Tagged Questions

An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
2answers
195 views

SQL injection: real escape string function

example4.php?id=id=2-1 I came across the above injection and I can not figure out why(how) does this work and what's interesting is it returns all the records from the database. Anything guys? ...
0
votes
1answer
183 views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
1
vote
1answer
119 views

Web Application Authentication Using Computer Properties

Introduction: I am in the process of building a web-based game that requires user authentication. The vast majority of other gaming sites utilize the typical username/password method for ...
0
votes
1answer
85 views

Is a properly configured server secure against unauthorized data access?

Take for example a game. Typically, when you buy or download a game that can be played offline, all of the data required to run the game is shipped with the executable. In order to protect these ...
1
vote
1answer
159 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
2
votes
4answers
459 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
1
vote
3answers
54 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
1
vote
2answers
126 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
0
votes
3answers
166 views

Does this reflected XSS vulnerability pose any real threat?

I have a web site where users can enter some text into a textbox and that text is immediately rendered in a div using javascript (strictly front end). If a user enders something like this: This is ...
0
votes
1answer
57 views

Handling passwords in wicket

I have a form which contains a password field. In swing the getPassword() method returns a character array. After the password has been processed by my web application the array can be wiped to ...
1
vote
0answers
190 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
1
vote
5answers
190 views

Fixing large number of SQLi, XSS, RFI/LFI in a PHP application

I'm working on a website which was built few years ago in PHP and its riddled with vulnerabilities all over the place. Someone has already gained access to the admin panel and we want to secure the ...
7
votes
1answer
99 views

What are the implications of publicizing a consumer secret for sharing between developers doing local website development?

In relation to this GitHub issue on the Gittip project (which turned out to be a false alarm), what are the security implications, if any, of hardcoding into the git repo a test app's OAuth consumer ...
1
vote
1answer
120 views

Is it illegal to publicly reveal security flaws in a service? [closed]

Mainly I'm interested in UK law on this, but I welcome input from any jurisdiction. I discovered flaws in a service that undermined the security of all its user's data. This is a service where users ...
2
votes
3answers
168 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
4
votes
4answers
470 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
-1
votes
2answers
460 views

After I downloaded Adblock plus on my computer, ads still popped up on youtube? What gives? [closed]

I downloaded Adblock plus on my computer, then went back to youtube (which was playing Vivaldi concertos), and all the ads were yet there. What gives? Is Adblock plus authentic?
1
vote
0answers
207 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
2answers
1k views

IIS Host Header Attacks

Is IIS and ASP vulnerable to the same Host Header Attacks we have seen on Apache and Nginx? Specifically the attacks that use the HTTP Host Header to reset a password or implement web-cache poisoning. ...
2
votes
5answers
341 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
0
votes
1answer
285 views

501 Not Implemented ServerInfo.jsp

I looked at my logs from amazon ec2 instance and found the following lines: 94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-" 94.177.121.102 ...
2
votes
1answer
121 views

Is there a way to report IP addresses scanning for Exploits?

We're currently running a web site using .NET, and I'm using the Elmah package to look at some errors and issues in real time. I've noticed that there are a number of errors in the log from IP ...
0
votes
1answer
126 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
1
vote
1answer
151 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
2
votes
4answers
2k views

Malicious code in image. Harmful?

In my website, a user can upload his profile picture. After analysis of some pictures, I have found some pictures with malicious PHP code, just like the upload script. As an example, I have found a ...
1
vote
2answers
107 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
2
votes
2answers
318 views

How do I Mitigate Directory Traversal when User-Supplied Input is a Mandatory Business Case?

I have an instance where we have an application that requires the ability to set up sftp commands that are specified by administrative users. They are configured through the front-end of the ...
21
votes
9answers
2k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
1
vote
1answer
124 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
2
votes
1answer
3k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
6
votes
1answer
262 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
5
votes
3answers
190 views

Separation of secure login steps

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits ...
4
votes
2answers
170 views

Does allowing the <cite> tag create any XSS vulnerabilities?

Backstory: Stack Exchange's markdown parser allows a couple of HTML tags (a,b,i,img) through, with some restrictions on the attributes to prevent XSS. We're thinking of requesting the <cite> tag ...
1
vote
1answer
132 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
3
votes
2answers
251 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
2
votes
3answers
613 views

Is there a way to exploit unused GET POST parameters in web application?

So there is an application that accepts some data from the outside. Assuming that it accept only finite number of different POST/GET parameters and the application is correctly handling all the data ...
0
votes
2answers
177 views

understanding and getting over the SSL performance issue

There are many great articles explaining how SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over HTTPS and the SSL ...
1
vote
1answer
754 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
1answer
158 views

Can anyone explain how to use an X509 client certificate to securely authenticate a user?

Bit of background. Web Application that can generate Pub/Priv Keys and X.509 certificates. How would I make use of the certificate in a web application, username and password login form to provide ...
1
vote
1answer
247 views

Have I done enough not be compromised through image uploading

I know that you can never be sure that you have done enough to be secure, and I also know that file uploading is hard to make correct. Before asking this question I read some of the related posts here ...
0
votes
0answers
40 views

Storing hashed or encrypted password in session? [duplicate]

I need users to be able to encrypt and decrypt without entering their passwords every time. One way is to store the hashed password in session, and use it for encryption and decryption. Problem with ...
1
vote
1answer
276 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
0
votes
1answer
88 views

Credit card data [closed]

I want to scan files for is there any credit card information.I searched for find good product. I used this application card recon Is there any similar product like that for find credit data ...
0
votes
1answer
233 views

False Positives- Server side protection against XSS

I read about XSS attacks and its prevention mechanism on server-side. It seems only protection is to sanitize the input by escaping special characters on server side (Using some PHP functions such as ...
1
vote
1answer
113 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
0
votes
1answer
69 views

Security design behind google's application specific password [duplicate]

When using Google's two-step verification with services that can't use it, such as mail clients on smartphones and desktops, the solution is to create application-specific passwords for those ...
2
votes
2answers
621 views

Data protection laws and regulation for storing IP addresses for registered users [closed]

I have a website, large amounts of this site can only be accessed if the user logs in. I would like to use the users IP addresses as a means to determine where they are when they access certain pages. ...
0
votes
1answer
289 views

Potential problem in public Maven repository

Problem This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository: http://repo.grails.org/grails/simple/codehaus-cache/com/ If you ...
0
votes
1answer
66 views

Is it reasonable to use a security proxy when integrating two web applications?

Background: We're in the process of integrating two web applications. The other one, application A, is a publicly accessible Internet service, which is provided by a third party and which offers Web ...