An application that is accessed over a network such as the Internet or an intranet using a browser.
2
votes
1answer
82 views
Quick Security Mitigations to Impending attacks
Suppose you are the sysadmin, and you know of an impending attack that just started or about to start soon. You can either wait it out, or try a few tricks and quick mitigation to fend off attackers ...
2
votes
1answer
169 views
Good tools for reverse engineering colaboratively?
Does anybody know a good set of tools for doing reverse engineering of binaries in a collaborative way?. My original idea is to disassemble a binary, allowing to add information about functions, ...
0
votes
1answer
151 views
Generating Web Application Security Profile
Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. ...
3
votes
4answers
88 views
What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)
When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
1
vote
1answer
46 views
Safely transfer UserID among different Subdomains
Scenario :
Application a.mydomain.com redirects its users to application b.mydomain.com for Account Creation.
b.mydomain.com creates the account, and redirects the user back to a.mydomain.com with ...
1
vote
3answers
145 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
1
vote
2answers
152 views
Breaking out of attribute in double quotes
I have a piece of code that allows for
[url]someurl[/url]
BB-Code and replaces it with
<a href="someurl">someurl</a>
It takes two precautions to prevent XSS.
It replaces ...
1
vote
2answers
76 views
Bad transactions in an e-commerce system?
I read an article signifyd-raises-2m-from-andreessen-horowitz-to-help-online-businesses-use-data-to-prevent-payments-fraud which talks about a service that pulls together data to screen the ...
1
vote
1answer
92 views
What does key, key pair and signature mean here?
I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with:
X.509 certificates can be used for servers, clients, email, code signing and more
...
-7
votes
2answers
91 views
What are the vulnerabilities of a social network ? (I would like to create one myself) [closed]
I am currently enrolling in a computer science class, however haven't learned about databases or security on the internet in general. I have had a lot of programming and database experience before ...
1
vote
2answers
245 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
0
votes
0answers
68 views
Client Side Negotiation
I have -MultiViews set and SSLInsecureNegotation off ( in ifmodule of mod_ssl.c) in Apache.
But still vulnerability report says I am vulnerable to client side renegotiation and "This server is ...
1
vote
4answers
965 views
Playing with Referrer Header
There are 2 sites:
http://www.site1.com
http://www.site2.com
http://www.site1.com contains link to http://www.site2.com as
<a href="http://www.site2.com/">link<a/>
When user clicks ...
5
votes
3answers
249 views
CSRF Countermeasures
I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
6
votes
3answers
285 views
What sort of delay will deter a robot from crawling my site?
I use what I believe is the standard method of identifying bad bots that do not respect my robots.txt (i.e. disallowing crawling the bad-bots subdirectory, then logging those who still go there).
So ...
2
votes
2answers
228 views
How can I trace Hacking attempt
First of all I dont want to track the hacker. I want to track if the system is being compromised some way. For example when a website is under attack it'll receive malicious data. I want to check ...
1
vote
3answers
133 views
Web Application - Cookie Expiry
We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
5
votes
6answers
674 views
What does it actually mean when someone says their website is hacked?
I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means.
To me the only way to get control of website is get the FTP ...
-1
votes
3answers
207 views
Unable to secure my site [closed]
I am php developer. I have enabled Captcha and CSRF tokens but still some one is inserting random values in my database. Please give me an idea about how anyone can insert junk values in my database ...
0
votes
2answers
172 views
Is this code vulnerable?
I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code?
<?php
if(isset($_SESSION['id'])){
// get data ...
1
vote
1answer
628 views
Wifi login redirect applications
This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
11
votes
3answers
292 views
What does a HTML filter need to do, to protect against SVG attacks?
I recently learned that SVG (Scalable Vector Graphics) images introduce a number of opportunities for subtle attacks on the web. (See paper below.) While SVG images may look like an image, the file ...
1
vote
1answer
75 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
2answers
114 views
How do I holistically protect a web service from network and MITM attacks?
I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
-4
votes
1answer
425 views
Best free website vulnerability scanners [closed]
I need to check web security and vulnerability in my web application. Whatever free vulnerability scanners application or vulnerability scan online site's are available?
4
votes
4answers
419 views
Why Do we Need CAPTCHA? In what case we should use it?
In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
-1
votes
2answers
108 views
Secure risks of online chat for customer service
Some merchants provide the ability to chat over the web for customer service or help.
