An application that is accessed over a network such as the Internet or an intranet using a browser.
1
vote
1answer
179 views
Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?
I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable.
I tried to test the ICMP rule by ...
4
votes
3answers
333 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
2
votes
4answers
794 views
What XSS attacks doesn't “Reflective XSS Protection” defeat?
Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability.
So ...
16
votes
5answers
1k views
Should I use Suhosin for PHP?
Suhosin can be used to increase the security of your php application.
I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
7
votes
3answers
290 views
AES using derived keys / IVs. Does it introduce a weakness?
I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application.
Obviously in order to re-use this key, a unique ...
3
votes
3answers
229 views
Is this a web attack I should be concerned about - trying to enter code for form vars
I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
2
votes
3answers
84 views
If I host a web form which submits CC details to a provider, are there PCI implications form host?
I'm wondering if anyone has any thoughts on a specific question I have. I read a lot about systems that 'store, process, submit' CC data requiring compliance.
If I host a form on my website which ...
3
votes
2answers
149 views
Secure login across two web apps
I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1.
APP2 needs to know an ID of the user who is ...
10
votes
7answers
646 views
Should we force user to HTTPS on website?
Should we force website from HTTP to HTTPS , one of the method is using .htaccess:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
But what I notice is that some ...
8
votes
2answers
588 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
5
votes
3answers
156 views
Does a 'reset password' website facility give away too much information?
If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
8
votes
2answers
775 views
How secure are the default ASP.NET membership and role providers for Sql Server?
I have a very basic idea of how these work. I've used them many times when I needed a user management system rather then writing my own. But should I use these for a production system? Would ...
0
votes
0answers
90 views
How do you connect honeyd to a web application? [closed]
Suppose I have a simple web application running Apache Tomcat running on a public facing IP/port.
According to the Honeyd website it says " Honeyd improves cyber security by providing mechanisms for ...
4
votes
3answers
394 views
Web app penetration testing
I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection.
The site is hosted on ...
0
votes
0answers
54 views
open source web development plugins,scripts store information? [closed]
I'm wondering if open source plugins like wordpress,drupal or jquery and many more detect for example what websites are using their plugin.
If so, is there any plugin which can detect which website ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
7
votes
4answers
909 views
Challenging challenge: client-side password hashing and server-side password verification
We have a website where users need to log in to access privileged information. Obviously we are using SSL, but I also want to avoid plaintext passwords from accidently ending up in server logs, or ...
5
votes
1answer
317 views
Practices for storing username/password in Web applications
I have read the following question: Storing password in Java application but I don't find the answers useful for my case.
So here is my question somehow related to that. I have a Java Web application ...
17
votes
4answers
549 views
Should I be concerned when a “Forgot Password?” tool sends my password in plaintext?
Some sites I have been a member of in the past don't go through the normal "Forgot Password?" process. Instead of e-mailing me a unique password reset link or something of the like, I have received ...
7
votes
4answers
159 views
Limited JavaScript app scenario: Attack vectors and mitigation
I'm going to be developing a single page JavaScript app which allows input via a textarea. This input is never sent to the server, never shown to another user, and will only be persisted in browser ...
0
votes
1answer
373 views
How to escape user input in a value of javascript object?
How to properly escape user-controlled input when it's inserted as a value in JSON object?
<script>
$(document).ready(function() {
new MyObject({
key1: "user_input",
key2: ...
2
votes
2answers
126 views
Is there a need for SSL on a local site?
Do I need SSL for a site that can only be accessed on the local network?
All users log in with windows credentials using Windows Auth with PHP on IIS.
And if I don't: What security is needed to make ...
6
votes
3answers
896 views
CSRF cookie vs session based tokens
I will generate a CSRF token and include it in a hidden form field. When receiving the request, I will check the form value against the value either stored in the user's session or in a cookie.
Is it ...
4
votes
2answers
96 views
filtering content in Content disposition header
I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :-
When Handling User-Controlled Filenames in Content-Disposition Headers
...
3
votes
3answers
147 views
What are some ways to steal a password/PIN using this system?
http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf
Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the ...
4
votes
2answers
230 views
CSRF Protection on static pages
I have a static site which has forms. The forms submit to a Rails endpoint which captures the submitted data. The static site and the Rails endpoint are on the same domain, on different subdomains and ...
