Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,392
questions
2
votes
0
answers
763
views
PHP Upload-show images securely [closed]
I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image.
So i've created a small test project where ...
- 121
27
votes
4
answers
9k
views
I detected someone probing my site for weaknesses, what can I do about it? [duplicate]
My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
- 10.4k
1
vote
2
answers
513
views
Is this a sign of a successful XSS attack?
I'm just testing a basic XSS injection attack. Given the images below, does it look like this website is vulnerable to XSS?
Is whitelisting the characters still the best practice against XSS attacks?...
- 65.6k
2
votes
0
answers
3k
views
Testing a padding oracle vulnerability with PadBuster
I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability
+ OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
1
vote
2
answers
878
views
Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?
Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them:
Use a prediction service to load pages more quickly: Browsers use an
...
- 1,900
1
vote
0
answers
122
views
Rotating session names vs a static session name with a rotating validation string
I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
- 129k
2
votes
2
answers
802
views
Does rendering of user supplied content imply an xss vulnerability?
I am working on a chat program in my spare time. If a user inputs html it will be rendered, for example, <a href="example.com">link</a> will render a hyperlink. At the same time, if you ...
- 949
3
votes
1
answer
376
views
Is this "forgotten-password" procedure safe/legal?
Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
- 2,117
1
vote
1
answer
233
views
How to prevent two-stage CSRF attacks?
Assume that we are creating a CSRF token and inject it in a form on the page sendmoney.php. What prevents the attacker from sending a request to sendmoney.php to get the CSRF token and then submitting ...
- 65.6k
0
votes
1
answer
1k
views
How to exploit CSRF using HTML form to save data? [duplicate]
So I found a CSRF vulnerability on a website. The website is sending GET request to get user data and there is no protection. So using HTML I can get the data from the website if the user is logged in,...
- 65.6k
1
vote
0
answers
95
views
Web application secrets protection following code execution
I would like to clarify protection practices for handling database secrets with database connected web application, using Docker containers. The aim is to determine how to protect secrets even if an ...
- 409
1
vote
2
answers
3k
views
Good Vulnerable Wordpress VM or Lab? [closed]
I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play ...
- 129k
0
votes
1
answer
112
views
Hosting statistic tool on heroku with flask secure?
I am working on a statistic tool for our company, millions of datasets. Now I need to upload the project, so all company members can request data from everywhere.
I am working with Python 3/Flask and ...
- 682
0
votes
1
answer
137
views
What kinds of web applications need dynamic packet filtering or deep packet inspection
I have some customers requesting that we put apply DPI or dynamic packet filtering in front of our web server. For the simplicity of my service, I'm feeling like this is over kill. What kinds of web ...
- 682
1
vote
2
answers
2k
views
POST Method Anti-CSRF Help With Burp Suite
I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
- 409
0
votes
2
answers
2k
views
Handling sensitive data for a web application
I'll save you the detail of the issues, but do let me know if you need any additional info that I'm not mentioning here.
The basic set up is that I have a web application, and on the browser the ...
- 129k
0
votes
1
answer
950
views
Modifying requests using Burpsuite considered to be valid security vulnerability?
I would like to know if intercepting and modifying requests using Burpsuite before reaching server is considered as vulnerability.
In our web based and mobile applications, adequate security measures ...
CommunityBot
- 1
13
votes
3
answers
3k
views
I don't understand what's wrong with just using cookies for authentication?
I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work:
You define a 32-byte secret key on the server
When the user logs in, you ...
- 165
0
votes
3
answers
358
views
Determine All Possible Fields in HTML Form
Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form?
For example:
Assume a ...
- 4,032
2
votes
0
answers
766
views
What are the dangers of "style-src: 'unsafe-inline'"? [duplicate]
This is a common sight in content security policies:
style-src 'unsafe-inline'
I know that this "UI redressing attacks" that can be use for phishing or just defamation. But are there other threats ...
- 65.6k
0
votes
1
answer
103
views
Multiple contributor security for blog
I currently develop a big blog website with Firebase as my backend just for information. Right now (not released/published the page yet), I give my authors accounts special rights to access pages ...
- 129k
0
votes
2
answers
159
views
How can I secure a REST service intended to be used by my customers' customers via their public website?
I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
- 314
3
votes
1
answer
1k
views
Allowing unauthenticated user access web page information
Our web application should allow unregistered users to browse certain
information.
