An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
2answers
131 views

Securing user's data against an attacker that may gain server root

I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will. A user's secure data should only be visible to her, ...
2
votes
1answer
180 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
1answer
184 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
1
vote
1answer
127 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
4
votes
1answer
163 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
0
votes
2answers
201 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
1
vote
1answer
63 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
3
votes
1answer
193 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
0
votes
0answers
39 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
2
votes
3answers
110 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
2
votes
2answers
461 views

Security concerns with iframes

Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated ...
3
votes
3answers
512 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
4
votes
3answers
309 views

Reflected XSS through cookie value?

I have always looked at reflected XSS as an attack that would take place through a URL. So, for example, you would have a URL like below: ...
8
votes
1answer
499 views

I've discovered a vulnerability which can reveal personal information for multiple websites. How to go about it?

It's not so much a technical vulnerability, but rather a sloppy security practice by a web design consultancy. They use a CMS which they've augmented with an admin login. As it happens, the admin ...
1
vote
1answer
88 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
-1
votes
1answer
102 views

retrieve database data with application server? [closed]

retrieve database data with application server?
2
votes
2answers
349 views

Web Application Vulnerability Scan- False Positives-Recognizing and Eliminating

Web Application Vulnerability and Potential False Positives As a Penetration Tester the application vulnerability scan is a major part of any penetration testing methodology. In the Application ...
0
votes
1answer
65 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...
0
votes
2answers
137 views

How did an attacker spoof (or add to) this myspace's login form?

In the attack detailed here, I see that a hacker has actually added a malicious post link. What I do not understand is how the attacker added it to the actual myspace.comdomain. Obviously this is an ...
1
vote
1answer
613 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
-1
votes
2answers
133 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
1
vote
1answer
214 views

Is XSS prevention only on the frontend enough for JSON services? [duplicate]

We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by ...
1
vote
3answers
193 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
1
vote
1answer
99 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
4
votes
1answer
270 views

How is Cross Site Flashing performed?

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
1
vote
2answers
273 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
-1
votes
1answer
108 views

How strong exactly is a 3gbps booter?

I heard some people talking about how they had a 3 gigabyte per second drddosser. That sounds all fine and dandy, but what can that actually do? Could it take down a website? To what extent?
2
votes
1answer
221 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
5
votes
3answers
1k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
3
votes
1answer
63 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
3
votes
3answers
628 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
1
vote
3answers
244 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
2answers
1k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
1
vote
1answer
107 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
1
vote
1answer
177 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
0
votes
2answers
65 views

Is address information sensitive for companies or individuals during registration?

I am designing a web site that contains external suppliers to register and keep their information with the company up to date. We already have a db with EIN, SSN numbers and their addresses. One of ...
2
votes
2answers
195 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
0
votes
0answers
139 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
4
votes
1answer
109 views

Is limiting access to a web script with .htaccess secure enough when that script can run arbitrary commands?

Okay, so I don't have much HTML experience, but I recently started working on a project with a group of people that involves regularly manipulating files in a web server. I would like to work on this ...
4
votes
1answer
171 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
2
votes
3answers
170 views

Are externally referenced libraries (CDN's) a security issue?

Today I read about an alleged malware attack targeting jQuery.com A german blogger who is what I would call an expert on IT security stated that Any website that is working with ...
-2
votes
1answer
61 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
1
vote
1answer
162 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
-1
votes
2answers
115 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
8
votes
4answers
1k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
1
vote
0answers
112 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
2
votes
1answer
73 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
0
votes
1answer
513 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
3
votes
2answers
348 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?