8
votes
2answers
184 views
User-specific Subdomains : JavaScript security
If I provide a public-facing website for users on my website at their own subdomain (e.g. bob.myapp.com) under their own control, can I allow them to execute arbitrary JavaScript without putting my ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
0
votes
2answers
611 views
IS Maltego is the best forensic/intelligence solution out there? [closed]
i am looking for the best intelligence forensic software that will give me the best solution for gathering information around the web .
please recommend me the best software out there ... and if you ...
2
votes
3answers
161 views
Pentesting file Upload feature
The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
3
votes
3answers
146 views
Security issues in a Dotnet Web application
I was required to fix three low risk security issues of a Web Application on a Windows 2003 server, NetFramework 2.0, IIS/6.0.
It is tracert-able. That may assist for crackers to know network ...
4
votes
2answers
301 views
Best way to securely set a session cookie on another domain
We currently have 2 sites http://www.foo.co.uk and https://secure.foo.com.
The www site does not have an SSL certificate and is on a different domain.
We have a login button on http://www.foo.co.uk ...
4
votes
1answer
176 views
Storing License Keys
I'm creating an application which generates licenses key and stores this in a database (the licenses are checked on-line). I don't wish to store these license unhashed - in case the database is ...
0
votes
3answers
435 views
Using an IPS as an alternative to mod_security
I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
3
votes
4answers
117 views
Strong authentication over insecure links
Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
4
votes
4answers
486 views
How does CAPTCHA mitigate DDoS attacks?
This seems like an easy question, but I've failed to find an answer.
One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
4
votes
2answers
147 views
Why are simple packet filter firewalls insufficient for the protection of web applications?
I was wondering why exactly are simple packet filter firewalls insufficient for the protection of web applications?
1
vote
3answers
240 views
Are tracking cookies illegal?
I have a merchant website. When a user visits the website, a cookie is set. Then when the same user visits the site again, we provide him with suggestions, content that he may enjoy based on what ...
8
votes
5answers
645 views
What is a DoS Attack and how does it differ from a DDoS attack?
Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says :
In computing, a ...
5
votes
3answers
157 views
How to best present 'Security Vulnerability Feedback' to devs in the IDE (like VisualStudio)
I posted today a pretty cool PoC where I was able to provide real-time 'security vulnerability feedback' to a developer as he is writing code in VisualStudio.
You can see the video at Real-time ...
0
votes
0answers
147 views
GWAPT - Training Experiences/Questions [closed]
I'm heavily considering the GWAPT certificate, I'm wondering:
http://www.giac.org/certification/web-application-penetration-tester-gwapt
Has anyone done the online version of it? What is it like? Is ...
11
votes
2answers
8k views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
3
votes
2answers
492 views
How to pentest Flash file on webapp with alowscriptaccess=samedomain?
In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:
<embed width="388" height="350" ...
5
votes
2answers
976 views
Can I block the true IP address using X-Forwarded-For header in IIS?
All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?
5
votes
1answer
93 views
How to determine level of security required for this kind of site?
Here are the main areas of the site that could become a security concern:
The site works as a general ledger system against the company and its users.
The ledger system is to keep track of small ...
12
votes
2answers
2k views
How to exploit HTTP Methods
Many security scanners like nikto, nessus, nmap, and w3af sometimes show that certain HTTP Methods like HEAD, GET, POST, PUT, DELETE, TRACE, OPTIONS, CONNECT, etc are vulnerable to attack.
What do ...
4
votes
5answers
183 views
Vulnerability scoring systems
Our company is developing a web app that is used for e-commerce. We want to establish a more formal scoring system for any security related issues eventually reported by us or by our clients. The ...
0
votes
1answer
158 views
What type of attacks can be carried on for an web application [closed]
My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application
...
0
votes
2answers
99 views
API - How can I make sure data sent by the user is only sent to my application?
I have an API and a web application where users can login through another system and then post text messages to my application, for example.
How can I assure that when this data is only posted to my ...
2
votes
3answers
414 views
How to block the websites on client machines
In our office we are blocking sites like facebook, twitter etc.The problem is that some of the users bypass the proxy and firewalls through external sites which allow us to bypass proxy, like:
...
