An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

22
votes
5answers
3k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
6
votes
1answer
78 views

Design a webapp that uses OAuth, but with tokens that can't be used by the operator?

I'd like to make a webapp that would allow users to OAuth with Stack Exchange, so that they can perform actions like voting through the app. I'm stuck at one point, though: I know how to perform ...
9
votes
4answers
469 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
0
votes
1answer
106 views

Cookie+session based CSRF protection

Consider the following scenario: 1. When user visits a webapp, server:     a) initialize the session;     b) generates CSRF token;     c) ...
2
votes
3answers
155 views

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
4
votes
8answers
845 views

Is this a good way to store passwords in a Web Application?

I've been tasked with finding a better way to store passwords and came up with this Algorithm. My understanding of Crypto is not strong enough but can someone check this please? Inputs: Username ...
11
votes
4answers
780 views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
10
votes
8answers
2k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
1
vote
2answers
238 views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
20
votes
1answer
2k views

What cookie attacks are possible between computers in related DNS domains (*.example.com)?

Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value. Example Suppose a user has the ...
1
vote
3answers
140 views

How can I prevent my database from being compromised if my CakePHP app is compromised?

I have an app server hosting a CakePHP app and a database server hosting the databases. The servers are physically separate. The databases contain encrypted sensitive information. The encryption keys ...
2
votes
3answers
326 views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
0
votes
1answer
117 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
2
votes
3answers
155 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
2
votes
2answers
161 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
5
votes
5answers
3k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
6
votes
3answers
440 views

Is it proper to be prompted that I entered an old password

I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt: Sorry! You Entered An Old Password And even shows the date&time when I ...
26
votes
3answers
6k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
2
votes
2answers
94 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
3
votes
1answer
200 views

How effective is Caja at preventing XSS?

I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your ...
2
votes
1answer
128 views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
1
vote
2answers
99 views

On what layer should password hashing and/or encryption take place

I'm finding myself on the inexperienced end of a discussion about where password hashing takes place. My coworker drew a schema from less to more secure, where the Public Internet was the least ...
1
vote
3answers
807 views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
3
votes
3answers
211 views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
3
votes
2answers
156 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
1
vote
2answers
106 views

How does one decide whether to block malicious scanning activities?

On a typical day in the internet, there would be numerous botnets commanding zombie computers to scan for servers with vulnerabilities. Every now and then, a new exploit would be discovered. Then, the ...
0
votes
1answer
67 views

Possible ways of exploiting PHP register_globals [closed]

I have a PHP script that executes a bunch of commands to verify that a user is logged. if (( isset ($password) && $password!="" && auth($password,$hidden_password)==1) || ...
1
vote
2answers
99 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
2answers
192 views

Form submissions over HTTPS are not encrypted?

My question is regarding HTTPS form submission. One of our website is using HTTPS, we display the login page to the user via HTTPS protocol. When the form is submitted, if we try to intercept the ...
1
vote
1answer
72 views

attack signatures [closed]

I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I ...
2
votes
1answer
247 views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
4
votes
4answers
395 views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
1
vote
2answers
120 views

Nested encryption for multiple users

I've developed a web application (developed in .NET MVC 4) which have multiple users with personal login credentials. The web application holds a lot of content uploaded by the users. My client would ...
0
votes
3answers
568 views

Elaborate Hacking attempt detected - now what?

I am in the process of developing a php/mysql based web application. I took the complicated route and rather than to use a framework or anything I built the entire foundation of my app from scratch. ...
0
votes
2answers
195 views

Help investigating potential website attack (URL rewriting and ROT-13 obfuscation) [closed]

We're looking for help/advice from website security experts. Our company develops web-based process management software and hosts it for our customers. The software sends emails to users when they ...
5
votes
5answers
1k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
4
votes
3answers
3k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
5
votes
2answers
115 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
3
votes
3answers
864 views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
2
votes
2answers
164 views

What are good approaches to modify TLS/SSL trafic in order to make a HTTP bot?

If I wanted to make a bot that plays/issues automatic actions/moves in a online browser game, whose communication is realized over HTTP1/1 and WebSocket (https and wws respectively), all TLS ...
7
votes
5answers
6k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
2
votes
3answers
96 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
2
votes
2answers
103 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
0
votes
3answers
95 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
6
votes
1answer
412 views

Using skype for an attack

I am curious about something; let's say someone randomly added me to Skype and tried to initiate a chat with me and I want to know more about them but I am worried if they can do some damage. My ...
0
votes
1answer
91 views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
3
votes
1answer
90 views

How online document signing services guarantee non-repudiation?

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee ...
1
vote
0answers
26 views

Writing Security Functionality Requirements [closed]

Is there any Guideline Doc. or Tutorials for writing Security Functionality Requirement (Common Criteria)for a product?
1
vote
3answers
210 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
0
votes
1answer
90 views

Is there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and fastcgi to create a psudo-CMS, is there any kind of security concerns to watch out for (ie buffer overflows, and the like)?