effective way of preventing XSS?
I'm guessing that HTML encoding the input would probably be a better solution, but I'm curious if just stripping out any < and > characters would be an effective defense against XSS attacks.
...
10
votes
4answers
439 views
What does defense in depth entail for a web app?
I'm assuming it means different layers of security from app-level security to server hardening to personnel training, but what are each of those layers and what are some good resources for each level ...
10
votes
2answers
568 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
10
votes
6answers
889 views
Is there a security risk running web apps in debug=“true”?
This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here:
There are plenty of performance reasons why apps shouldn't be run in ...
10
votes
3answers
1k views
What are the security risks of letting the users upload content to my site?
As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
10
votes
3answers
296 views
Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?
Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session?
Would it then be advisable to ask the user to reauthenticate (or simply ...
10
votes
1answer
4k views
What key exchange mechanism should be used in TLS?
There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
