An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
1answer
141 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [closed]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
0
votes
1answer
165 views

Java desktop app vs web service [closed]

I currently have a desktop app written in Java (Swing) which talks to a C-based backend over SSL. I am trying to understand the pros/con from a security perspective to move to a web service model. ...
0
votes
2answers
164 views

Is this the most secure encryption/hashing system? [closed]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...
43
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
2
votes
1answer
113 views

How to pen-test RAP applications

Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google ...
-2
votes
2answers
132 views

Is it illegal to access a public file that contain private information? [closed]

There is a website that I was testing to see if they have any vulnerability. To my surprise I found that one of the folders, like /docs with index of /, and they have a file that will contain all ...
1
vote
2answers
374 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
1
vote
2answers
102 views

security concern of user submitted bash command

Recently I am building a web service that user input will be used to run a bash command on the server side. What are the security problem I need to take care? Right now I find one that user could ...
0
votes
2answers
88 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
1
vote
3answers
134 views

Trouble understand login vulnerabilities

I'm testing my own web page with the following vulnerabilities. #1: Form escapes ' to \' So if a user tries to enter the following information: username: 'or'1=1 password: m username will ...
3
votes
1answer
204 views

At what criteria should an unpatched machine be considered hacked? [closed]

Since every machine connected to the Internet requires security patches, there is a window of time in which those updates have been released and those machines haven't yet been patched. It is ...
1
vote
1answer
90 views

What is the safest way to encrypt a password that can be decrypted at a later time?

In a web app I'm building, I need to use Apple's AutoIngestion tool for iTunes Connect. In this tool it seems the only way to use it is to send a password in plain text. What would be the best ...
-1
votes
1answer
70 views

Custom TLS in Browser [duplicate]

We are developing a JSF web application that has a main requirement of using our own TLS implementation (custom algorithm suites). The clients will connect via a browser. Is there any way (customising ...
0
votes
1answer
133 views

How does a reverse proxy change the security posture of a web server residing in the DMZ? [closed]

How does the reverse proxy change internal and external security posture with a reverse proxy compared to not having a reverse proxy? For example, you have a publicly accessible iis server, what is ...
0
votes
2answers
85 views

Contact form without validation

one of our web page is a contact form eg name, email, and a textbox for sending comments. It seems like if we leave all of those text fields blank and click the submit button, it still went through ...
4
votes
4answers
542 views

How strong is visualCaptcha?

I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives: Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right ...
2
votes
3answers
151 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
1
vote
1answer
168 views

Detecting web app attacks by parsing log files [duplicate]

Following up on this question as the answers are now 5 years old: Can I detect web app attacks by viewing my Apache log file? My boss has tasked me with analyzing our access.log and error.log files ...
2
votes
4answers
229 views

What would you call an attack where authenticated user modifies other users information on web app?

Authenticated user on web app, using other people's id to update or change their information. So basically the web app is not checking for person who is logged in against the person who he/she is ...
0
votes
1answer
59 views

Feasibility of creating an in-memory web app (that runs from a CD-rom on a web server) for sharing self-destructing messages

This question is about a hypothetical in-memory web application that is used for exchanging encrypted messages that passively self-destruct in X amount of minutes. Here the messages would be stored ...
0
votes
0answers
71 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
0
votes
1answer
54 views

Making a Judgement on a User's IP Usage

We have a click exchange-type web application that allows users to receive stats boosts within a game. Stats boosts are based off unique IP addresses which poses a problem for users who use proxies or ...
0
votes
2answers
316 views

Source code disclosure vulnerability

I am a bit confused about the discussion here about hiding javascript source code. Let's say if I browse to a url like this: http://www.example.com/site/somejs.js and then what I see is something like ...
0
votes
3answers
176 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
1
vote
2answers
244 views

ruby on rails pentesting web applications

I am currently testing a RoR web application, but I am honestly at a bit of a loss, I have never gone up against a RoR application before and I was wondering if there were any specific tools I could ...
3
votes
1answer
87 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
2
votes
1answer
195 views

Preventing XXE Injection

I've stumbled upon an exploit method which I haven't really had time to investigate before. XML eXternal Entity is said to be susceptible of a server-side type of injection. I can specify a Document ...
3
votes
2answers
57 views

Is hashing schema information for client when generating SQL queries more secure?

