An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

3
votes
4answers
408 views

How should a webmaster manage all her passwords and keys?

I have several private keys that I use to ssh into AWS, dreamhost, github, etc. I have passphrases for all of these private keys that are too complex to remember. I have mysql passwords that my ...
4
votes
4answers
921 views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
3
votes
1answer
261 views

How can I check the iframe on my website is secure or not?

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?
3
votes
2answers
533 views

Encrypt web.config file using Data Protection API

I have encrypted part of my web.config file using the Data Protection API. Now, my question is, what does a hacker need in order to decrypt the web.config file? Does he require physical access to ...
2
votes
2answers
1k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
1
vote
2answers
195 views

Is there guidance that says all sessions to be logged off when a user changes their password?

Often when an account is hacked, security guidance is to change your password. However I've noticed that changing a password sometimes isn't enough to log out of other sessions that are active. Is ...
0
votes
3answers
251 views

CSRF possible if params are not passed through query string?

I was reading up on OWASP's page on CSRF and in their example they use a request where the sensitive parameters are stored in the query string: ...
2
votes
1answer
141 views

Can Jasper files be used as shells to attack java web apps?

JasperReports is an open source Java reporting tool that can write to a variety of targets, such as: screen, a printer, into PDF, HTML, Microsoft Excel, RTF, ODT, Comma-separated values or XML ...
1
vote
1answer
242 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
0
votes
1answer
193 views

Secure browser storage

Where is a secure place to store a "secret" in a web browser that a User has access to and JavaScript does not? Thinking was along the lines of web history, bookmarks, built in password manager & ...
3
votes
4answers
449 views

Is it safe to show user a message if account is locked

I am working on a web application, security is high priority. So, if a user has failed to login more than 3 times, the account will be locked. Should I display a message to the user saying "your ...
0
votes
3answers
349 views

Why do you need to login after you change a password?

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
0
votes
1answer
12k views

Error150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Help me guys please i'm having an problem with my google account. I can't log in it keeps saying : Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a ...
1
vote
0answers
110 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
61
votes
3answers
7k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
0
votes
1answer
153 views

Are there any risk in serving static assets via compressed SSL protocol from 3rd party domain?

e.g. curl -v -H 'Accept-Encoding: gzip' 'https://cdnjs.cloudflare.com/ajax/libs/Colors.js/1.2.2/colors.min.js' As you can see, result is gzipped. My assumption is since they are serving from 3rd ...
3
votes
2answers
326 views

Reusing the same session-ID necessarily bad?

The question is related to session-ID management in a particular php-based web-app. The web-app uses the same session-ID for each session for a fixed user. So, after logging-out of the application, ...
2
votes
3answers
1k views

Javascript containing a long hexadecimal string and eval: is this suspicious?

At the bottom of the index.php file for a simple “contact us” form, I found the following (some whitespace and newlines added): try {if(window.document)--document.getElementById('12')} catch(qq) ...
0
votes
2answers
99 views

General User Authorization Security

I am creating a website that needs user authorization. It is my first time creating a website to go live, and also my first time trying to do any form of authorization. The following is my plan, will ...
0
votes
3answers
185 views

Do obscure image URLs prevent image harvesting?

On a Web site which requires user login, and all content is viewable by any registered user, is there any point in making obscure image URLs like "1mh9cr2m78234bc23-32xy4723nxy12.jpg" to protect the ...
35
votes
15answers
5k views

Should we protect web application source code from being stolen by web hosts through obfuscation?

Is it worth to obfuscate a java web app source code so that the web host cannot make wrong use of the code or even steal your business? If so, how should this be dealt with? How should we obfuscate? ...
21
votes
3answers
2k views

Pitfalls of using OAuth for mobile Applications

OAuth seems to be getting a lot of traction at the moment as an authorization solution for web applications and mobile applications. I'm interested in understanding what the pitfalls of using OAuth ...
3
votes
1answer
307 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
8
votes
2answers
508 views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
3
votes
2answers
374 views

Automated URL Discovering

I built a simple server containing static files at /files/ and I'm attempting to discover them using automated tools. I'm using wfuzz to brute force on the URL but is that the only way? Is there any ...
9
votes
4answers
495 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
3
votes
1answer
296 views

Can Exchange/OWA still compress static images and be immune to HTTP compression attacks?

Microsoft Exchange / OWA (Outlook Web Access) allows for three different types of compression (link for Ex2010) Compression setting Description High Compresses both static and ...
1
vote
1answer
91 views

Impact of using map APIs without SSL support? [duplicate]

We are currently developing a web application which involves map APIs. Most of the map API providers don't provide any SSL support (e.g. Yahoo! doesn't). What will be the security impact of using map ...
-2
votes
1answer
284 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
8
votes
3answers
310 views

How could the string \";alert('XSS');// be used for XSS?

I was using Burp Suite for some testing and I noticed that they included the following string: \";alert('XSS');// as an attack string for an XSS payload. How could this string be used to execute ...
2
votes
2answers
570 views

IS TDE PCI-Compliant?

According to PCI PAN can be stored in the database as long as strong cryptography is used. I couldn't find which cryptography is considered strong according to PCI. Here's the issue: I have PAN ...
2
votes
3answers
408 views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
4
votes
2answers
455 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
4
votes
1answer
364 views

Encrypted view state vulnerable?

While reading up on view state as a possible means to prevent CSRF, I came across this Microsoft Security Bulletin which states: An attacker who successfully exploited this vulnerability could ...
3
votes
2answers
170 views

How to intercept url to disallow Forced Browsing in simple Dynamic Web Project?

I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL ...
6
votes
1answer
242 views

Is it dangerous “Powered by…” tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
10
votes
1answer
202 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
1
vote
2answers
108 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
-2
votes
1answer
91 views

Is committing credit card data to this website considered safe? [closed]

Recently i came across one donation site which gets credit card info and makes donations, like the above donation site most of the site broughts donation on their own donation page instead of ...
5
votes
1answer
130 views

CAPTCHA enough to thwart user enumeration?

Say I have a site that has a user registration process where, when a user enters an email address already in use, an error message is displayed telling them that. This seems like a easy way to a ...
5
votes
2answers
531 views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
3
votes
2answers
467 views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
2
votes
1answer
98 views

Tagged website malware

A common occurance I've found when doing forensics on compromised websites is a pattern like this: <span>Clean code here</span> <!--0c0a22--> ... malware code here ... ...
4
votes
4answers
434 views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
-4
votes
3answers
262 views

PHP web application security [closed]

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). I think that I want to use self-signed SSL ...
10
votes
4answers
479 views

Sending HTTP 403 as. 200 - “Silent Identification of Admin”

A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin. Here's the scenario: Main site is target.example Attacker site is ...
1
vote
1answer
235 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
6
votes
2answers
254 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
3
votes
1answer
2k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
0
votes
1answer
370 views

In-office Flask app on port 80 - is it safe? [closed]

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache ...