An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
5answers
1k views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
3
votes
1answer
86 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
2
votes
0answers
45 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
1
vote
0answers
48 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
8
votes
2answers
724 views

Using optical illusions as CAPTCHA

Would using the "flaws" in human perception of an optical illusion graphic allow a system to differentiate between humans and machines (using these pictures like a CAPTCHA)? Some examples are where a ...
41
votes
6answers
17k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
2
votes
0answers
27 views

Continuous integration SaaS security considerations

How do CI SaaS products protect themselves from bad actors? When a CI server builds and tests arbitrary code, how can we be sure this code is not some sort of exploit? Are CI companies like Travis ...
4
votes
2answers
84 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
4
votes
1answer
41 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
3
votes
3answers
97 views

What are the security risks of importing and processing an excel spreadsheet from an untrusted user

I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the ...
1
vote
3answers
4k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
21
votes
4answers
4k views

Keylogger web application protection

I'm trying to improve security in a web application. The application has an admin site and keyloggers are a concern that I'm trying to solve. Can the application do something that can prevent ...
3
votes
1answer
89 views

Hosting multiple websites securely

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
2
votes
2answers
155 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
9
votes
1answer
147 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
1
vote
0answers
46 views

User Agents in e-mail Headers

I received a COX e-mail generated on a Surface tablet. The User Agent was exactly what I expected it to be: Mozilla/5.0(Windows NT 10.0 ETC. Then I received an AOL email with User Agent: JAS STD. I ...
0
votes
3answers
235 views

Best practice of Secret Question/Answer

I'm building a web application and I'm actually writing a code that allows users to choose their secret question and answer used to identify them if they forget their passwords. I'm a little bit ...
1
vote
1answer
76 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
12
votes
4answers
10k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. In the words of ...
2
votes
1answer
53 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
1
vote
4answers
285 views

Fraud detection to avoid fake users

I know there is no 100% solution for fraud detection, but at least I want to set some level of confidence in this use case. Suppose that I have a system where: A user need to make a registration A ...
2
votes
1answer
189 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
4
votes
2answers
212 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
1
vote
1answer
74 views

How to avoid abuse of web-server endpoint from a rogue client?

I realized that once a user logs into the application and receives an Auth token there is the potential that they could use that token along with a rogue client to exploit an endpoint that they now ...
3
votes
1answer
43 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to white list all the APIs and static resources of an application. Although from the security ...
4
votes
1answer
335 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
3answers
109 views

Where to find about web application vulnerabilities' history? [closed]

There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, ...
-1
votes
1answer
124 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
3
votes
2answers
194 views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onlcick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
0
votes
1answer
58 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
5
votes
4answers
533 views

Untrusted signature on java app for downloading youtube, harmful?

If you visit most of the "online youtube download" pages, you will get this message: Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
4
votes
1answer
76 views

Informative error messages in password reset functionality?

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
2
votes
3answers
238 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
3
votes
2answers
139 views

How can i demonstrate remote file inclusion via get methods

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application. Scenario: In my web application RFI works only when the user's ...
1
vote
1answer
93 views

How specifically should I implement CSRF protection?

There are a ton of articles explaining what CSRF is and that I should use a CSRF token to prevent CSRF. A few of them mention details such as using SHA256 over MD5. However, none of them explain how ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
7
votes
6answers
3k views

What does it actually mean when someone says their website is hacked?

I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means. To me the only way to get control of website is get the FTP details....
2
votes
1answer
123 views

What can I do about a malicious site with a similar domain name?

I recently purchased a domain name (lets pretend it was generic.co), I checked to see what site was hosted on the domain close to mine (generic.com). The site loads a fake blue screen of death and ...
15
votes
2answers
1k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
4
votes
4answers
173 views

Why there are so many web servers which get exploited by generating obfuscated files?

TL & DR How do those obfuscated files many users complain on this SE-site about get on their systems? And after that, even more interesting how they get executed? Is this caused by the way php ...
6
votes
3answers
118 views

Is there any concern regarding a database primary key exposure? [duplicate]

Is there any risk if for example I let to end users to know the primary key associated to users in the database?
4
votes
1answer
105 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
3
votes
3answers
686 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
1
vote
0answers
71 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...
0
votes
2answers
69 views

Do you need to know the filename to conduct a Directory traversal

If my websites has a directory traversal vulnerability (linux) and my other php pages have complicated filenames (e.g. efj93ehdsijgdij3g.php), could an attacker still access other files? Or an ...
-1
votes
1answer
78 views

Why does a CDN server need my IP address to let me download a video? [closed]

I used browser developer tools to get the source page of a video from a webpage. When I try to open the full URL containing the video, I see my public ip address is contained in that URL. Changing ...
10
votes
5answers
5k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
0
votes
2answers
162 views

Why can't I test XSS Vulnerability?

I am using DVWA and having trouble executing a simple, reflected XSS vulnerability. Entering the suggested text does not produce a popup in either Firefox or Chrome. Are there any settings that I need ...
12
votes
5answers
2k views

Unknown process on my ubuntu machine communicating over multiple ports with UDP proto

I have a Django web application where the web app and the postgresql database are hosted on two separate Ubuntu-based machines. On my Database machine (and not my web application), if I run sudo ...