An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...
3
votes
1answer
471 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
13
votes
6answers
3k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
4
votes
5answers
2k views

When storing private identifying information in a web application, what is “industry standard” best practices? [closed]

I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account ...
2
votes
4answers
2k views

Web Security Certifications

I'm looking for a certification for Web Application Security and Web Pen Testing. Via Google I found the following two: Certified Web Application Tester GIAC Web Application Penetration Tester How ...
7
votes
2answers
3k views

Antivirus for scanning anonymous file uploads

Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...
9
votes
3answers
2k views

localStorage for apps over https. What expectations are there?

I run an online gradebook. To keep student data private, I transfer all data over https. Now, I'd like to use localStorage to avoid redundant calculations and server requests. However, according to ...
10
votes
4answers
520 views

Should a web application return true http errors?

Exception and error information can be used by a malicious user to map out the API of an web application, so it is routine to see security checklists to advise returning only a "Please contact your ...
4
votes
3answers
3k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
2
votes
2answers
3k views

Secure SSL Session from losing itself into unsecure http

I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
10
votes
6answers
626 views

What are web attacks which users can run code on your servers?

I hear stories about insecure web servers and sites which people (or bots) break into and execute their own code on the server. My question is how is that possible? I heard of people putting their ...
4
votes
3answers
807 views

Secure data transmission and storage

We currently have an application that we deploy via the web, users access it by connecting to a link which opens an executable file. This file was compiled with visual foxpro. My question is - is ...
5
votes
1answer
187 views

Is it safe to allow untrusted field names in JSON?

When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
6
votes
3answers
325 views

How do I secure my advertisement space against ad overlay browser attachments?

I don't really have an issue with advertisements simply being blocked by individual users who are visiting a customers site or my own site. As an individual you have the freedom to choose not to look ...
2
votes
1answer
508 views

What threats does a stateless web application have? (as opposed to a “state-full” sessions)

I'm comparing the pros and cons between having an authenticated "stateless" ASP.NET MVC session versus a ASP.NET Forms application with viewstate. Assuming that there is a webfarm of more than 1 web ...
10
votes
3answers
500 views

Should I ask a user to re-authenticate if the browser thumbprint changes? Is a server side library available?

Is there a security benefit to using the browser's thumbprint in addition to a session identifier to identify a unique session? Would it then be advisable to ask the user to reauthenticate (or simply ...
11
votes
5answers
15k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
7
votes
4answers
3k views

CSRF protection needed for clients that don't accept cookies?

I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
3
votes
3answers
348 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
15
votes
4answers
1k views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
39
votes
6answers
15k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
7
votes
3answers
3k views

Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?

Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
8
votes
5answers
2k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
1
vote
1answer
520 views

What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
13
votes
6answers
2k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
17
votes
6answers
8k views

Preventing information disclosure from browser back button/history?

I have sensitive data that will be hosted on a website, and I would like to prevent the data from being exposed in this scenario: The primary user logs off the application, but does not close the ...
7
votes
1answer
400 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see the July 2010 draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
24
votes
1answer
24k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
2
votes
2answers
391 views

Is the OData Protocol susceptible to Insecure Direct Object References?

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention ...
9
votes
3answers
2k views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
68
votes
4answers
25k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
6
votes
7answers
2k views

Should I prevent sending of GET requests for urls that are normally operated with POST request?

There is an url that is normally operated using POST requests (i.e. POST request is sent when user submits form). But attacker can form GET request with parameters that are sent in POST request. This ...
3
votes
0answers
558 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
9
votes
3answers
3k views

Is it possible to forge a post request?

Consider the following URL http://mysite.com/form?date=x. Suppose that if x is in an incorrect format, that a page is returned with <p>x is not a valid date</p>, where the page author has ...
5
votes
1answer
12k views

AES-256 OR RSA-2048 for web application security?

I'm developing a web application with a database backend using Django that will be accessed from the Internet. The database will contain sensitive information and I'd like some advice on the approach ...
4
votes
2answers
916 views

When is an intermediate page needed before directing a user off my primary website? What is the best implementation?

The NSA has a page that intercepts redirections off the primary site. (click "TLS: "Suite B Cipher Suites for TLS," RFC 5430" for an example). I've seen this used in Exchange Outlook Web Access ...
14
votes
3answers
7k views

Is the Facebook login form using SSL without https in the URL?

If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
19
votes
2answers
889 views

What risks should I be aware of before allowing advertisements being placed on my website?

The thought of having a 3rd party send javascript, and images to end users seems to be a scary thought, but that is exactly what we are doing when I place advertisements onto my site. Does serving ...
24
votes
2answers
5k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
2
votes
2answers
178 views

How can I force certain the webclient to honor or remember certain parameters from the webserver?

HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
8
votes
9answers
448 views

What is the proper way to view the sourcecode of a website?

I recently heard that Firefox makes a second HTTP request when the sourcecode is requested. Is this true? Does this mean the webserver may issue alternate source from the original? Lastly, is ...
6
votes
5answers
746 views

Should a closed source website keep a secret key in its source?

Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a ...
26
votes
5answers
2k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
4
votes
5answers
3k views

Should I ignore the BEAST SSL exploit and continue to prefer AES?

Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4. I am wondering if it wouldn't be better to continue using AES instead for the following ...
4
votes
1answer
1k views

What is the impact of certificate validation level (or class) on deployed web applications?

Certificates can have a class level (or validation level). What is the impact of these levels on deployed web applications? More specifically: Is the certificate level included in the certificate ...
5
votes
1answer
521 views

Any non-commercial certificate authority issuer for web applications?

Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
11
votes
2answers
10k views

Implications of Trace/Track Methods on Apache

When performing vulnerability scans using Nessus, against a host running Apache, one expected result is always "HTTP TRACE / TRACK Methods Allowed". While this result only has a base CVSS of 4.3, I ...
8
votes
2answers
9k views

Is the service join.me actually a huge security risk?

In case you don't know, there is a website called join.me which lets you do screen sharing from a browser, using a flash program that is on the web page. Until I encountered this service, I had no ...
6
votes
4answers
7k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
4
votes
3answers
3k views

Google App Engine Security

I am writing a master thesis concerning security of certain applications, and as a part of it I want to write a web app on Google App Engine and test how secure it is. Does anyone know if there was ...