An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
2answers
84 views

Should it be possible in a good software, using a “Change Password” link for a single user, to try to guess passwords for every user of a Application?

I am having a fight with the "Security Expert" of my team about this very basic question and I need help in getting a good valid argument(s). The pretext is as follows: Should it be possible/valid to ...
3
votes
1answer
136 views

web application extracts uploaded tar files, is it vulnerable?

I have a python based web application running on a linux server, Is the following flow vulnerable? HTTP file upload (regular post from browser) server validates max size before processes the file ...
7
votes
2answers
126 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
3
votes
1answer
26 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
3
votes
5answers
142 views

Is it secure to ship public key with license file?

I've implemented a licensing client and server for our web-applications. Currently there is only one way for licensing an app, user should manually upload the license file using specified form and ...
0
votes
2answers
74 views

How unsecure would I assume old PHP code is? [closed]

We have several websites that are client facing at a very large company. These websites do gather client information. They were written 6-7 years ago, quite possibly using a PHP/mysql code ...
3
votes
3answers
142 views

Is random URL token secure enough for file attachments and other user content? [duplicate]

Lets say we have a hypothetical system where there are various files are added by users and are sensitive, e.g. lets say an attachment to a private message. It's not that easy to verify access rights ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
3
votes
6answers
676 views

Can hackers find secret tokens passed to HTTP GET requests?

I have some code like this in index.php: if(isset($_GET['something'])){ //do something } Can hackers find this and request index.php?something, or is this sufficient for security?
4
votes
2answers
129 views

Can I prevent all employees from accessing customer data without being logged (especially IT)

I am hosting a web application and SQL server database on Azure and I would like to ensure that no individual at the company can access customer data without the access being logged. It seems that ...
4
votes
4answers
540 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
55
votes
7answers
7k views

Are there security advantages gained from forcing a website to be available from just one tab at a time?

I just found that a website of one Polish bank forces the users to open it in one browser tab only. You cannot for example check your transfer history while looking for an account number that you ...
24
votes
1answer
1k views

HTTP HEAD and its security versus operational uses

Most security advice I see recommends turning off HTTP Methods like TRACE, OPTIONS, HEAD etc. So now I have turned off most of these options on my web server and leaving only GET and POST options that ...
9
votes
4answers
6k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
6
votes
3answers
837 views

How can I prevent data scraping on my website? [duplicate]

How can I prevent client software scraping data from my website? Some examples of my URLs are: http://example.com/products.php?q=1 http://example.com/products.php?q=2 ...
8
votes
5answers
3k views

What are potential security risks when using an insecure wireless connection?

If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it pose a threat even if the person is using a secure application layer protocol? What I mean by ...
1
vote
1answer
139 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
0
votes
2answers
157 views

Our users get a trojan horse alert on our site, but we don't. What do we do?

A user of our website got a trojan horse alert when she tried to get to our website. But myself and some other friends got no alert whatsoever and can go on the website and download files without ...
11
votes
3answers
5k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
1
vote
1answer
61 views

Forcing response headers

I'm testing a particular vulnerability box since yesterday and I came with one rather strange problem that I didn't expect. Lets say a vulnerable web-application offer image file upload. The image ...
8
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
7
votes
3answers
2k views

Can we drop XP from HTTPS support? If not, when? [closed]

XP support was dropped by MS on April 8 2014, almost two years ago, but there are still many people who use XP for internet surfing. Also, there are still many sites like Google or Facebook who offer ...
3
votes
3answers
165 views

Does this concept attack work to harvest credentials and 2FA using offline fake site?

