An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

1
vote
2answers
104 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
1
vote
3answers
128 views

Where can I find a list of frowned upon usernames for web sites?

There are some usernames that shouldn't be allowed to register on online services, for example: administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin As far as ...
1
vote
5answers
135 views

Reply to email or text as verification?

I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
1
vote
3answers
319 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
1
vote
3answers
103 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
1
vote
1answer
487 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
0
votes
2answers
98 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
2
votes
1answer
893 views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
2
votes
0answers
170 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
1
vote
2answers
86 views

Need explanation on local file inclusion?

So few days ago a friend fixed an lfi on his site , and he sent me the url used , it was base 64 encoded url but not usual ../../../etc/passwd , It is : Li4vLi4vZXRjL3Bhc3N3ZAAucG5n Now decoded on ...
9
votes
1answer
538 views

XSS Technique - & JavaScript Include

I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me: & JavaScript includes <BR SIZE="&{alert('XSS')}"> I ...
0
votes
2answers
574 views

What kind of attacks can happen on port 80

I am a novice to network security domain. For one of our clients, we are trying propose a network model where an Apache proxy/web-server which will be the only one that is exposed into the ...
1
vote
5answers
258 views

Why after a website password reset am I asked to login again?

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
-2
votes
3answers
692 views

How to identify if my site is vulnerable to DOS/DDOS attacks? [closed]

I am hosting a site on a hosting server. How to identify whether my site is vulnerable to DOS/DDOS attacks?
1
vote
3answers
243 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
0
votes
0answers
92 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...
0
votes
2answers
82 views

What methods can be used to verify identity against a database?

I have a database with individual contact data for students... this data includes name, address, phone number, birthdate, etc. (no social... that would have made this too easy apparently, ha ha) I ...
0
votes
2answers
170 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
0
votes
1answer
183 views

How were hackers able to alter the text of my pages without a form or querystring?

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend. Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. ...
-1
votes
2answers
106 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
0
votes
0answers
46 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
0
votes
2answers
189 views

How to ensure that only my single page app can make requests to an API

I have a REST API that can potentially serve multiple web clients. I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this? ...
1
vote
2answers
124 views

Database compromised and some passwords cracked

I run an MMORPG game and today while moving from one server to another, apache failed and listed some of the data on the server including a back-up of all the source code + database which a few people ...
3
votes
1answer
187 views

How can I avoid Canvas Fingerprinting?

Canvas Fingerprinting has been getting a lot of press these last few days. Here is a study I read on this topic: 1 and 2 What can I do to keep browsing anonymously and avoid this tracking method?
1
vote
0answers
77 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
-2
votes
1answer
74 views

protect files on webserver, allow only internal use

I have a website and it has an audio player to play music files, the music files are hosted in a public directory. Since they are they anyome can point there and use the files on their website. Is ...
-1
votes
2answers
134 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
2
votes
3answers
480 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that allows for secure messaging. In part ...
4
votes
1answer
2k views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
0
votes
2answers
76 views

How to securely serve client-side-only web content to mobile with convenience?

For a cryptocurrency client implementation, I am serving a single page webapp to mobile clients. It is a client-side-only page. I would like to serve this page to clients, but I fear tampering by ...
1
vote
1answer
73 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
4
votes
5answers
344 views

Should I add protections where I dont understand how hacker can break system?

Lets say there is an AJAX application where the user can submit items - buy them. And there was a code IF ($_POST[items] > 20) { echo 'error'; } else { do_buy($_POST[items]); echo ...
0
votes
1answer
150 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
0
votes
1answer
140 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
1
vote
0answers
42 views

Steps for creating a test environment where GUIDs are exploitable?

I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not ...
3
votes
2answers
275 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
3
votes
2answers
930 views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
0
votes
1answer
56 views

Does ASP.NET guarantee the integrity of a page's controls on a post back?

Say you have an ASP.NET page that lists the prices for certain items in labels. I know it's cringe-worthy, but say you took the price of the item from the label on the page to determine what the user ...
1
vote
2answers
116 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
2
votes
1answer
177 views

Is this a bot fishing for security vulnerabilities on my site?

I am running a webpage for my family with a feature to track users and guests. Since its all just family stuff no one ever visits this server, and I hardly see more than 2-3 of us logged on at the ...
0
votes
1answer
105 views

benefits of xinetd for a web server

What are the pros and cons of using xinetd for a web server running on a VPS. Assume the following measures have already been taken to secure the system: system hardening, latest updates, minimal ...
1
vote
0answers
112 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
0
votes
1answer
159 views

Securing user postal address in a database?

I've been assigned a web project that deals with shipping goods between two parties. I am unsure what a secure database scheme (if any) would be for storing the recipient's postal address and whether ...
7
votes
2answers
1k views

Is this an XSS vulnerability?

My company recently had a security assessment done on our website and we had a XSS vulnerability reported. Below are the details of the reported vulnerability: If a user hits a URL like the one ...
0
votes
1answer
224 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
4
votes
2answers
166 views

How can I enable opportunistic encryption for my web-site?

As per an honourable mention in an answer for « Why self-signed https is less trustworthy than unencrypted http? », it appears that there are already two post-Snowden drafts that have to ...
3
votes
2answers
282 views

Learning XSS: Why is my javascript ignored?

<a href='mailto:</a><script>/*'></a><script>/*</a>: <br> <hr> <a href='mailto:*/location.href=/*'>*/location.href=/*</a>: <br> ...
3
votes
4answers
351 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
1
vote
1answer
234 views

SQL truncation vulnerability

I came to know the SQL truncation vulnerability that I wasn't aware of. It is my understanding that this vulnerability is based on the fact that MySQL truncates the value of an "insert query" whether ...
2
votes
3answers
240 views

Separate log-in panel for administrators?

I have a dispute with my father about the following ... I want to make a website (with MySql database) and use the root/index - page for BOTH the log in entry for normal visitors AND log in for ...