An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

14
votes
1answer
2k views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
6
votes
1answer
683 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
9
votes
2answers
2k views

Security Concerns on clientside(Javascript)

We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
20
votes
2answers
4k views

Which HTTP status codes are interesting from a security point of view?

I'm looking to extract interesting information from webserver logs and I wonder which HTTP status codes should I filter out? For example, 200 hits can be considered to be 'regular behavior' whereas ...
10
votes
4answers
2k views

Is there a typical step-by-step A-Z process for testing a Web site for possible exploits?

I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for instance,...
3
votes
2answers
605 views

Which access rights should be chosen for doku wiki?

I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages). At the moment I gave the ...
8
votes
4answers
5k views

Can I block the true IP address using X-Forwarded-For header in IIS?

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address. Can I use the X-Forwarded-For header with ...
3
votes
4answers
163 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
0
votes
2answers
2k views

How do we protect our server from anonymous hacker? [duplicate]

Possible Duplicates: Hardening Linux Server How to best defend against Targeted Attacks? I read this news: Anonymous hacker group hits Apple, publishes data My question: How do we ...
2
votes
1answer
3k views

Is it possible to secure a web app without HTTPS? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? Think of a typical web application where the users log in, and then the session is kept with a session key. Is it ...
13
votes
5answers
3k views

Solution to allow JavaScript input but prevent XSS

We have a simple Blog system that allows users to input html and JavaScript to build a blog page. I'm aware that allowing javascript open up the door to xss attacks. We do however need to allow users ...
5
votes
6answers
2k views

I want to be web security consultant?

If I want to be very good at security and especially web security, then must I learn languages? I mean things like PHP, C#, java, etc? If not then what should I learn exactly? and do you know any good ...
20
votes
14answers
3k views

How can you become a competent web application security expert without breaking the law?

This question was asked here on Programmers Exchange, but it was suggested I ask here as well since most of the experts would likely hang out on IT Security exchange instead. I find this to be ...
5
votes
1answer
672 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
34
votes
2answers
12k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
0
votes
0answers
138 views

How can I prevent SESSID stealing? [duplicate]

Possible Duplicate: Can you secure a web app from FireSheep without using SSL? How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would mean ...
10
votes
3answers
2k views

How to perform penetration testing on a Flex application?

Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
14
votes
6answers
2k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
8
votes
2answers
2k views

How secure are the default ASP.NET membership and role providers for Sql Server?

I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
7
votes
2answers
626 views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
8
votes
3answers
454 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
18
votes
3answers
3k views

Is it a vulnerability to display exception messages in an error page?

Our web application has an error page that displays the absolute URL path and query of the page on which the error occurred, the date/time of the error, and the exception message. (We do not display ...
10
votes
1answer
409 views

Is there a web application firewall equivalent of virustotal?

I'm wondering if there is a web application firewall (WAF) equivalent of VirusTotal? A site where I can throw for example injection strings, exploits or xss, and it will tell me what the default ...
11
votes
1answer
567 views

Public XSLT & XML playground (with PHP DOMDocument, etc.) Security Risks?

Let's say I want to set up a sandbox or playground in PHP that users can use to create (or paste in) XML and XSLT, then transform the XML via the XSLT (by means of PHP 5's DOMDocument and related ...
47
votes
8answers
6k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
1
vote
1answer
569 views

How do security questions work? [duplicate]

Possible Duplicate: Do security questions subvert passwords? Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he ...
14
votes
3answers
4k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
12
votes
4answers
788 views

How should I secure a contact form that appears on every page of a website?

My client has a small "Contact Us" form on every page of their website. They are adamant about not including CAPTCHA verification on these forms, to keep them easy to use, but I feel it is my ...
13
votes
3answers
1k views

Elaborate websockets security

I'm interested in learning more about web sockets security. Read that web sockets were originally in Firefox, removed for security reasons and now added back in with the problem resolved: http://news....
5
votes
6answers
1k views

What might be the legal and policy consequences of traffic sniffing?

I found a security hole in an organisation in the UK with many employees. Login form sends user name and password in clear text to the public facing IP via HTTP. Initially I pointed this to IT but ...
4
votes
2answers
713 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as intended)...
18
votes
4answers
6k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
14
votes
4answers
687 views

How to protect off-the-shelf web applications?

As an exercise, please consider the following: If you are faced with having to deploy off-the-shelf web applications that you are unsure about the vendors security coding practices, which techniques ...
125
votes
3answers
22k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
26
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
6
votes
6answers
2k views

How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of ...
4
votes
2answers
2k views

How to protect from new Javascript Injection technique that doesn't use eval()?

There is a new Javascript injection technique that is generating chatter on the forums mentioned here Here is the code sample: String.prototype.code = function(){ return (new Function('with(this) { ...
7
votes
4answers
694 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 http://www.vupen.com/demos/VUPEN_Pwning_Chrome....
10
votes
2answers
686 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
5
votes
2answers
171 views

Protection against synthetic queries

Note: One, I am not sure if synthetic queries is right word for the risk I am talking about. Second, though I am considering 3-tier model of web-applications general answers are welcome in client-...
61
votes
7answers
28k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
3
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications? [closed]

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
3
votes
3answers
158 views

Encrypting a fixed format message with commands and transmitting over the internet

Linked to: Encrypting a fixed format message? I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
4
votes
3answers
522 views

It is safe to buy a domain if I get this message in Firefox?

I want to buy a domain name from a big registar (well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” and I am ...
4
votes
3answers
389 views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
3
votes
2answers
224 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: $...
1
vote
2answers
2k views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
1
vote
1answer
1k views

Securing clients side scripts [duplicate]

Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
6
votes
3answers
218 views

What indicators did OWASP use to end up with OWASP Top 10?

I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ... Knowing that each of these ...
8
votes
2answers
2k views

MIME sniffing protection

As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...