An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
2answers
115 views

What exactly is endpoint security?

Would someone explain what endpoint security is, exactly? What do companies like McAfee and Symantec sell with their endpoint security suites? I also would like to learn if endpoint security ...
0
votes
1answer
162 views

AngularJS - Can a response from an $http.post to PHP be modified?

I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the ...
2
votes
2answers
54 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
1
vote
1answer
368 views

How to check my application passes multiple virus scanners

I have an application I am trying to bring to market and I want to ensure that nothing in it is picked up by a virus scanner (since that would reflect badly on me). Since I only have a single scanner ...
1
vote
4answers
139 views

Why pull upgrade from production server rather pushing them from development server?

I am reading a book on security which suggest that if you have both development and production server and if you make some change, you should pull them from production server rather pushing them from ...
6
votes
3answers
247 views

How to convince team mate about using a whitelist?

Context In our development team, we have to build a component. This component is a full client side one written in Javascript. A client web application wishing to embed this component will call it ...
0
votes
1answer
149 views

Can someone tell me whether this is Cross-site scripting attack or normal log entry?

Can someone shed light on this logs . ****GET /list25/ADMN/Eligibility/EligibilityResponse.aspx ...
-3
votes
1answer
43 views

What are some good resources to learn Remote Code execution [closed]

I want to learn remote code execution from scratch. Is there any sort of book where I can learn from, or there is a preunderstanding required to learn remote code execution? I am desperate to learn ...
-1
votes
1answer
258 views

Header.php keeps changing with JavaScript code in WordPress [duplicate]

I observed that my post on the blog takes too much time to load and I started to try finding out the issues behind it. I found there's a JavaScript code injected in header.php here: <?php ...
2
votes
2answers
4k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
8
votes
4answers
1k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
4
votes
2answers
178 views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
0
votes
1answer
48 views

Convert customer tracking system from web access to REST

Intro:In our company there is a service tracking website for our clients, where they can monitor the progress made in their cases with us. Our users are required to log in to that website (admin ...
4
votes
1answer
41 views

Does using creating a seprate firefox profile cause a seprate security context to protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
2
votes
2answers
218 views

Why does OWASP recommend “Disable Web Browser Cross-Tab Sessions”

I have been looking through the OWASP session management cheat sheet and I don't understand the reasoning behind the suggestion to "Disable Web Browser Cross-Tab Sessions". How does using the same ...
-1
votes
1answer
107 views

hard time in bug bounty hunting [closed]

I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting. I have read an ...
3
votes
4answers
168 views

Is it good practice to mandate input action on the password field in a webapp?

I am of the school of thought that says you should never have the browser "remember your password" because if you use it often enough, you will be able to retain that piece of information. I now want ...
0
votes
1answer
146 views

Is this code vulnerable to any attack? [closed]

I found the following code on this page. Is this indicative of a security problem. ;}else{str=" Following ";} document.getElementById("follow_"+count).innerHTML=str;} function ...
11
votes
5answers
7k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
1answer
43 views

SSL between websites on the same server

I have deployment that includes a public asp.net website and an internal webAPI both installed on the same machine. The webAPI will only communicate with the website. For example, it will not be ...
2
votes
2answers
1k views

Is it possible to take down a site using javascript in the URL bar?

If a site is written poorly enough, is it possible to take it down or severely mess with it using only javascript in the URL bar?
2
votes
2answers
1k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
1
vote
2answers
116 views

What's the most secure way to save Connection String in Windows Forms application?

I just got myself in a new company where they develop Windows Forms applications using .NET technologies and VB.NET, Of course. They use SQL Server databases. The BIG issue is that they store the ...
1
vote
2answers
53 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
0
votes
1answer
52 views

Practical benefit of using SqlCredential vs username/password in connection string

Currently I'm using SQL Server Authentication with the username/password as part of the connection string for my web application. As far as I know this standard procedure within the .NET world and ...
1
vote
3answers
391 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
0answers
44 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
3
votes
5answers
2k views

When is it safe to use a web based FTP client?

Is it safe to use a web based FTP client? If so, when? What should I watch out for?
-1
votes
1answer
64 views

How do a basic tests for webapp - online tool made with PHP (forms, shell access, session) [closed]

I created a webapp in PHP (MySQL, jQuery) and now I want to take necessary security measures in order to keep it up and running and harmless for my VPS. App has several public forms ($_POST, $_GET, ...
0
votes
1answer
449 views

On the ability to reverse engineer the Instagram Private API

I came across these blog posts where a man was able to extract the Instagram private signature key from the Android app: http://mokhdzanifaeq.github.io/extracting-instagram-signature-key/ Which could ...
1
vote
1answer
64 views

Is it secure to make a publicly available Web App that has URL's generated from a hash?

If you know of a better title, please feel free to edit the title. I'm making a simple google Web App so colleagues at my workplace can view details about a QA that they received. The issue is only ...
3
votes
3answers
1k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
-1
votes
1answer
132 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
5
votes
4answers
1k views

Can I use port 443 without SSL?

If I am running a web server on port 80 and I also have port 443 (HTTPS) turned on but it is not enforced. I did not self-sign or sign with a proper CA (i.e., I don't use SSL for my site), does ...
4
votes
4answers
846 views

Is there a security risk in existence of those HTTP headers in responses?

The following HTTP headers can be seen in responses on some sites: Age: 12 Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ== Via: 1.1 tacoma:3128 (squid/2.7.STABLE9) X-Cache: MISS from tacoma X-Cache-Lookup: ...
-6
votes
2answers
169 views

What does “;” mean in the link [closed]

In some links, I found ;. Example: https://example.com/index.php?action=pm;sa=send;u=1 What does that mean? Is it a web application firewall?
2
votes
1answer
64 views

Is using Gravatar in a web application with “private” URLs a security issue?

In our application, there is a kind of a "share" feature that sends an email to a user-provided address. This email contains a link with a secret access token (as part of the URL) that is valid for a ...
6
votes
3answers
736 views

Any eventhandlers that apply to hidden elements?

I'm trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
0
votes
2answers
91 views

How can I demonstrate the reflected XSS via post methods

I was trying to make a PoC of XSS: Attack sample: I have injected script into the value: <html> <body> <form action="https://test.com/api/users.prefs.set?t=1447648400" ...
4
votes
0answers
20 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
5
votes
3answers
254 views

Did I miss any vulns here?

I recently took a beating in a Security Engineer interview and I did not get any specific feedback on how I did. I'd like to re-ask the question to the community so I can polish up on these elements. ...
0
votes
1answer
62 views

Does creation of dump data would be considered as vulnerablity?

Problem behind the question : We were a small firm developing a small web application which was similar to fb,gmail,etc [in terms of functionality]. We have a signup form and I was assigned to test ...
2
votes
3answers
76 views

Don't trust the client?

I am a web developer, and have been trying to learn a bit about security, and the thing that seems to be the biggest principal is just to trust the client with as little as possible. Is this a correct ...
6
votes
1answer
108 views

How does X-XSS-Protection: “0” affect the security of my website?

How does disabling XSS protection affect my website? What security vulnerabilities does it open? My site requires the header to be used on certain pages, so what can I do to secure the pages with the ...
2
votes
1answer
65 views

Is this code vulnerable to DOM based attacks?

We are developing code for a Banking web application. We want to make sure that the code is secure and since we are using a lot of javascript code, we are kind of worried if any chance of a web based ...
3
votes
1answer
271 views
2
votes
1answer
49 views

How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?

I've been writing a Django app and almost published it with debug mode on. Django's documentation indicates Never deploy a site into production with DEBUG turned on. Did you catch that? ...
11
votes
4answers
11k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
8
votes
5answers
13k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...