An application that is accessed over a network such as the Internet or an intranet using a browser.
6
votes
3answers
176 views
Defending site against being abused by phishing
Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
6
votes
4answers
655 views
What is the right way of storing database connection strings from the security point of view?
What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
6
votes
2answers
299 views
With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?
From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
6
votes
2answers
438 views
What a programmer should know before their web service's client audit
Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
6
votes
3answers
307 views
What is the next step of this file upload attack?
Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
6
votes
1answer
155 views
What responsibility do I have in continuing another developer's work?
My question is related to this one. I did not found anything googling around and that is why I am asking.
This question
I am the sole web developer for a firm, and I manage everything, from ...
6
votes
3answers
155 views
What indicators did OWASP use to end up with OWASP Top 10?
I was asked by a student how OWASP Top 10 are ranked, based on which indicators: is it severity? ease of exploit? ease of implementing their countermeasures? ...
Knowing that each of these ...
6
votes
2answers
239 views
Is it proper to be prompted that I entered an old password
I changed my Facebook password a few days ago. Today, I entered the old password chronically, and saw the prompt:
Sorry! You Entered An Old Password
And even shows the date&time when I ...
6
votes
3answers
173 views
Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?
I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
6
votes
1answer
378 views
Injecting ampersand to the url
Let's say there is a program sending some data to server via GET:
http://server.com/gateway?value1=abc&value3=def
Then the server sends these values further, adding value2: (python code)
...
6
votes
4answers
236 views
Is there any added security benefit to username complexity requirements?
I've come across several sites lately that have complexity requirements for usernames like "must be 8 characters long and contain at least 2 numbers". Is there any real added benefit to this from a ...
6
votes
3answers
366 views
How can I find subdomains of a site?
One of the things I need to do from time to time is to find subdomains of a site for example.
Starting with example.com
sub1.example.com
other.example.com
another.example.com
I'm ...
6
votes
3answers
916 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
6
votes
2answers
823 views
Is it possible to do HTTP header injection if CR/LF are stripped?
In HTTP response there is the following header with attacker controlled content:
Content-Disposition:attachment; filename="attacker_controlled.html"
The only characters that can't appear in ...
6
votes
2answers
153 views
Where can I find good resources on reversing web malware?
I am wondering where I can find a good site with resources on reversing web malware like javascript, flash, html5, and any other stuff that is designed to attack the clients.
Does anyone have any ...
6
votes
2answers
275 views
Security issues with PHP Sandbox
I am working on a PHP sandbox for a Web Application Honeypot. The PHP sandbox will analyze a PHP file that may have been injected as part of an RFI attack. It should run the file in a safe environment ...
6
votes
1answer
345 views
Strict Transport Security — max_age value
I've been wondering what max-age should the HTTP Strict Transport Security header have.
Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes)
market.android.com has it ...
6
votes
1answer
276 views
how to configure edit-restricted mediawiki
I am planning to setup a public wiki using mediawiki, but I never used mediawiki for a public site before and I am not experienced with it, even as a user.
I am planning to create a very restricted ...
6
votes
1answer
290 views
Encrypting sensitive data in software and storing/decrypting it on a server
I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing.
I'm developing software which has 2 parts - a C# program run ...
5
votes
4answers
527 views
Is XSS dangerous in application without database?
I think it definitelly isn't, because XSS which isn't saved anywhere would damage ONLY attacker.
Am I right or are there any cases where XSS could hurt non-db-application? (I mean datas are not saved ...
5
votes
6answers
671 views
What does it actually mean when someone says their website is hacked?
I have seen many people say that their website has been hacked using some vulnerability. I never fully understood what this means.
To me the only way to get control of website is get the FTP ...
5
votes
6answers
527 views
How do I secure my login page?
The login page is the starting point to any web site and the most important thing to authenticate the user.
When I begin to build any web application, I take a lot of time to think about how to ...
5
votes
7answers
337 views
How do random attackers discover websites to target?
I'm working on a site that doesn't need to be known to the Internet at large (but for a few reasons, is hosted on shared hosting instead of on an intranet). It's a WordPress installation and so I've ...
5
votes
4answers
318 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
5
votes
6answers
718 views
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code.
