An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

55
votes
7answers
7k views

Are there security advantages gained from forcing a website to be available from just one tab at a time?

I just found that a website of one Polish bank forces the users to open it in one browser tab only. You cannot for example check your transfer history while looking for an account number that you ...
24
votes
1answer
1k views

HTTP HEAD and its security versus operational uses

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that ...
9
votes
4answers
6k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
6
votes
3answers
711 views

How can I prevent data scraping on my website? [duplicate]

How can I prevent client software scraping data from my website? Some examples of my URLs are: http://example.com/products.php?q=1 http://example.com/products.php?q=2 ...
7
votes
5answers
3k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
1
vote
1answer
130 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
0
votes
2answers
155 views

Our users get a trojan horse alert on our site, but we don't. What do we do?

A user of our website got a trojan horse alert when she tried to get to our website. But myself and some other friends got no alert whatsoever and can go on the website and download files without ...
11
votes
3answers
5k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
1
vote
1answer
59 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
8
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
7
votes
3answers
2k views

Can we drop XP from HTTPS support? If not, when? [closed]

XP support was dropped by MS on April 8 2014, almost two years ago, but there are still many people who use XP for internet surfing. Also, there are still many sites like Google or Facebook who offer ...
3
votes
3answers
157 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
1
vote
2answers
90 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
0
votes
1answer
67 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
1
vote
2answers
104 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
32
votes
3answers
30k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
5
votes
1answer
121 views

Detect man-in-the-middle on server side for HTTPS

Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot ...
3
votes
1answer
66 views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
0
votes
1answer
45 views

Block web content authoring from internet

In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet? Configuring httpd.conf to restrict the content ...
1
vote
3answers
122 views

Why limit internet access while connected to a remote desktop?

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential ...
3
votes
2answers
85 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
2
votes
2answers
49 views

If authenticated user tries to access a restricted resource

If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course? Take them to a standard Access Denied Page, with ...
4
votes
1answer
161 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
1
vote
0answers
77 views

Approach for testing xxe injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did : intercepted traffic using burp changed the request with ...
9
votes
2answers
2k views

When viewing my website from port 3306, I see some weird MySQL info

If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page: Is this exposing any vulnerabilities for me? Should I block port 3306?
1
vote
1answer
56 views

Executing XSS payload when “http” is added to payload

I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag. 1 )When I set payload to javascript:alert()(which ...
0
votes
3answers
107 views

How secure is a server's .htaccess file?

Would access need to be gained to the server in question or can an .htaccess file leak information in some way?
1
vote
2answers
16k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
-2
votes
1answer
94 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
4
votes
1answer
38 views

CSRF issues in “stateless” web app?

So I have developed a web application, which also has an API. API supports both GET and POST requests. The API is completely stateless, means nothing is stored or modified in a database/file when ...
3
votes
1answer
108 views

Security of Web Game over WebSockets?

Project that I'm working on depends on WebSockets to communicate between the server and client browser for all interactions within the game. I'm attending university for Computer Security, but I'm ...
1
vote
1answer
71 views

Usablity vs security malicious file upload

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows: There is a panel where one can ...
24
votes
1answer
24k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
10
votes
4answers
9k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
4
votes
5answers
247 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step ...
43
votes
6answers
10k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
21
votes
4answers
22k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
-4
votes
1answer
40 views

Testing a Developed Web application - any tips? [closed]

I developed a web application mostly in PHP and JavaScript with a bit of AJAX. I do not have pentesting experience, but I like to try a few tools like sqlmap on it to see if I have any flaws in my ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...
-1
votes
2answers
38 views

How secure are ActiveX based security plug-ins?

Sometimes I have to use web sites that use ActiveX security plug-ins. The websites say that these plug-ins 1. secure the authenticity of printable certificates 2. secure overall data sent back and ...
1
vote
0answers
546 views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
3
votes
1answer
226 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
6
votes
2answers
105 views

If an RSS feed handles quotes and HTML tags incorrectly, can it be considered a security risk?

I'm trying to encourage an organization to fix their RSS feed, which has numerous problems with the way quotes and tags in the source text are displayed in feed readers. I'd like to be able to tell ...
8
votes
4answers
785 views

When paying for something on line, is paying with a checking account less risky than paying with a credit card?

If I purchase something on line and am given the choice to pay with a checking account (also known as a current account) or a credit card, is the risk of my checking account data being stolen and used ...
2
votes
1answer
1k views

folder and file permission shared host advice

I have a website with a webhost company. I wrote a little php/mysql application - no file uploads, just administering data from the DB and creating pdf with TCPDF. There are folders like css and js ...
1
vote
3answers
167 views

Multiple types of tracking

In a system where I have reviews of products, to avoid fake reviews I have thought about doing the following: Limit one review for each account -> To bypass this measure, the user could create ...
6
votes
2answers
238 views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., jscodehere ...
-3
votes
1answer
1k views

Alternative ways to exploit this path traversal

I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files: ...
3
votes
3answers
128 views

Is it safe for web application to receive and parse emails?

I am not sure, if this question needs to be narrowed down to web applications only, but that is my particular interest. Suppose a web application receives (retrieves from mailbox) emails, parses the ...
1
vote
1answer
84 views

Secure communication between two REST apis

I'm building an application which stands alone for the most part, but which needs to access another system for private user data. What is a simple and safe method of securing that private data? We ...