An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
3answers
139 views

Does this reflected XSS vulnerability pose any real threat?

I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end). If a user enders something like this: This is ...
5
votes
2answers
541 views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
0
votes
1answer
54 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
20
votes
9answers
2k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
16
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
1
vote
5answers
153 views

Fixing large number of SQLi, XSS, RFI/LFI in a PHP application

I'm working on a website which was built few years ago in PHP and its riddled with vulnerabilities all over the place. Someone has already gained access to the admin panel and we want to secure the ...
2
votes
2answers
120 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
1
vote
1answer
112 views

Is it illegal to publicly reveal security flaws in a service? [closed]

Mainly I'm interested in UK law on this, but I welcome input from any jurisdiction. I discovered flaws in a service that undermined the security of all its user's data. This is a service where users ...
8
votes
3answers
11k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
4
votes
2answers
164 views

Does allowing the <cite> tag create any XSS vulnerabilities?

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag ...
-1
votes
2answers
225 views

After I downloaded Adblock plus on my computer, ads still popped up on youtube? What gives? [closed]

I downloaded Adblock plus on my computer, then went back to youtube (which was playing Vivaldi concertos), and all the ads were yet there. What gives? Is Adblock plus authentic?
84
votes
2answers
47k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
1
vote
0answers
170 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
3
votes
5answers
265 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
0
votes
1answer
204 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
1answer
115 views

Is there a way to report IP addresses scanning for Exploits?

We're currently running a web site using .NET, and I'm using the Elmah package to look at some errors and issues in real time. I've noticed that there are a number of errors in the log from IP ...
71
votes
15answers
7k views

Does an established ssl connection mean a line is really secure

From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
1
vote
1answer
143 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
0
votes
1answer
107 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
2
votes
4answers
989 views

Malicious code in image. Harmful?

In my website, a user can upload his profile picture. After analysis of some pictures, I have found some pictures with malicious PHP code, just like the upload script. As an example, I have found a ...
1
vote
2answers
105 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
14
votes
6answers
3k views

Is showing your IP address in the URL a bad practice?

Someone told me that showing your IP address in a URL (like hxxp://45.67.134.34/default.html) is easier to hack. Is that true? I could trace any domain name and get its IP number as well.
2
votes
1answer
364 views

Using Selenium tool for xss scripts

Ok, so i need to know can Selenium webdriver tool be used for testing xss vulnerabilities and exploits. If its possible, then pleasee provide me with some example or tutorial. Apologizes, if am wrong ...
2
votes
1answer
2k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
0
votes
1answer
101 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
6
votes
1answer
249 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
2
votes
2answers
346 views

Data protection laws and regulation for storing IP addresses for registered users [closed]

I have a website, large amounts of this site can only be accessed if the user logs in. I would like to use the users IP addresses as a means to determine where they are when they access certain pages. ...
7
votes
2answers
1k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
1
vote
1answer
101 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
2
votes
2answers
209 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
2
votes
3answers
562 views

Is there a way to exploit unused GET POST parameters in web application?

So there is an application that accepts some data from the outside. Assuming that it accept only finite number of different POST/GET parameters and the application is correctly handling all the data ...
1
vote
1answer
565 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
0
votes
2answers
128 views

understanding and getting over the SSL performance issue

There are many great articles explaining how SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over HTTPS and the SSL ...
1
vote
2answers
431 views

Why should web applications use multiple gatekeepers?

I have been reading a security checklist for web application design which can be found on: http://msdn.microsoft.com/en-us/library/ff648647.aspx One of the recommendations is to "use multiple ...
1
vote
1answer
110 views

Can anyone explain how to use an X509 client certificate to securely authenticate a user?

Bit of background. Web Application that can generate Pub/Priv Keys and X.509 certificates. How would I make use of the certificate in a web application, username and password login form to provide ...
1
vote
1answer
199 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
0
votes
0answers
39 views

Storing hashed or encrypted password in session? [duplicate]

I need users to be able to encrypt and decrypt without entering their passwords every time. One way is to store the hashed password in session, and use it for encryption and decryption. Problem with ...
0
votes
1answer
82 views

Credit card data [closed]

I want to scan files for is there any credit card information.I searched for find good product. I used this application card recon Is there any similar product like that for find credit data ...
9
votes
4answers
272 views

What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

Also: Is it something that can be achieved with limited funds? I ask because I am intrigued by the obstacles that are in place.
0
votes
1answer
40 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
0
votes
1answer
178 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
1
vote
0answers
81 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
0
votes
1answer
62 views

Security design behind google's application specific password [duplicate]

When using Google's two-step verification with services that can't use it, such as mail clients on smartphones and desktops, the solution is to create application-specific passwords for those ...
4
votes
2answers
495 views

Has there been any documented cases where hackers have hijacked the phone number to a business?

Has there been any cases where hackers have taken over the phone number to a business, by creating a phone number in the same area code, setting up a virtual PBX / Asterisk system, routing all calls ...
0
votes
1answer
279 views

Potential problem in public Maven repository

Problem This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository: http://repo.grails.org/grails/simple/codehaus-cache/com/ If you ...
0
votes
1answer
59 views

Is it reasonable to use a security proxy when integrating two web applications?

Background: We're in the process of integrating two web applications. The other one, application A, is a publicly accessible Internet service, which is provided by a third party and which offers Web ...
3
votes
2answers
218 views

Risks for a new type of website login feature

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a ...
14
votes
4answers
3k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
1
vote
2answers
65 views

Preventing interaction among web application on a shared hosting account

I have multiple web application installed in separeted directories in a shared hosting account. My worry is if one application get hacked, attacker can use it to attack other applications too. So, My ...
0
votes
2answers
286 views

Is SSL a mitigating factor for HTTPonly not set on cookies?

I have a few sites that are using HTTPS (no mixed mode HTTPS/HTTP). The cookies do not have a HTTPOnly flag set. They do pass along session IDs. Also some of the sites do not have a "Secure"flag set ...