An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
4answers
302 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
4
votes
3answers
396 views

Static code review approach

My questions is related with static code analysis approach used by Veracode vs Fortify/AppScan. Veracode – Finds security flaws in application binaries and bytecode without requiring source ...
2
votes
3answers
148 views

Separate log-in panel for administrators?

I have a dispute with my father about the following ... I want to make a website (with MySql database) and use the root/index - page for BOTH the log in entry for normal visitors AND log in for ...
11
votes
4answers
955 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
10
votes
4answers
3k views

Authenticating without a database

I've been inspired by a question over on Code Review, which boils down to: What is the proper way to authenticate a user without a database? Would it be the exact same process if you stored ...
4
votes
1answer
293 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
3
votes
3answers
427 views

How to store passwords securely in my server?

Disclaimer: I know I should use bcrypt to securely store user's passwords. Please, keep reading. I want to store credentials for several email services for each user. So if I log in with my username ...
5
votes
3answers
619 views

Can allowing a web application to move, copy and/or delete files outside of the server root be a security issue?

I am new at using and programming web applications, so I wanted to ask a question. Is it safe to execute os commands like copy and mv and delete from a web app that is running on an apache, or does it ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...
4
votes
2answers
170 views

You've just acquired a newly created CentOS server, what should you do to secure it?

I've just acquired a new CentOS server, which will be hosting a Ruby on rails application, it is public facing. What should I do to secure this server?
1
vote
1answer
152 views

Theoretical home grown password options, or what is it that SCrypt, BCrypt, PBKDF2 does that is so special?

I'm developing a personal web framework, nothing internetty, and probably not even anything that will ever go on my personal LAN. And looking for password advice people seem to only recommend those ...
0
votes
1answer
79 views

Security of starbucks gift card redemption feature

Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists. Clicking the redemption ...
0
votes
1answer
51 views

How should I validate an API key for a web service deployed via iframe?

I'm working on a small web service that provides some functionality that can be embedded in a web page with an iframe. As this is a subscription-based service, I'd like to be able to manage who can ...
0
votes
1answer
148 views

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here http://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
1
vote
2answers
89 views

In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?

I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight). ...
5
votes
5answers
268 views

Is sending plain passwords over SSL as part of a password update process bad?

The Web application I'm working on is 100% SSL secured (or rather TLS as it is called today...). The application recently has been audited by a security company. I mostly agree with their results but ...
2
votes
2answers
2k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
5
votes
3answers
190 views

Separation of secure login steps

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits ...
2
votes
3answers
2k views

How to block the websites on client machines

In our office we are blocking sites like Facebook, Twitter etc.The problem is that some of the users bypass our proxy and firewalls through external proxy sites like www.youhide.com or ...
11
votes
6answers
6k views

Why are iframes allowed at all in modern browsers?

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
2
votes
2answers
528 views

Protecting hidden form fields

The scenario is as follows: An application has a web interface through which data can be configured. The data to consider for this question is Users with a many-to-many relationship with Groups. ...
40
votes
4answers
10k views

Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password ...
0
votes
1answer
76 views

How do I secure “Data at Rest” only allowing Service API to access it from a mobile application

How do I secure data at rest from unauthorized access, but still allowing my application to access the data using user authentication over HTTPS? My scenario is as follows: Login to application ...
0
votes
1answer
60 views

When is it appropriate to provide clickjacking protection one of my websites pages?

I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on ...
0
votes
0answers
280 views

Socket.IO & WebSocket security - query certifcate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
0
votes
1answer
433 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
1answer
85 views

Beating CSRF using Tokens

I am new to web programming. I read an article where they advised to use tokens as a hidden field in forms and match that token at the server end to detect non-legitimate requests. I am wondering what ...
0
votes
5answers
260 views

Are all URL shorteners unsecure/vulnerable?

The OWASP state that open redirect is a vulnerability: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This ...
3
votes
3answers
132 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
1
vote
1answer
129 views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
2
votes
1answer
214 views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites ...
3
votes
5answers
1k views

referrer checking as a defence for XSS attack

After reading the question about referrer and the answer of @D.W., I did not understand the following part: XSS defense. Strict referer checking can make reflective XSS attacks harder, because ...
1
vote
1answer
480 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
3answers
616 views

What is the most secure way to set up web server user permissions? [closed]

The default Debian way of setting up a common web server (Nginx) is to run the main process as root and unprivileged workers as www-data. In order to allow for the worker processes to read/execute web ...
0
votes
1answer
51 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
31
votes
7answers
2k views

Is there a difference between GET and POST for web application security?

I have 2 choices in sending data between 2 web applications. I encode the data in Base64 and append to the URL and retrieve these parameters at my destination application and decode the parameters. ...
1
vote
3answers
1k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
2
votes
2answers
355 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
12
votes
7answers
1k views

Where to start with security testing?

Starting with a QA team that deals mainly with functional requirements testing and has little real security testing experience, what simple practical things should the QA team start doing to start ...
22
votes
11answers
8k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
10
votes
1answer
1k views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
2
votes
3answers
119 views

Multi-factor auth: implementing a “don't ask again for this computer” function

Many sites that support multi-factor authentication provide a "do not ask me again for this computer" option. I'm hoping to gain some insight into how this feature could best be implemented. My ...
0
votes
0answers
35 views

Best practices concerning pushing user registrations

Imagine an organization which possesses a lot of personal customer data in their internal databases. This organization creates a web application, and wishes to be able to send a registration link to ...
3
votes
4answers
307 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
1
vote
1answer
203 views

Path Truncation not working in PHP while exploiting LFI

From what I understand in PHP '/etc/passwd/' or '/etc/passwd/./././' should be treated just the same as '/etc/passwd' I am using PHP 5.4 and this does not seem to be true: php -r ...
2
votes
1answer
296 views

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

What I know about CSRF is that a malicious website tricks a normal user into issuing a request to a trusted website using a form. I understand that is possible because we can post forms to different ...
2
votes
3answers
10k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
1
vote
1answer
438 views

How to handle private key encryption/decryption for web application

In the process of designing a web app that handles public/private key pairs - a Bitcoin web app, specifically - I've had a lot of thought on how to securely handle the storage of the private key, ...
1
vote
2answers
296 views

I can upload any file to an ASP webapp/IIS server but I do not know where (which folder), is this exploitable?

I'm able to upload any file to an ASP webapp/IIS server. My first though is to upload an ASP shell but I don't know where the file has been uploaded. I have written a Python script that beggining ...
1
vote
1answer
51 views

Resources for reviewing multi-tiered webabbs in Spring, Hibernate or JAX-WS

I need some pointers to any resources (videos from any conferences or general videos, pdf, anything) for secure source code reviewing of multi-tiered web-apps in JAX-WS, Spring or Hibernate. I am ...