An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
1answer
126 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
0
votes
1answer
41 views

How to evaluate the overall safety of a web offering? [closed]

Background: I have been trying to find a simple app to document my children's milestones in life. I have been signing up for a couple of free services and trying to evaluate their offerings. I ...
-2
votes
1answer
96 views

Clarification on a website security [closed]

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
0
votes
2answers
192 views

Google Analytics: Hacked or Ghost Referers?

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior. I've got a web application ...
0
votes
2answers
119 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
0
votes
2answers
76 views

Login account check [closed]

Suppose you want to create a new account in any website (let's make it Facebook), how do they check the Gmail ID or any mail ID we entered is a valid mail ID? I observed that some websites are ...
1
vote
2answers
298 views

Should CSRF token without session cookie work?

Let's say that website example.com has CSRF protection. They send CSRF token in custom header and in hidden input fields. For example to add new folder, your http request need to contain CSRF token. ...
0
votes
1answer
83 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
4
votes
5answers
197 views

Is it dangerous to serve user-uploaded Flash (SWF) files?

I'm working on a site that has CMS functionality. I'm considering allowing users to upload Flash (.swf) files and then displaying them on my site. Is this a bad idea? Is there a way to do this ...
1
vote
2answers
125 views

Credentialed scans and the Burp Suite active Scanner

I have been running scans on a few web applications that require a typical username and password to gain access to the website. I usually remain logged in through the browser my proxy is running ...
0
votes
1answer
70 views

How can I secure my server to ensure pre-login calls are originating from my app?

I have a .NET Web Api servicing a Cordova based mobile app and web front end written in AngularJS. I have done a ton of research and most sources don't give a great answer or one that's huge overkill ...
1
vote
1answer
89 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
4
votes
2answers
669 views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
-1
votes
3answers
217 views

How to check for sql injection attack? [closed]

We do our final year project related to sql injection. For implementing sql injection attack which IDE or tool we used? bcoz netbeans and other type of IDE are more secured?
-1
votes
1answer
33 views

Solving the code delivery problem via hashing the source GET'd [closed]

TLS gives you the confidence you're talking to the servers you trust, right? Yet, why should I give confidence to a page (likely to be a application today) that I've never read the source code, ...
0
votes
1answer
56 views

How to save a web page with its certificate?

I've made a payment to an online store and they're claiming there's no order with the number that appeared in my screen, therefore they're refusing to send me the product. I still have the page opened ...
2
votes
1answer
162 views

RESTful web application security and authentication scheme

I am building a web application where the front-end is a single-page-app and the back-end serves it through a RESTful API. I want to make sure I implement user authentication with the best security ...
0
votes
3answers
97 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
2
votes
3answers
150 views

Is it important for a web application's middle-tier to use a different communication protocol?

When building an n-tier/layered web application where each tier is physically separated from the others, is it important for a different communication stack to be used by the backend tier(s)—which are ...
0
votes
1answer
97 views

How could one defeat Webtrackers

I was just wondering why some pages refuse to load completely while surfing with no-script Plug-in when I don’t allow specific Java scripts. I was wondering if there is some way to hold the tracker ...
1
vote
2answers
43 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
1
vote
3answers
101 views

Is there an SQL injection equivalent on url-passed parameters to a servlet?

In SQL injection an attacker can craft a string that if left unchecked and executed it can complete and execute arbitrary SQL commands. Is there an equivalent to these kinds of attacks in JSP pages? ...
9
votes
3answers
844 views

Why should I use whitelist on a WAF?

I was studying different WAFs, from open-source (such as ModSecurity and NAXSI) to commercial solutions (Imperva, Citrix, Fortinet, etc.). Many people state that having a whitelist-based WAF is far ...
1
vote
2answers
172 views

Security of php code on webserver - obfuscate?

Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft? I think my question boils down to 'Is there a ...
2
votes
1answer
108 views

Hiding remote database credentials in application

If I'm building an application that connects to a remote database, where should I hide the credentials? I've seen many suggest that you go through a web-application and use POST and GET requests to ...
0
votes
1answer
155 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
1
vote
2answers
175 views

Overkill or appropriate?

I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server, and the database will be on its own ...
1
vote
3answers
182 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
0
votes
3answers
103 views

How to secure consumer info without buy an certificate?

I need to know how to properly secure my consumers credit card info without buying expensive certificates? It is possible to use https:// and ssl or tls without an certificate and without scary ...
2
votes
3answers
91 views

Security coding training best approach

To train the development team, there are various options one can take: inhouse presentation with code samples, CBTs so developers do it at their best time, instructor-led courses onsite or inhouse ...
2
votes
4answers
304 views

Should text files or image files be virus scanned during upload?

I have created an online web app for my company. It's being tested for security files. The tester loaded the EICAR text file. The virus scanner on the server caught and removed the file. I have only ...
1
vote
1answer
110 views

Is posting data to a https address secure?

I am making an web application who POST an username and password to an server who checks it. This communication is secure (SSL/TLS). What I was wondering if the secure SSL communication is set up ...
1
vote
2answers
221 views

Is PHP unserialize() exploitable without any 'interesting' methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
2
votes
4answers
862 views

Analyze my custom web authentication scheme, based on a token derived from username and password

To avoid having the user to login every time his session expires, I want to implement a token based authentication system. My scheme works like this: Send the user login (send name + password) ...
1
vote
1answer
92 views

Is it possible to build a web-service which is immune to DOSes?

I heard that a service I'm using on the web has some problems with denial of service -attacks. I was wondering if it is theoretically possible to build a web-services where user can send data and ...
0
votes
0answers
94 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
1
vote
2answers
159 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
3
votes
1answer
94 views

PHP max_input_vars security expectations

Considering a site that handles large POST data, would it be unreasonable and dangerous to set the php.ini max_input_vars to something like 100000? I know this is a vector for DOS attacks, but don't ...
1
vote
0answers
32 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
2
votes
1answer
340 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
3
votes
3answers
109 views

Does it make sense to isolate each web service user on his own servers?

I am planning an architecture of a web application for my company which is launching a financial service for its partners, and my main question is - does it make sense to put each partner on a ...
2
votes
1answer
51 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
-1
votes
2answers
135 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
0
votes
1answer
58 views

How I do get the correct the Tamper parameters from an internal web login [closed]

I am doing pentesting for a web application, but I do not know if am using the Tamper Data add on on mozilla correctly. Could anyone explain how to get the following parameters, and where do I need ...
2
votes
1answer
226 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
35
votes
6answers
4k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
1
vote
1answer
98 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
0
votes
1answer
342 views

CSRF Guard: Injects token in POST Request?

I have implemented CSRF Guard into my web application. It's working fine for GET requests (with AJAX and without AJAX) however for POST request token is not getting injected into the request that's ...
3
votes
2answers
191 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
5
votes
1answer
325 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...