An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

2
votes
3answers
323 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
0
votes
1answer
426 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
5
votes
4answers
315 views

Avoiding direct object references

Say I wanted to avoid exposing a database primary key in a URL; somehow I must encrypt the key, so that the url only exposes elements of an unenumerable cipherspace. What kind of encryption should I ...
3
votes
2answers
145 views

Can CSRF protection work even if an XSS vulnerability exists?

Need for CSRF protection that withstands an XSS attack One of the big dangers of XSS is that it can often bypass CSRF protection and thus perform any action the victim can perform. If it would be ...
1
vote
0answers
41 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...
1
vote
1answer
186 views

Is JWT in cookies with any CSRF solution just as vulnerable to XSS as JWT in localStorage?

I've read that JWT tokens shouldn't be stored in localStroage because XSS attacks can read them. The proposed solution is to store JWT tokens in HTTPOnly cookies and use anti-CSRF w/ double-submit ...
2
votes
2answers
109 views

What is web application security best practice for HTTP Get request? [duplicate]

If I have web application GET URL which gives me details of particular user. What is more secure / which is good practice? eg. www.xyz.com/user?id=10 or www.xyz.com/user?fname="abc"&lname="...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
5answers
1k views

Simple solution to XSS

I've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I ...
3
votes
1answer
88 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
1
vote
0answers
50 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
8
votes
2answers
727 views

Using optical illusions as CAPTCHA

Would using the "flaws" in human perception of an optical illusion graphic allow a system to differentiate between humans and machines (using these pictures like a CAPTCHA)? Some examples are where a ...
41
votes
6answers
18k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
2
votes
0answers
28 views

Continuous integration SaaS security considerations

How do CI SaaS products protect themselves from bad actors? When a CI server builds and tests arbitrary code, how can we be sure this code is not some sort of exploit? Are CI companies like Travis ...
4
votes
2answers
90 views

Software Library Vulnerability Tracking

I'm looking to improve the security posture of a web app specifically with respect to OWASP A9 - Using Components with Known Vulnerabilities. Is anyone aware of any comprehensive data sources aside ...
4
votes
1answer
43 views

Seamless authentication from an iPad to several enterprise apps - what are the options?

What are the options for authenticating users of corporate iPads which are MDM managed to access sensitive corporate web apps exposed over the internet? The issue here is there are several web apps ...
3
votes
3answers
105 views

What are the security risks of importing and processing an excel spreadsheet from an untrusted user

I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the ...
1
vote
3answers
5k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
21
votes
4answers
4k views

Keylogger web application protection

I'm trying to improve security in a web application. The application has an admin site and keyloggers are a concern that I'm trying to solve. Can the application do something that can prevent ...
3
votes
1answer
100 views

Hosting multiple websites securely

Surprisingly I couldn't find any related topics here, so I'll put this up. I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
2
votes
2answers
199 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
9
votes
1answer
152 views

Handling “forgot password” functionality with encrypted data without security questions

As a sort of follow-up to this question on handling password-reset functionality when dealing with encrypted user data, is there any good method for resetting a user's password in an encrypted web ...
1
vote
0answers
50 views

User Agents in e-mail Headers

I received a COX e-mail generated on a Surface tablet. The User Agent was exactly what I expected it to be: Mozilla/5.0(Windows NT 10.0 ETC. Then I received an AOL email with User Agent: JAS STD. I ...
0
votes
3answers
261 views

Best practice of Secret Question/Answer

I'm building a web application and I'm actually writing a code that allows users to choose their secret question and answer used to identify them if they forget their passwords. I'm a little bit ...
1
vote
1answer
85 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
12
votes
4answers
10k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. In the words of ...
2
votes
1answer
54 views

Signing web forum messages

I maintain web forum software, which is accessible via NNTP and e-mail (as mailing lists). Since NNTP by design allows anyone to spoof their e-mail address, message signing can be used instead to ...
1
vote
4answers
306 views

Fraud detection to avoid fake users

I know there is no 100% solution for fraud detection, but at least I want to set some level of confidence in this use case. Suppose that I have a system where: A user need to make a registration A ...
2
votes
1answer
215 views

Is an encrypted .dmg file decrypted on the dropbox server? [closed]

I'd like to use built in tools to create an encrypted drive in OS X that I can sync with Dropbox. To this end, I've created a 'sparse bundle' encrypted volume (.dmg) that remains in ~/Dropbox. My ...
4
votes
2answers
214 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
1
vote
1answer
77 views

How to avoid abuse of web-server endpoint from a rogue client?

I realized that once a user logs into the application and receives an Auth token there is the potential that they could use that token along with a rogue client to exploit an endpoint that they now ...
3
votes
1answer
46 views

Better alternative to WAF path whitelisting?

We are managing a WAF which is being used by some applications. Recently I tried to use a Valid URL module to white list all the APIs and static resources of an application. Although from the security ...
4
votes
1answer
337 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
3answers
112 views

Where to find about web application vulnerabilities' history? [closed]

There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, ...
-1
votes
1answer
124 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
3
votes
2answers
232 views

How can I execute a XSS when a web application transforms a data from lowercase to uppercase?

I'm testing a web application, when I send an input data to web application, this places the data in an onlcick function, something like this: <a href="#" onclick="someFunction('dataFromServer', '...
0
votes
1answer
63 views

Verifying that a request is internal

I've got a web app that will only output safe code. It needs to pass this to a Python backend. The logical way to pass things between JavaScript and Python is to have a Flask server running. Then, the ...
5
votes
4answers
536 views

Untrusted signature on java app for downloading youtube, harmful?

If you visit most of the "online youtube download" pages, you will get this message: Why all these sites come up with this message? Is it a worm, or just an unharmfull app?
4
votes
1answer
89 views

Informative error messages in password reset functionality?

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
2
votes
3answers
244 views

Is it safe to generate a password for a user during sign up in a web application?

I'm working on updating a web application. It currently creates a password for a user during sign up. Is asking the user to create the password themselves safer than relying on a generated password?
3
votes
2answers
149 views

How can i demonstrate remote file inclusion via get methods

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application. Scenario: In my web application RFI works only when the user's ...
1
vote
1answer
102 views

How specifically should I implement CSRF protection?

There are a ton of articles explaining what CSRF is and that I should use a CSRF token to prevent CSRF. A few of them mention details such as using SHA256 over MD5. However, none of them explain how ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
2
votes
1answer
127 views

What can I do about a malicious site with a similar domain name?

I recently purchased a domain name (lets pretend it was generic.co), I checked to see what site was hosted on the domain close to mine (generic.com). The site loads a fake blue screen of death and ...
15
votes
2answers
1k views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
6
votes
3answers
118 views

Is there any concern regarding a database primary key exposure? [duplicate]

Is there any risk if for example I let to end users to know the primary key associated to users in the database?
4
votes
1answer
128 views

Is running IIS application pools as a domain user considered bad practice?

I'd say the question is self-explanatory, but to give a bit of context to the sort of environment I'm talking about. The scenario is that your webservers are being joined to the domain to make ...
3
votes
3answers
702 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
1
vote
0answers
78 views

Force Browser to not URL encode specific chars [duplicate]

I try to get a XSS to work but the problem is, that the XSS is only working within BURP because there I can send for example '>' as an not URL encoded String. As soon as I try it in the browser, it is ...