An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
2answers
337 views

Help investigating potential website attack (URL rewriting and ROT-13 obfuscation) [closed]

We're looking for help/advice from website security experts. Our company develops web-based process management software and hosts it for our customers. The software sends emails to users when they ...
5
votes
5answers
1k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
5
votes
2answers
130 views

Any eventhandlers that apply to hidden elements?

Im trying to XSS a search field and my attack vector is getting reflected like this: <input type="text" id="txtRpHiddenKeyword" style="display: none;" value="ATTACK VECTOR HERE" /> Only ...
2
votes
2answers
310 views

What are good approaches to modify TLS/SSL trafic in order to make a HTTP bot?

If I wanted to make a bot that plays/issues automatic actions/moves in a online browser game, whose communication is realized over HTTP1/1 and WebSocket (https and wws respectively), all TLS ...
7
votes
5answers
8k views

Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP

The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well. In addition there are a ...
2
votes
3answers
110 views

Limit attempt of user login against PBKDF2

I have been tasked been tasked by my boss to change the encryption system of our web application from MD5 to PBKDF2 as MD5/SHA1 has been shown to be breakable in recent years . I argued against it ...
2
votes
2answers
115 views

Is it possible to make a “proof of anteriority” for sites content?

Given a site that publishes unique content online and given that there are lots of site scrapers and persons stealing content and reposting it as their own, inevitably you will have the same content ...
0
votes
3answers
116 views

Regarding Cross-Site Scripting attacks

My application has an Upload Management Module and accepts Excel and text files to our server. I detected invalid data inside some uploaded files (the uploader put ...
6
votes
1answer
693 views

Using skype for an attack

I am curious about something; let's say someone randomly added me to Skype and tried to initiate a chat with me and I want to know more about them but I am worried if they can do some damage. My ...
1
vote
1answer
154 views

Caching Behaviour on major browsers

Before I even ask the question - this is a hard question to frame, so I welcome edits to improve clarity. How do major browsers decide how to cache responses, especially if said responses are ...
3
votes
1answer
127 views

How online document signing services guarantee non-repudiation?

There is a number of services online like RightSignature or SignHub that will let you sign online legally binding documents. I understand how documents can be signed digitally and this can guarantee ...
1
vote
0answers
32 views

Writing Security Functionality Requirements [closed]

Is there any Guideline Doc. or Tutorials for writing Security Functionality Requirement (Common Criteria)for a product?
1
vote
3answers
325 views

How to detect anomalous activity in web server traffic?

I'm wondering how to successfully detect malicious activity in my web server traffic? Could you point me out some popular solutions which can help me to detect attacks on my web application? I ...
0
votes
1answer
107 views

Is there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and fastcgi to create a psudo-CMS, is there any kind of security concerns to watch out for (ie buffer overflows, and the like)?
-1
votes
2answers
266 views

ISP can detect DNS requests for a website. Can it do the same for websites embedded inside other websites ? [duplicate]

ISP can detect DNS requests for a web site, ie www.google.com . If I have a website ie www.mysite.com, and a webpage ie www.mysite.com/mypage.html and inside www.mysite.com/mypage.html , the web site ...
4
votes
2answers
255 views

What type of information should be shown to an end user for a logon session summary?

Google, Yahoo, Facebook and several banks have a session summary screen that lists a variety of information, but they aren't consistent in what is offered to the end user. e.g. Facebook offers a ...
1
vote
2answers
182 views

How secure are the GPG/PGP keyservers?

Importing a GPG key with a KeyID or fingerprint seems to rely on keyservers. Doesn't this invite man-in-the-middle attacks, in which someone would alter the keys to allow them to decrypt the data? ...
4
votes
5answers
3k views

Should I ignore the BEAST SSL exploit and continue to prefer AES?

Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4. I am wondering if it wouldn't be better to continue using AES instead for the following ...
0
votes
1answer
165 views

Can I use a vpn to securely use prototypes of webapps from my phone or laptop?

I want to experiment with web development (using django) for both desktop and mobile. Server, phones and desktops could all be part of the same virtual private network. The VPN will be from some ...
1
vote
3answers
4k views

Is it possible to find who posted comment on my blogspot anonymously?

Problem Behind question : I own an blogspot site and people used to come and comment on my posts. In recent days I can see a spammer who comments anonymously on my every blog-posts. The comments were ...
41
votes
7answers
2k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
7
votes
2answers
227 views

What criteria should be used for manually reviewing / prioritizing failed logins?

I have a web application that is exposed to the Internet, and am interested in creating alerts, or prioritizing the manual review of failed logins to the web application. What thresholds, or ...
0
votes
1answer
195 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
0
votes
1answer
288 views

How to secure and limit access to a web based application hosted on a local server

I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that: To host the application myself. The ...
2
votes
2answers
475 views

Unrestricted File Upload - Possible exploits

During a penetration test‎ (exercise) on a IIS web server + MYSQL DBMS, I have found an Unrestricted File Upload vulnerability for which I can upload a .php file. So I have tried to upload a php ...
2
votes
0answers
46 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
2
votes
3answers
906 views

Cross site scripting prevention removing &lt and &gt

I'm testing an application that only skips < and > symbols. The user input being validated is always inserted between html tags like <b>, <span>, <div>, etc. and never passed ...
1
vote
1answer
217 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
-1
votes
3answers
155 views

Building a website with MAXIMUM website security [closed]

Well lets assume that someone is intending to build a website that will contain THOUSANDS of sensitive records such as credit cards etc. What would be a good checklist that would ensure that the ...
1
vote
1answer
106 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
0
votes
1answer
66 views

How to pass an email address securely to a web application X embedded inside a web application Y

The scenario I'm trying to address is this: There is a web application Y which has an authenticated user. Inside Y, web application X is hosted (which belongs to a different domain). When X is ...
5
votes
3answers
628 views

Do I need to expire a session cookie when sessions are handled server-side?

The only data in the cookie is the session ID. There is no expiration timestamp set when creating it, a session is always evaluated server-side to see if it has expired. When logging out, the session ...
3
votes
1answer
114 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
79
votes
8answers
6k views

Do we need to logout of webapps?

A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some ...
9
votes
2answers
2k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
1
vote
4answers
697 views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
0
votes
1answer
182 views

Encrypting content using same secret key as hash?

OK - I'm trying to design a system that can provide personalised/differentiated content at minimal expense to the server. One of the designs I'm currently exploring is where the request is somehow ...
2
votes
0answers
160 views

Automated tools to test Struts OGNL security vulnerabilities

I'm looking for a way to find Struts2 OGNL vulnerabilities (specifically http://www.cvedetails.com/cve/CVE-2013-4316/ and http://www.cvedetails.com/cve/CVE-2013-2251/. ) I know that attackers ...
-6
votes
1answer
164 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
4
votes
3answers
147 views

Can “remember me” be done securely on an accountless website?

I have a website that lets users submit a form without having to create an account and log in. However, in order to keep users accountable for their submissions, the form requires them to provide ...
4
votes
1answer
225 views

What are the dangers with creating MySQL databases on the fly?

I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database. I ...
10
votes
3answers
613 views

Is Gmail showing images by default a good idea for privacy?

Google have decided to show images in Gmail messages accessed via the web, iOS and Android by default: Instead of serving images directly from their original external host servers, Gmail will now ...
1
vote
3answers
538 views

How to expose a client's real IP address?

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?
4
votes
5answers
12k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
0
votes
1answer
174 views

Password algorithm to be integrated on a website

I have recently started a project to code a secure password protection algorithm to be used on both computers and mobile devices. As I have never done anything like it before, I am a bit unsure of ...
4
votes
2answers
250 views

XSS when <, > and " are escaped

I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following : It escapes <, >, " to their URL entities (not &, ) or () You are ...
0
votes
3answers
205 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
20
votes
7answers
833 views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
9
votes
3answers
8k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...