I'm planning to implement a web system wherein APIs and presentation for CRUD in data tables are automatically generated, like that in phpMyAdmin. How I plan to implement this is to construct SQL ...
2
votes
1answer
100 views

Can you steal session cookie with BREACH attack?

Most of the discussions about the BREACH vulnerability are around stealing session-based CSRF tokens. But if you can steal a session-based token, could you also steal the session token itself? ...
3
votes
2answers
136 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
4
votes
3answers
494 views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize ...
1
vote
1answer
43 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
1
vote
1answer
129 views

mail.google.com identity doesn't match

I got This website doesn't supply identity information in firefox while browsing gmail.com, I understand that would be because I understand it is required when it needs to load content using ...
2
votes
1answer
79 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
1
vote
2answers
104 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
3
votes
2answers
101 views

Issues with using TLS Session Id for Web App Session?

Apache Tomcat has the ability to use the TLS Session ID instead of a session cookie or JSESSIONID in the querystring. My site is HTTPS Everywhere. This seems useful in that I don't have to worry ...
5
votes
3answers
255 views

PHP | Security for allowing user uploads

My Sittuation: I am creating a web application with PHP which allows users to scan their files for viruses. It allows the user to upload their files via the html "file" input type or via a URL. I ...
3
votes
4answers
1k views

Is it secure to have source code for website public? [duplicate]

I am working on a website and would like to have it under revision control. I have used git for earlier projects before and I like it. This project though is a website written in Django. I am totally ...
2
votes
1answer
49 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
0
votes
1answer
71 views

rate limiting and access filter for web application

I had a requirement of rate limiting and dynamically access controlling access to web application dynamically I want to be able to rate limit access turned on / off dynamically black/white list ...
2
votes
1answer
59 views

Freelance web app tester law on breach after scan [closed]

If I was to do a web app test on a companies site and I didn't spot something and the company was breached via the app I tested what come back could I possibly have ? How could I protect myself ...
2
votes
1answer
155 views

Basic nginx securing / restricted access [closed]

I run a private virtual server on Ubuntu 14.04 and I use Nginx as my http server and/or reverse proxy. I run multiple webapps on this server, most of them are fresh open source projects. UPDATE : ...
6
votes
1answer
243 views

Secure forgot password page: Is a server-stateless implementation viable?

This is yet another "How is a forgot my password page done right" question. However, it explicitly addresses two implementation options that I have come across recently. The common approaches [1,2] ...
3
votes
3answers
526 views

External cross domain include script

One of my web application underwent a vulnerability assessment recently, and one of the findings is about cross domain include script. Our web app uses addthis_widget.js from AddThis to bookmark ...
1
vote
1answer
144 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
0
votes
1answer
43 views

How to evaluate the overall safety of a web offering? [closed]

Background: I have been trying to find a simple app to document my children's milestones in life. I have been signing up for a couple of free services and trying to evaluate their offerings. I ...
-2
votes
1answer
102 views

Clarification on a website security [closed]

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
0
votes
2answers
252 views

Google Analytics: Hacked or Ghost Referers?

I posted this question (Hacked or Ghost Referers) on Google groups earlier today, but I also wanted to see if the security experts here have any insight into this behavior. I've got a web application ...
0
votes
2answers
170 views

Are CSRF tokens useful outside of web APIs?

I'm trying to understand CSRF tokens and one thing isn't making sense to me. For a web API, you can provide a CSRF token just once, on authentication, and expect the client to remember that token ...
0
votes
2answers
80 views

Login account check [closed]

Suppose you want to create a new account in any website (let's make it Facebook), how do they check the Gmail ID or any mail ID we entered is a valid mail ID? I observed that some websites are ...