An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

20
votes
4answers
8k views

Is $_SERVER[ ] a safe source of data in PHP?

Can I 100% rely on $_SERVER[] to be a safe source of data that I do not need to sanitized like I do $_GET[] and $_POST[]?
3
votes
3answers
188 views

Sending sensitive infromation via self destructing link in an email

I need to come up with a simple way for people within the company to send out arbitrary sensitive information to arbitrary recipients. There is an equal chance that the sender and recipient will be ...
1
vote
2answers
89 views

Login attempt password logging and obfuscation

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? ...
1
vote
1answer
680 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
6
votes
4answers
283 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
0
votes
0answers
58 views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
2
votes
2answers
901 views

CSRF Login: can Attacker Login using valid credentials?

Consider the picture below (taken from page 21 here). Is this possible? If so, how can I prevent it?
1
vote
2answers
86 views

Does an image showing exception error on my site pose a prominent security risk?

I wrote a small website in PHP and ZF2. Had a friend test it out by posting a link to it on Facebook. Apparently I forgot to turn off ZendFramework reporting and he find an error. Posted a photo ...
-4
votes
1answer
60 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
0
votes
3answers
178 views

What can I do to increase security of a small open source application [closed]

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
43
votes
7answers
8k views

Is suggesting a correct url in a 404 page bad practice?

I'm currently writing a web application, and my client asked me if it would be possible to suggest a valid URL to the user when they accidentally write a typo in the URL bar, an example of this would ...
21
votes
4answers
12k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
0
votes
1answer
121 views

Why is storing usernames in cookies bad? [duplicate]

A commonly repeated advice over the web is not to store usernames in cookies. However, I don't really understand the problem. What I'm doing in my web application is: I generate a 16-byte (converted ...
-1
votes
1answer
53 views

Remote Help HTTP GET Request Format String Denial Of Service Vulnerability

Is there any solution for "HTTP GET Request Format String Denial Of Service Vulnerability" in the Remote Help software? I have referred many places but I could not find a solution. Please refer the ...
4
votes
3answers
2k views

GET and POST request vulnerable to CSRF attack?

Are both GET and POST request vulnerable to CSRF? Should we use PUT instead?
5
votes
5answers
196 views

Should I use CSRF protection for GET requests?

I've seen several blanket statements on the web to the effect that you don't need CSRF protection for GET requests. But many web applications have GET requests that return sensitive data, right? Then ...
2
votes
2answers
116 views

How do I know that malware on the client computer does not modify data transmitted to my webapp?

I am working on a web application and have had an idea of a new feature I would like to add. The feature includes getting data from the user on their open system and receiving it on my server. For the ...
5
votes
1answer
112 views

How to prevent directory traversal when joining paths in node.js?

I have a node.js webapp in which I need to concatenate two paths in a safe way. The first one (leftmost) is a constant, and the second one (rightmost) is relative to the first one and comes from ...
3
votes
1answer
170 views

What is pseudo-encryption key vulnerability?

An organization in a related business was recently hacked. The hackers downloaded several GB worth of files with private information and posted it on the Internet. The news article states: “They ...
38
votes
10answers
8k views

How can I securely check if a username exists?

I'm working on the onboarding functionality of my web app and at some point I'm asking a new user to choose a username. When the user gets to this point, I have his/her email and a cellphone number ...
0
votes
0answers
32 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
18
votes
6answers
3k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
3
votes
2answers
251 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
2
votes
6answers
2k views

When is it safe to use a web based FTP client?

Is it safe to use a web based FTP client? If so, when? What should I watch out for?
1
vote
0answers
87 views

LFI to RCE when log file isn't readable

During a penetration test, I came across an endpoint which lets me include local files and I can read /etc/passwd. However I don't have permissions to read proc/self/environ and /etc/shadow. The ...
72
votes
4answers
27k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
13
votes
1answer
3k views

Should I hash my passwords even if I am only allowed to generate limited traffic?

At this moment I'm busy working on an webapp with a friend of mine. The main problem we have is that we are only allowed to generate 50 GB a month in datatraffic. My question is: Does hashing the ...
2
votes
2answers
98 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
-1
votes
1answer
35 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
0
votes
2answers
90 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
68
votes
13answers
21k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
3
votes
2answers
183 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
25
votes
4answers
7k views

Should I block the Yandex Bot?

I have a web application that the Yandex spider is trying access into back-end a few times. After these spider searching, there are few Russian IP addresses that try to access back-end too and they ...
0
votes
0answers
56 views

How to perform TimThumb remote code execution over Wordpress sites?

When I was scanning a web application, Vulnerability scanner shows me that wordpress application has a vulnerability called TimThumb Remote Code Execution (referring Webshot feature). I went through ...
0
votes
1answer
143 views

Preventing uploads of malware to server by changing all extentions to PNG?

Ok, so I have my own website, and you can use the file upload quite a bit, and it is very important to the site. However, I've been hearing that clients can still bypass a file extension restrictions (...
1
vote
0answers
109 views

from weevely shell to root? OSCP [closed]

I'm doing OSCP, and have been on this problem for a while. I need some guidance on this. I manage to get a weevely shell to a lab machine via SQL injection. The OS is CentOS 5.4 The user is "apache"...
1
vote
1answer
140 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3....
0
votes
2answers
90 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
15
votes
8answers
4k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
4
votes
2answers
352 views

Why do web services keep asking me about my phone number?

They say it's for my own safety and that somehow my account is more "secure" if I link it with my phone number, but I don't understand why - they already have my e-mail address through which I can ...
3
votes
2answers
96 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g.,...
1
vote
2answers
65 views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
5
votes
3answers
516 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
3
votes
2answers
125 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
1
vote
3answers
307 views

How to generate random but unique tokens for authentication?

I need to create unique and long tokens for email verification, but I am not sure about how. Currently we are on staging servers or we are just using os.urandom() in Django. But I need to know what ...
2
votes
2answers
203 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
77
votes
6answers
9k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
1
vote
0answers
26 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...