An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
2answers
94 views

Need help to exploit php script vulnerability of a challenge

i am trying to exploit a vulnerability in a php script of the 'stop us' challenge of Wechall.net and I am not sure but I think I found the vulnerability, but now I don't know how to exploit it. I made ...
68
votes
13answers
21k views

What are the pros and cons of site wide SSL (https)?

What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
3
votes
2answers
184 views

Can you exploit an XSS vulnerability on one page to run code on another page?

Lets say that page A is vulnerable to XSS, but contain nothing of interest to an attacker. Page A links to page B that is not vulnerable to XSS, but contains a high value target for an attacker (such ...
25
votes
4answers
7k views

Should I block the Yandex Bot?

I have a web application that the Yandex spider is trying access into back-end a few times. After these spider searching, there are few Russian IP addresses that try to access back-end too and they ...
0
votes
0answers
56 views

How to perform TimThumb remote code execution over Wordpress sites?

When I was scanning a web application, Vulnerability scanner shows me that wordpress application has a vulnerability called TimThumb Remote Code Execution (referring Webshot feature). I went through ...
1
vote
0answers
113 views

from weevely shell to root? OSCP [closed]

I'm doing OSCP, and have been on this problem for a while. I need some guidance on this. I manage to get a weevely shell to a lab machine via SQL injection. The OS is CentOS 5.4 The user is "apache"...
1
vote
1answer
160 views

How to use nmap through proxychains?

Iam running nmap through proxychains using this comand proxychains nmap -v scanme.namp.org This produced an error showing like this root@kali:~# proxychains nmap -v scanme.nmap.org ProxyChains-3....
0
votes
2answers
90 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
15
votes
8answers
4k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
4
votes
2answers
359 views

Why do web services keep asking me about my phone number?

They say it's for my own safety and that somehow my account is more "secure" if I link it with my phone number, but I don't understand why - they already have my e-mail address through which I can ...
3
votes
2answers
97 views

Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?

The OWASP Application Security Verification Standard (ASVS), Version 3, states in clause V11.2: Verify that every HTTP response contains a content type header specifying a safe character set (e.g.,...
1
vote
2answers
67 views

Is crossdomain policy file required by EVERY web application?

1) If a web application does NOT use any Flash content, does it require crossdomain / clientacess policy file ? 2) If a web application does not host crossdomain / clientaccess policy file, is it ...
5
votes
3answers
519 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
3
votes
2answers
129 views

Preventing Browser from BeEF Exploitation

BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect ...
1
vote
3answers
319 views

How to generate random but unique tokens for authentication?

I need to create unique and long tokens for email verification, but I am not sure about how. Currently we are on staging servers or we are just using os.urandom() in Django. But I need to know what ...
2
votes
2answers
204 views

Secure copy-paste from phone to computer

Some computers on my university block the keepass application which I use as a password manager. I'm thinking of building a small web application + Android app which lets me securely copy a string ...
77
votes
6answers
9k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
1
vote
0answers
27 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
1answer
46 views

How to find name of file to include in local file inclusion attack?

In a local file inclusion attack, besides guessing, is there method that allows an attacker to know the name of the right file? The name of the file to be included in a LFI attack is not always ...
6
votes
4answers
5k views

Malware infections from visiting or using YouTube

Is it possible to be infected by viruses or other malware while visiting YouTube? What kind of measures do the YouTube staff take to prevent viruses and malware?
0
votes
2answers
97 views

How to detect XSS in GET requests?

How to detect XSS in HTTP/1.1 GET requests? A request can be malicious and I want to know how to detect if the GET request to a server is trying to XSS my website?
0
votes
0answers
49 views

Targeting a specific machine and known setup with Armitage / Metasploit?

Most introductions to armitage / metasploit start with searching for potential targets. But if you want to pen test your own setup then it probably makes more sense to target the specific machine and ...
35
votes
10answers
11k views

Is anybody using client browser certificates?

Client browser certificates seem to be a nice way to protect sites from intruders - it is impossible to guess and should be harder to steal. Of course, they do not solve all the problems, but they add ...
38
votes
5answers
5k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
1
vote
3answers
49 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
0
votes
2answers
55 views

Converting an intranet site to internet [closed]

We currently have a web application with client sensitive data that is only accessible by the intranet. The management wants to open this to the internet because there will be a need to have other ...
0
votes
0answers
42 views

PHP null byte exploit through cookie [duplicate]

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
2
votes
2answers
178 views

Are there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and FastCGI to create a pseudo-CMS. Are there any kind of security concerns to watch out for within FastCGI itself over a well written bash script (for ...
2
votes
3answers
2k views

Centralized local hosted web based password manager

In our company we have more than 100 employers and everyone use several online applications daily. To access all of this sites they need a password which was now stored very insecurely. so I'm ...
3
votes
3answers
116 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
1
vote
1answer
66 views

Secure WebApp authentication

I know there are many questions about hashing passwords on the client side out there, but none of them, which I found, address my use case. My app will be end-to-end-encrypted and it is not an option ...
0
votes
1answer
83 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
1
vote
1answer
62 views

How can data URLs be exploited?

I found I can upload an avatar using data URL (the one you get by googling some picture and right-clicking on its miniature) by just changing type="file" to type="url". Initially user shouldn't be ...
11
votes
2answers
8k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
63
votes
5answers
9k views

HTTPS web service switched to HTTP. What can go wrong?

I recently visited a website which used to have an HTTPS connection. Now it has just a plain HTTP connection, and the authentication method has changed from user+password to "authenticate with Google ...
0
votes
0answers
76 views

UTF-7 JSON hijacking on Microsoft IE and Edge

After some research, I saw an answer on StackOverflow saying that it's still possible to perform a UTF-7 JSON hijack using Microsoft IE and Edge browsers. If yes how can it be done? I really need an ...
1
vote
1answer
88 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
2
votes
4answers
90 views

Security risks of using MongoDB ID vs a counter in URL? [duplicate]

In my Angular app, I use the MongoDB id in the URLs. Are there any security risks to this? Should I use a counter instead, and then in my DB have some sort of collection that links this counter to ...
2
votes
2answers
175 views

Bug Bounty Methodology for a Newbie

Question: Once I join a bug bounty program and start hunting for bugs on a website, how do I efficiently start looking for bugs? I am very familiar with common vulnerabilities (XSS, sql injection, ...
3
votes
0answers
97 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
1
vote
2answers
134 views

How to rate or review one Java web Application's security

Is there a way to rate or review the security for a Java web application? Except for web scanner or code audit, does it exist a metric/procedure to evaluate the application's security? Also I have ...
3
votes
1answer
100 views

Is it possible for XSS to occur in src attribute?

I'm working on XSS vulnerability and understanding it. I know in following cases cross site script injection happen in Javascript context Inside <script> tag. Inside html tag in event handler ...
1
vote
1answer
62 views

Secure login form from unsecure site

We have two sites, app.company.com and www.company.com. Right now, users are trained only to enter their login credentials on app.company.com. Both sites use SSL. The app.company.com uses CSRF and we ...
8
votes
1answer
240 views

Any way to browse OSVDB?

I've been playing with nikto and I see some vulnerabilities listed in the scan for my dev server. For example, I see osvdb-XXXX, with a short description after it. I am googling this string, osvdb-...
2
votes
3answers
313 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
0
votes
1answer
419 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
5
votes
4answers
306 views

Avoiding direct object references

Say I wanted to avoid exposing a database primary key in a URL; somehow I must encrypt the key, so that the url only exposes elements of an unenumerable cipherspace. What kind of encryption should I ...
3
votes
2answers
132 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
1
vote
0answers
41 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...