Sometimes though, the avoidance of ...
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
5
votes
5answers
594 views
Robots.txt security strategy?
Is there a way to basically have an allow all policy on your top level domain, and any subdomains disallow all? I would rather that my public facing app servers not get indexed, but from what I can ...
5
votes
3answers
484 views
Is security increased by using a subdomain per customer in a web-app?
I'm thinking about adding per-customer subdomains to my web app (which would mean a wildcard ssl certificate and some extra code). It's an app to help small companies with their cashflow. Customers ...
5
votes
5answers
422 views
Why are iframes allowed at all in modern browsers?
I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, ...
5
votes
3answers
206 views
Should user input be validated for it's length?
Is it bad not to validate length of user input to text field at server side. May it lead to such vulnerabilities as buffer overflows and other?
I think it depends on programming language of ...
5
votes
2answers
365 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
5
votes
3answers
249 views
What fraction of web sites are vulnerable?
It is known that security vulnerabilities are common on the web: many web sites are vulnerable. Is there any data on what fraction of web sites are vulnerable, and what fraction are secure?
5
votes
2answers
485 views
Antivirus for scanning anonymous file uploads
Since I have no experience with AV solutions on Unix-like environments, I would need help with suggestions on something that can be suitable for scanning files that are uploaded by anonymous users ...
5
votes
3answers
267 views
Is randomizing cookie names a good idea?
What security benefits would randomizing cookie names on a website offer? What are some of the challenges it would create?
5
votes
4answers
1k views
How effective are reverse proxies as a web application security measure?
How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they?
For example are they more effective in preventing ...
5
votes
3answers
249 views
CSRF Countermeasures
I'm working through a book on web application security and it says that an effective CSRF countermeasure is to assign a temporary pseudo-random token to sensitive actions performed by authenticated ...
5
votes
4answers
2k views
How does a trojan like Trojan:JS/BlacoleRef.BV infect a website?
Today I find out my website is infected with Trojan:JS/BlacoleRef.BV. The server is a shared server from a hosting company.
How does a trojan like this get on the webserver?
5
votes
3answers
650 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
5
votes
3answers
1k views
Is it possible to inject HTML into image to provoke XSS?
Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS.
I guess that this HTML will be processed by browser only if hole exists in browser. ...
5
votes
5answers
272 views
Hiding version - valuable or just security by obscurity?
Many automatic security scanners have built in rules that alert on the presence of software version, and in many security lists version exposure to arbitrary person accessing the system is mentioned ...
5
votes
4answers
189 views
Safest way for multiple users post to a single social networking account
Suppose I have a team or organization managing a single twitter account and a single facebook page. Different users need to be able to post content to the same account. How can I minimize the risk of ...
5
votes
3answers
273 views
Web server file sniffing
What is it called when a user tries several attempts to figure out the files and folder structure on a web server?
For example, the attacker will run http://example.com/test.jpg to determine if ...
5
votes
2answers
127 views
What are the parameters to be logged in a web application?
I am working on developing a secure authentication system with SSO. Until now I have been using the logging framework to generate logs that help in debugging the application. I wonder if there is a ...
5
votes
3answers
686 views
Securing a multi-tenant architecture
I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
5
votes
2answers
201 views
What fraction of vulnerabilities does black-box pentesting find?
Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all.
What fraction of vulnerabilities does black-box pentesting find, ...
5
votes
2answers
698 views
HTML 5 Security Code Scanner
Are there code scanners in the market that scan HTML 5 code?
Does anyone have a list of tags of specific CORS configurations that need/can be scanned?
5
votes
3answers
1k views
Where can I find exploit code?
I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are:
2010-1917,
...
5
votes
1answer
115 views
Is it safe to allow untrusted field names in JSON?
When forming a JSON data structure, are there any security risks with allowing the field names to be chosen by an attacker? You can assume they'll be quoted properly. I'd like to know if allowing ...
5
votes
1answer
224 views
What is the benefit of the scope in OAuth2?
In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless.
This question refers to ...
5
votes
2answers
572 views
Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?
SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet.
I've read the information at it's Stanford University home page, the Wiki ...