This information is returned by apis
Currently we are using hardcoded guest login to achieve this
The mere ...
- 31.2k
1
vote
1
answer
98
views
Dangers of Sending Onetime Pin numbers over http
Are there any dangers of sending a one time pin number from customer to my server over HTTP?
Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
- 16.1k
1
vote
2
answers
4k
views
Why can't I test XSS Vulnerability?
I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
CommunityBot
- 1
1
vote
2
answers
8k
views
Execute cmd commands with http directory traversal attack
Question Summary:
I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
- 121
1
vote
1
answer
148
views
How can I make sure that my Python code cannot be accessed by the user of my web app?
I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following:
def add(n1, n2):
return n1 + n2
I'd ...
- 5,130
22
votes
3
answers
5k
views
What’s wrong with in-browser cryptography in 2017?
There are many articles in the internet criticising JavaScript cryptography in the browser:
"What’s wrong with in-browser cryptography?" by Tony Arcieri
"Final post on Javascript crypto" on rdist
"...
- 65.6k
3
votes
0
answers
2k
views
How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?
Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
a browser game in which the player's level and progress are to be saved locally.
a game,...
- 65.6k
1
vote
1
answer
114
views
Does the Web Cryptography API prevent a bad server from slurping cleartext?
Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely:
private keys ...
- 65.6k
0
votes
1
answer
167
views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
- 6,192
6
votes
3
answers
2k
views
Is CSRF still a relevant attack vector?
CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications".
But even without frameworks doing CSRF defense, I've ...
- 65.6k
2
votes
0
answers
2k
views
Data image with CSP
I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that.
Because it is called from within ...
- 93
11
votes
3
answers
530
views
How to calculate our application security debt?
Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
- 7
0
votes
2
answers
159
views
What are the places one should look for CSRF flaw? [closed]
While finding vulnerabilities in a web app what are the potential areas where one should look for CSRF flaw?
- 48.4k
5
votes
4
answers
397
views
How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio.
You can see the video at Real-time ...
- 3,260
25
votes
3
answers
91k
views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
- 1
4
votes
3
answers
1k
views
How are "security questions" not a major security hole for any application that uses them?
So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address.
...
- 11
6
votes
1
answer
1k
views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
- 1,437
0
votes
1
answer
230
views
What can be disadvantages (impacts) of keeping passwords in plain text in web browser?
While hunting for bugs, I landed on a website which shows my password in plain-text when I inspect element when I sign in (I didn't tweak things like changing type attribute to text). I can clearly ...
- 129k
2
votes
1
answer
213
views
Why most of the web applications use CRSF token as a prevention method instead validating through origin header?
Why was crsf token discovered at the first place? One can always check from the the request generated by origin header
CommunityBot
- 1
1
vote
1
answer
169
views
Website login desktop program instead of sharing passwords
Brainstorming ways to share passwords without the users being able to see the passwords. In Windows we can watch/control when/what users do on corporate computers. There are some web services multiple ...
CommunityBot
- 1
14
votes
2
answers
10k
views
Preventing CSRF attacks against WebSocket communications
I have read the thread about CSRF attacks in websockets (Do WebSocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security,...
- 34.2k
1
vote
3
answers
477
views
Why keep track of user password changes in web application?
For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just ...
- 4,032
0
votes
2
answers
515
views
XSS vulnerability through burp suite
I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.
Is this a reportable vulnerability?
- 65.6k
-1
votes
1
answer
106
views
Confusion related to broken authentication vulnerability
I was able to login by using the cookie of my previous session but when I try to change the setting I was logged out. Will this be eligible for authentication bypass vulnerability?
- 129k
3
votes
1
answer
2k
views
Web-Application with CORS Origin: * using authorization header
As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an
...
- 27.3k
1
vote
1
answer
1k
views
JSON web token vulnerability with HMAC and RSA
I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here
Though I understood the nature of the bug and how it can be abused by attackers, I couldn'...
- 1,003
2
votes
2
answers
5k
views
XMLHttpRequest CSRF fails with allowed CORS
I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack.
Now the following code should send a OPTIONS request, ...
- 129k
6
votes
3
answers
9k
views
Should I encrypt sensitive form data with JavaScript on the client?
This is by no means a replacement for HTTPS, so please do not assume that is why I am asking this question. I am exploring, and I am curious. I am looking for some expert input on this, and I am not ...