An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
1answer
255 views

Is it possibel to inject php code to roundcube errors log file via LFI vulnerability? [closed]

i tried to inject php code to roundcube errors log file, with no success. i think there is something filtering injected php code.
1
vote
2answers
94 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
5
votes
8answers
1k views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
6
votes
3answers
8k views

Javascript Malware: How does it work, and how can it be mitigated?

I am wondering how malware gets served through Javascript. I've noticed a few illegitimate pop-ups while visiting some financial websites. I wonder how malware exploits work against the application ...
6
votes
5answers
8k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
4
votes
3answers
1k views

Vulnerable java applications

I am looking for some open source/free vulnerable JAVA based applications. It can be web application, desktop application or any other. I need them to do some experiments in my research work. They ...
1
vote
1answer
640 views

Examples for (Web-)Security-Architectures

I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
18
votes
4answers
7k views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
10
votes
1answer
3k views

How to use postMessage securely

postMessage is a primitive introduced in HTML5 that web pages can use for cross-origin communication. What do I need to do to use postMessage securely? What are the primary security pitfalls or ...
6
votes
4answers
2k views

Protecting against CSRF when a form is being submitted via an AJAX call

I'm using anti-CSRF tokens on all my forms to prevent CSRF attacks. Also, the tokens are being saved in the $_COOKIE variable to validate against the value I get from the form. I'm resetting the token ...
1
vote
1answer
473 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
2
votes
2answers
1k views

Is Drupal's filter_xss enough for filtering HTML?

Drupal has filter_xss function. Is it safe to use for filtering arbitrary user HTML input? If not, what should be used instead when using Drupal 7? This questuion is a duplicate of Drupal's built-in ...
39
votes
2answers
23k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
917 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
-4
votes
1answer
206 views

Secure Traffic model for Web application Protection

Web Application Firewalls relies on negative and positive security traffic rules to protect web application from being exploit. My question is that is their any other web traffic modelling technique ...
5
votes
1answer
78 views

Should different web apps running on VDS each have their own user account?

I deployed my second rails app on my VDS with capistrano. Should I configure that application server to run as a different user, or the same as the first application? If I run applications as ...
10
votes
6answers
10k views

Why is php not used for banking sites or for a banking transaction?

Other programming languages popular on the web, such as Java and .NET, are used for banking sites. However, I've rarely (if ever) seen a PHP application designed to be deployed for a banking site. ...
2
votes
1answer
96 views

What is this hardened computer called? [closed]

After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software. What is this hardened computer called?
6
votes
3answers
2k views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
33
votes
8answers
3k views

Dealing with excessive “Carding” attempts

We are currently setup using Magento on a LAMP stack for our e-commerce platform. As of a month or two ago we began noticing a lot of carding attempts against our website. All attempted transactions ...
9
votes
4answers
10k views

What is the danger of Reflected Cross Site Scripting?

What is the danger of Reflected Cross Site Scripting? I understand the Reflected XSS is dangerous, because it's possible. But what practical attacks can be performed using Reflected XSS?
2
votes
2answers
613 views

Anomaly based web application Firewall

How practical are anomaly based web application firewall in mitigating web based attacks ? Which types of threats do they mitigate against and which don't they? Are their any practical implementation ...
2
votes
1answer
395 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
0
votes
1answer
403 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
10
votes
3answers
8k views

CSRF cookie vs session based tokens

I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie. Is it ...
3
votes
1answer
167 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
2
votes
2answers
163 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...
7
votes
4answers
3k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
-1
votes
2answers
125 views

Should I use salt to authenticate data?

I have a client and a server. The client makes a request containing userId, cardId, position (on the card) A hacker could just do the same http request with the next position. So I think about ...
5
votes
3answers
812 views

How to store chat conversations on my website?

I am making a site where members are able to have one-to-one chats, and I'm not sure how should I process conversation texts. Should I store the text in a .txt file or directly in a database? I also ...
1
vote
2answers
2k views

SQL Injection tool (Mac OS X) [closed]

Do you know any software for searching (analyze) SQL injection (on website) from Snow Leopard ? I have found some that can run from Linux or Windows. I understand that most Linux (console) ...
9
votes
1answer
1k views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
14
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
3k views

How to secure a server backend

I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
3
votes
5answers
2k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
2
votes
3answers
441 views

Usernames - Should their length be limited? [duplicate]

Possible Duplicate: Is there any added security benefit to username complexity requirements? Are there any good security reasons for a web application to limit the length of a username? If ...
4
votes
1answer
333 views

Client-side cross-site access in SSL environment - when it's still possible to do?

I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
21
votes
4answers
9k views

Why users want to disable cookies?

I just started to create a new web application. In the documentation, it is written that I have to prepare for the situation where users have disabled cookies. This is not the first time I have read ...
4
votes
2answers
1k views

How do I run a security check on my WordPress server?

I have a cloud-based server running with CentOS 6.0 and CSF installed. Today I got a message from my host that one of my WordPress installations is hacked and used for phishing. But I don't know how ...
1
vote
2answers
601 views

Application of Bayesian network for Web Application Security

How can a Bayesian network be used to perform attack analysis of web traffic? I read an interesting article on its application. "Web Application Defense with Bayesian Attack Analysis" but I was not ...
1
vote
1answer
587 views

Lots of 'unidentified exploits' detected with w3af

I've been running some scans across a few different networks and on certain sites I will get a flag about an unidentified exploit in the log. When I review what the exploit is, most of the time its a ...
5
votes
1answer
66k views

Chrome is telling me I am receiving a forged certificate for Gmail, is someone trying to hack me?

I went to log on to https://mail.google.com this morning and I got the following error. Is someone trying to attack me or is this just a bug? I'm on a WPA2 encrypted wireless connection using Chrome ...
6
votes
2answers
2k views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" src="http://www.domain.com/...
-1
votes
2answers
268 views

What are the security advantage of new redirecting method used by Gmail and Facebook?

When clicking on the any link in gmail or Facebook,it redirect to that link by some other ways. What are the security advantage of new redirecting method used by gmail and Facebook?
2
votes
2answers
357 views

Web Application Firewall Rules

For Network Layer Firewalls we have different sort of redundancy and consistency checks like rule shadowing, that can impact the performance of firewall. Do similar kind of checks can be applied on ...
4
votes
4answers
2k views

Isn't microtime() or mt_rand() sufficient for password reset?

In Can anyone provide references for implementing web application self password reset mechanisms properly? it is mentioned to use strong cryptographic randomness to generate the reset token that is ...
1
vote
1answer
327 views

Web Application Firewall Rule Optimization

Following are the two Rules taken from ModSecurity CRS core Ruleset. These two rules are base Rules for XSS attacks. If we look at these two rules their variables and actions are same what they differ ...
-3
votes
2answers
410 views

How is banking softwares used over the internet [closed]

I'm developing a banking software using php and that will be used over the internet. What are some of the security steps I should take in db design, programming, hosting...? thanks.
0
votes
1answer
305 views

Understanding CSRF vulnerability in Web Application?

I want to understand what is CSRF vulnerability. I use authorization system in my web application and found CSRF. What should we do to solve it? Actually I want to create simulation for this ...
2
votes
1answer
1k views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most of ...