My concept is this: Client connects to Malicious\Eviltwin AP Client connects to www.facebook.com but this one is a fake offline site by the fake dns server Client enters user and password ---> ...
1
vote
2answers
92 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
0
votes
1answer
68 views

Mobile apps social Oauth

I need to develop iOS and Android apps that should have to communicate with a server throught RESTfull API. Also I need to register and authorize user throught popular social networks like Facebook, ...
1
vote
2answers
109 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
32
votes
3answers
31k views

How to exploit HTTP Methods

Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack. What do ...
5
votes
1answer
146 views

Detect man-in-the-middle on server side for HTTPS

Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot ...
3
votes
1answer
81 views

Sending a token with a request from one app to another

Say I have an application written in some language and framework (Python + flask, for instance), and have a great deal of the functionality requiring login, and authentication via JWT. Now I want to ...
0
votes
1answer
45 views

Block web content authoring from internet

In implementations where one uses content management, which is the better method to secure the web content authoring pages from access from internet? Configuring httpd.conf to restrict the content ...
1
vote
3answers
141 views

Why limit internet access while connected to a remote desktop?

I work in the nuclear industry, and sometimes we have some strange (but understandable) standards for information security. I have encountered one which seems odd and would like to know the potential ...
3
votes
2answers
99 views

Use password to calculate checksum for API requests

I was wondering if it would be an effective way of securing an API by requiring all requests to be checksummed, salted with the users password (or a hashed version)? With securing I mean making it ...
2
votes
2answers
49 views

If authenticated user tries to access a restricted resource

If a user with authorization to access Resource A, tries to access Resource B (by trying to follow a URL), which of the following is a better course? Take them to a standard Access Denied Page, with ...
4
votes
1answer
198 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
1
vote
0answers
103 views

Approach for testing xxe injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did : intercepted traffic using burp changed the request with ...
9
votes
2answers
2k views

When viewing my website from port 3306, I see some weird MySQL info

If I visit my web URL and force port 3306 (MySQL), I see a suspicious looking web page: Is this exposing any vulnerabilities for me? Should I block port 3306?
1
vote
1answer
62 views

Executing XSS payload when “http” is added to payload

I have a context where every special characters are escaped properly except ':' &'/'. The output is reflected inside <a href="payload" tag. 1 )When I set payload to javascript:alert()(which ...
0
votes
3answers
111 views

How secure is a server's .htaccess file?

Would access need to be gained to the server in question or can an .htaccess file leak information in some way?
1
vote
2answers
17k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
-2
votes
1answer
104 views

Web application security vulnerability managment [closed]

Does anyone know of a way to manage Web application security vulnerabilities? Im looking for a tool that might integrate with selenium and or burp. I'm want to be able to run the tests over and over. ...
4
votes
1answer
38 views

CSRF issues in “stateless” web app?

So I have developed a web application, which also has an API. API supports both GET and POST requests. The API is completely stateless, means nothing is stored or modified in a database/file when ...
3
votes
1answer
112 views

Security of Web Game over WebSockets?

Project that I'm working on depends on WebSockets to communicate between the server and client browser for all interactions within the game. I'm attending university for Computer Security, but I'm ...
1
vote
1answer
74 views

Usablity vs security malicious file upload

We were designing a web application which has the functionality similar to vulnerability management, our web application functionality can be briefed as follows: There is a panel where one can ...
24
votes
1answer
25k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
10
votes
4answers
9k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
5
votes
5answers
266 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step ...
44
votes
6answers
10k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
21
votes
4answers
23k views

How to hijack a session?

Despite the blatant title of the question, this is actually for a genuine purpose. My site uses PHP code like this: $select="select id from tableA where user_id='".$_SESSION['sess_user_id']."'"; ...
-4
votes
1answer
42 views

Testing a Developed Web application - any tips? [closed]

I developed a web application mostly in PHP and JavaScript with a bit of AJAX. I do not have pentesting experience, but I like to try a few tools like sqlmap on it to see if I have any flaws in my ...
4
votes
3answers
8k views

What are the main differences between the network-level and the application-level regarding information security?

I'm fresh new to the field of security, so I'm sorry if this question seems stupid to you. What are the main differences between the network-level and the application-level regarding information ...