Are there any risks in using these online chat channels? If so, what are the primary risks? Can the chat ...
0
votes
2answers
184 views
How to restrict web access to certain countries
What are the better ways of filtering access to the web application based on Geographical location. Is it possible with a network layer firewall or we need an application layer?
2
votes
2answers
327 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
0
votes
1answer
218 views
How I add cookie to w3af for authenticated attacks?
Can anyone explain this in steps to me?
Lets just say I clicked to OWASP Top 10 scan profile and entered url.
Next I need to add cookies or authentication values to w3af (form based auth.).
How?
...
10
votes
1answer
369 views
How can I embed iframe securely without restricting its functionality?
I'd want to embed an iframe from untrusted site into web application. Iframe:
should be able to run Javascript and browser plugins (Flash, etc.)
should not be able to access my web application ...
3
votes
1answer
107 views
How can I use certificates to secure my webservices? What is available to javascript?
I have a few web services that are accessed over public wifi connections and I think it would be a good idea to issue certificates to encrypt data, prevent MITM, and invalid impersonation (beyond what ...
-2
votes
1answer
234 views
Nessus does not detect sql injection with “Web App Tests” [closed]
In my website I have an sql injection vulnerability.
But when I scan my website with Nessus under "Web app tests" there is no result on sql injection.
Why is this? What should I do to make this ...
6
votes
1answer
156 views
What responsibility do I have in continuing another developer's work?
My question is related to this one. I did not found anything googling around and that is why I am asking.
This question
I am the sole web developer for a firm, and I manage everything, from ...
0
votes
2answers
163 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
1
vote
3answers
155 views
How this kind of mechanism considered as vulnerability?
From following news, http://thehackernews.com/2012/12/etsy-for-iphone-loophole-allows.html
Someone just setup a proxy to intercept traffic between browser and https protocol, then it called ...
3
votes
2answers
121 views
Proxying a Credit Card Transaction?
Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into ...
3
votes
2answers
189 views
Is there a site like plaintextoffenders.com that shames companies that force insecure passwords?
I recently came across http://plaintextoffenders.com/ and I liked the idea. I wondered if there was a similar site that shames websites that force insecure passwords?
I personally have a list of a ...
1
vote
2answers
152 views
Authentication without saving password
Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
0
votes
3answers
102 views
Does including decorative HTTP headers into server reply pose extra security risk?
Suppose I reconfigure my HTTP server to add the following HTTP header into every reply:
X-Hello: Hello!
or some other presumably funny text.
Can this have any negative effect on the server ...
6
votes
4answers
356 views
Banking application login leaks information
My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
User visits the homepage of the bank.
User ...
11
votes
4answers
1k views
How to know which database is behind a web application?
I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections.
When attacker try to perform a database attack ...
1
vote
0answers
68 views
Are there any case studies for a large (think Twitter or Facebook) Web application vulvnerability so severe it caused a total shutdown of services? [closed]
I'm looking for either a case study, or an article from a news source that discusses the vulnerability and methods for recoverability.
3
votes
1answer
169 views
How did the Tumblr worm spread?
Recently Tumblr was hit by a fast-spreading worm.
How did the worm work? What was the vulnerability in Tumblr that it exploired? Did it exploit a XSS vulnerability in Tumblr? A CSRF vulnerability ...
1
vote
1answer
140 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
6
votes
1answer
3k views
Why is it so hard to close onion domains (e.g. The Silkroad)?
A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor)
For those who do not know what Tor is and who do not want to waste their time ...
2
votes
1answer
144 views
Possible to execute a non-persistent XSS attack without using the url/query string?
I've been reading up on non-persistent XSS and all of the examples I have found use the situation where a webpage takes something from the url/query string and places it on the page.
Is there any ...
2
votes
1answer
135 views
Updated list of bad/overused passwords [closed]
I am building a website, and I'd like to make sure the users don't put an overused password like password or password1.. or any of these
Is there a place that constantly analyzes hacked websites ...
0
votes
3answers
89 views
Does AV software protect web applications (Twitter, Facebook, etc) from attacks? (CSRF, etc)
Is it correct to say that AV software focuses on downloaded executables and locally malicious activity, and it doesn't actively scan HTTP/S content for web based attacks such as CSRF, XSS, phishing ...
1
vote
1answer
128 views
Is there formal guidance that requires all sessions to be logged off when a user changes their password?
Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active.
Is ...
