An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

21
votes
5answers
5k views

What are the security risks of letting the users upload content to my site?

As a web designer (not a security expert) I wonder: If I allow users to upload content to my website (videos, images and text files), what are the real risks involved?
1
vote
2answers
211 views

Security of php code on webserver - obfuscate?

Can the php source of a web app be considered safe on the server, or is it worthwhile obfuscating the code to reduce the chance of successful theft? I think my question boils down to 'Is there a ...
1
vote
3answers
9k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
90
votes
3answers
15k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
1
vote
2answers
193 views

Overkill or appropriate?

I have come across a web application that a company has asked me to rebuild. After all the implementation is said and done I will deploy on a private server, and the database will be on its own ...
1
vote
3answers
192 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
2
votes
3answers
103 views

Security coding training best approach

To train the development team, there are various options one can take: inhouse presentation with code samples, CBTs so developers do it at their best time, instructor-led courses onsite or inhouse ...
2
votes
4answers
553 views

Should text files or image files be virus scanned during upload?

I have created an online web app for my company. It's being tested for security files. The tester loaded the EICAR text file. The virus scanner on the server caught and removed the file. I have only ...
0
votes
3answers
106 views

How to secure consumer info without buy an certificate?

I need to know how to properly secure my consumers credit card info without buying expensive certificates? It is possible to use https:// and ssl or tls without an certificate and without scary ...
1
vote
1answer
120 views

Is posting data to a https address secure?

I am making an web application who POST an username and password to an server who checks it. This communication is secure (SSL/TLS). What I was wondering if the secure SSL communication is set up ...
16
votes
4answers
5k views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
1
vote
2answers
328 views

Is PHP unserialize() exploitable without any 'interesting' methods?

Say that there was a publicly accessible web page with the following PHP code: <?php class NotInteresting { public function noExploits() { echo "Whatever."; } } $unsafe = ...
2
votes
4answers
877 views

Analyze my custom web authentication scheme, based on a token derived from username and password

To avoid having the user to login every time his session expires, I want to implement a token based authentication system. My scheme works like this: Send the user login (send name + password) ...
22
votes
5answers
15k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
1
vote
1answer
93 views

Is it possible to build a web-service which is immune to DOSes?

I heard that a service I'm using on the web has some problems with denial of service -attacks. I was wondering if it is theoretically possible to build a web-services where user can send data and ...
1
vote
1answer
901 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
2answers
236 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
0answers
121 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
15
votes
5answers
610 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
3
votes
1answer
112 views

PHP max_input_vars security expectations

Considering a site that handles large POST data, would it be unreasonable and dangerous to set the php.ini max_input_vars to something like 100000? I know this is a vector for DOS attacks, but don't ...
2
votes
1answer
58 views

Spoofing of Server Sent Events

In the spec for Server Sent Events, it says Authors should check the origin attribute to ensure that messages are only accepted from domains that they expect to receive messages from. Otherwise, ...
1
vote
0answers
38 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
2
votes
1answer
542 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
3
votes
3answers
143 views

Does it make sense to isolate each web service user on his own servers?

I am planning an architecture of a web application for my company which is launching a financial service for its partners, and my main question is - does it make sense to put each partner on a ...
2
votes
0answers
275 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
43
votes
8answers
4k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
34
votes
5answers
22k views

Are there security issues with embedding an HTTPS iframe on an HTTP page?

I've seen websites placing HTTPS iframes on HTTP pages. Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the ...
-1
votes
2answers
166 views

Is JavaScript console vulnerable to XSS

Assume the content of the name variable below is controlled by an attacker. Is this line of code vulnerable to XSS? console.log(name) When I send an injection in name variable I see its value ...
35
votes
6answers
5k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
1
vote
1answer
127 views

Iframe postmessage fraud

I've reviewed some material here and in other sites relating to secure usage of Window.postMessage. There is a bunch of material regarding best practices but one of my questions remained unanswered. ...
-1
votes
2answers
135 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
0
votes
1answer
83 views

How I do get the correct the Tamper parameters from an internal web login [closed]

I am doing pentesting for a web application, but I do not know if am using the Tamper Data add on on mozilla correctly. Could anyone explain how to get the following parameters, and where do I need ...
1
vote
1answer
964 views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
3
votes
1answer
3k views

Detect a server supporting SPDY?

With my current interest in the CRIME attack, I am currently trying to check if there actually exits a way to "fingerprint" a server that supports SPDY? My research lead me to believe only that the ...
1
vote
3answers
1k views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the ASCII decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
3
votes
2answers
285 views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
0
votes
3answers
290 views

Can an attacker spoof an IP address to access my .htaccess protected file?

Let's say I lock down my site through .htaccess and say DENY FROM ALL ALLOW FROM myip how involved is it for a hacker to to simply spoof their IP address to match whatever mine is and gain access? ...
7
votes
5answers
10k views

Hiding JavaScript source code

In a web-app should one strive to hide as much of the code as possible, for example from view source? In particular I was wondering should JavaScript be hidden, especially ones used for Ajax? I was ...
5
votes
1answer
350 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
1
vote
1answer
133 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
4
votes
1answer
173 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
1
vote
2answers
287 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
2
votes
1answer
86 views

Redeploying multiple Secure sites on a single server

This may not be a great site for this question. I basically have approximately 10 VPS instances running a secured website each, each with their own SSH connection to a hosted Database. What I'm ...
-1
votes
1answer
144 views

TLS/SSL and password transmission

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
21
votes
1answer
19k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
0
votes
1answer
412 views

Alternative ways to exploit this path traversal

I've got an application vulnerable to directory traversal (I know this because it's part of the wording of the question). The application has two directories, public and private, and two php files: ...
-3
votes
1answer
99 views

What is the Impact of TRACE Method? [duplicate]

What attacker will benefit of TRACE Exploitation and What is the Recommendation to fix this issue?
0
votes
3answers
156 views

Effect of mail bombing

I have option in my application which send an invitation email to another user. Someday ago, one of my friend told me that, attacker can flood any email using this function. And i have checked that ...
2
votes
2answers
182 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
3
votes
3answers
304 views

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as ...