An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

8
votes
4answers
3k views

How effective are reverse proxies as a web application security measure?

How effective are reverse proxies as a web application security device? Which types of threats do they mitigate against and which don't they? For example are they more effective in preventing ...
8
votes
4answers
823 views

How dangerous is it to store password in plain text on sites like GitHub?

I have a few private repositories set up on GitHub for some of the projects I am working on for my company. These applications connect to databases and I have database authentication credentials ...
8
votes
2answers
649 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
8
votes
3answers
1k views

How bad is a Self Contained XSS attack?

Some of you might be familiar with this attack called Self Contained XSS. I recently stumbled upon this article about it. So how bad this kind of attack can be, even though this doesn't have access to ...
8
votes
3answers
227 views

Securing an E-commerce site

I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site. I'm confused as to what the critical ...
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
8
votes
2answers
249 views

Is there any risk related to allow user to give an URL as their image profile?

Building a website, I'd like to allow users to specify an url that point to an image that will be used as a profile picture (included in the HTML DOM as a ). But before doing anything stupid, I was ...
8
votes
2answers
425 views

Isolating Web application hosted on same web server

I am working on a scenario if we have two or more web application hosted on a same server. Let says Web application X is vulnerable so how can i be sure that it will not effect the other web ...
8
votes
3answers
2k views

Should web sites disable form autocomplete on all forms?

I've noticed that some web-app security scanners flag the 'Autocomplete' feature of some websites (in the username/password fields) as a security risk and thus suggest including "AUTOCOMPLETE = false" ...
8
votes
4answers
827 views

Preventing insecure webapp on subdomain compromise security of main webapp

I want your help on getting more concrete information on a type of vulnerability that I remember vaguely. I vaguely remember hearing about a year ago that if you set up a webapp on a subdomain, and ...
8
votes
2answers
588 views

Recent Facebook XSS exploit details

There was a recent XSS exploit on Facebook that posted a vulgar message and got users to click on a link to spread the payload. What vulnerability was exploited, and what can other sites do to avoid a ...
8
votes
3answers
461 views

What security features should be present in every web-based CMS?

What are the most important security features that a web-based CMS should offer? What's vital? What would be nice to have? What features should the CMS not attempt to do? Please note: I'm looking ...
8
votes
3answers
1k views

What is the next step of this file upload attack?

Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form. I believe the attack was unsuccessful for a ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
8
votes
3answers
295 views

Verify a website user is behind corporate firewall?

We have a public ecommerce website hosted at our datacenter onsite. For people who are within the corporate firewall hitting the website I want to display profiling information about the request of ...
8
votes
5answers
1k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
8
votes
2answers
1k views

MIME sniffing protection

As it is known, older versions of MSIE (before 8) have a nasty habit of treating images as HTML if they "look like" HTML, which can lead to nasty vulnerabilities for sites that allow people to upload ...
8
votes
2answers
686 views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
8
votes
2answers
2k views

PHP - How to do safe input filtering in the light of multibyte encoding vulnerabilities?

For days now I try to get my head round how to write a secure web application in php, and it turns out to be particularly difficult. The more I read, the more I sink in deep swamps full of ...
8
votes
3answers
1k views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...
8
votes
2answers
2k views

Is it possible to do HTTP header injection if CR/LF are stripped?

In HTTP response there is the following header with attacker controlled content: Content-Disposition:attachment; filename="attacker_controlled.html" The only characters that can't appear in ...
8
votes
3answers
826 views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
8
votes
1answer
545 views

Are browser still vulnerable to Cross-Site Cooking?

The latest article that I have been able to find about Cross-Site cooking was stating that it was possible to set cookie on 2 dots top level domain such as .co.uk. The mechanism for preventing ...
8
votes
2answers
1k views

How secure are the default ASP.NET membership and role providers for Sql Server?

I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
7
votes
3answers
916 views

How serious are XSS attacks

A website I visit allows this kind of attack, to be implemented with GET in the URL <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> Along with many others on this page: ...
7
votes
5answers
519 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
7
votes
4answers
1k views

Escaping JavaScript constants

how can untrusted values be included in a html-page as javascript string constants? Although the case i am asking uses JSF and Rails, I think this is a general problem independent of the server side ...
7
votes
3answers
953 views

Flaws in Crypto Cat

I've heard from several people that Crypto Cat has some security flaws. Has anyone performed an analysis of the system and written a whitepaper? I'm curious what the flaws specifically are and what ...
7
votes
2answers
407 views

Why do some online banking sites (and others who desire secure login pages) sometimes add autocomplete=“off” on their login page input fields?

For example: http://www.natwest.com/x-user.ashx?redirect=trusteer.interstitial.url&condition=trusteer.enabled2%3Dtrue <input name="...." type="text" maxlength="10" ...
7
votes
6answers
1k views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
7
votes
7answers
1k views

Facebook account keeps getting hacked, can't seem to figure out why or how?

One of my mate, she has a lot of friends on Facebook, uses it for marketing. Her account keeps getting broken into. Her password gets reset and/or gets locked for changing resetting password too many ...
7
votes
4answers
803 views

Security attacks on PHP web applications

I know about following security attacks on php applications (html,php,js). XSS SQL Injection CSFR Session Hijacking /Fixation Code Injection Remote file injection Should i know about any other or ...
7
votes
4answers
9k views

Why Do we Need CAPTCHA? In what case we should use it?

In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
7
votes
3answers
2k views

Is there a way to bypass Django's XSS escaping with “unicode”?

Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions. However this presentation on slide ...
7
votes
2answers
456 views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
7
votes
4answers
261 views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
7
votes
1answer
1k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
7
votes
4answers
2k views

SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol

I have a question I'm hoping you could help with? I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection. ...
7
votes
3answers
5k views

Is it possible to inject HTML into image to provoke XSS?

Some answers mention that it's possible to inject attacker-controlled HTML into images and therefore provoke XSS. I guess that this HTML will be processed by browser only if hole exists in browser. ...
7
votes
3answers
14k views

How can I use this path bypass/exploit Local File Inclusion?

I have tried to run a vulnerability scanning script (Uniscan 6.0) on some websites and then I found a site which is exploitable with this following path. (included a word "invalid" , params/website ...
7
votes
6answers
1k views

Fortify360 - Sinks & Sources - Vulnerability count

In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
7
votes
3answers
546 views

Is Using MD5 Sufficient Reason to Reject This Payment Processor?

I'm evaluating a credit card processor[1], and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
7
votes
1answer
6k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
7
votes
3answers
506 views

Finding security consultant for doing in-depth code review?

We have a PHP application that we know has poor coding practices (because the developers did not have a good understanding of PHP / programming fundamentals). This could lead to the scenario where we ...
7
votes
5answers
2k views

Does setting httponly prevent stealing a session using XSS?

If a session token is stored in a cookie that has httponly set, is there any way that a XSS vulnerability could allow a malicious user to steal a users session token?
7
votes
2answers
2k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
7
votes
5answers
355 views

Is there any added security benefit to username complexity requirements?

I've come across several sites lately that have complexity requirements for usernames like "must be 8 characters long and contain at least 2 numbers". Is there any real added benefit to this from a ...
7
votes
4answers
4k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
7
votes
4answers
253 views

Limited JavaScript app scenario: Attack vectors and mitigation

I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...