An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

4
votes
4answers
1k views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
2
votes
3answers
183 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
6
votes
5answers
6k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
0
votes
2answers
201 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
1
vote
1answer
284 views

Checklist for securing JBoss

Is there a security checklist for auditing JBoss configuration files ? CIS and DISA provides security checklist only for Tomcat and Apache server. Is there any other ressources ?
0
votes
0answers
39 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
4
votes
4answers
1k views

What XSS attacks doesn't “Reflective XSS Protection” defeat?

Its been quite a while since I have played with cross site scripting vulnerabilities but today I came across a website today that was crying out to be tested for a basic XSS vulnerability. So ...
3
votes
3answers
515 views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
2
votes
2answers
465 views

Security concerns with iframes

Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated ...
8
votes
1answer
499 views

I've discovered a vulnerability which can reveal personal information for multiple websites. How to go about it?

It's not so much a technical vulnerability, but rather a sloppy security practice by a web design consultancy. They use a CMS which they've augmented with an admin login. As it happens, the admin ...
4
votes
3answers
311 views

Reflected XSS through cookie value?

I have always looked at reflected XSS as an attack that would take place through a URL. So, for example, you would have a URL like below: ...
1
vote
1answer
89 views

Is having a GUID in a https url secure enough? [duplicate]

Is having a GUID in a https url secure enough? Are there any security risks of using this way of authenticating users? https://mywebsite.com/......?Guid=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Also what ...
2
votes
2answers
350 views

Web Application Vulnerability Scan- False Positives-Recognizing and Eliminating

Web Application Vulnerability and Potential False Positives As a Penetration Tester the application vulnerability scan is a major part of any penetration testing methodology. In the Application ...
-1
votes
1answer
102 views
0
votes
1answer
65 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...
4
votes
1answer
171 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
0
votes
2answers
137 views

How did an attacker spoof (or add to) this myspace's login form?

In the attack detailed here, I see that a hacker has actually added a malicious post link. What I do not understand is how the attacker added it to the actual myspace.comdomain. Obviously this is an ...
1
vote
1answer
617 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
1
vote
3answers
194 views

Will checking the CSRF token on the header and the form's hidden be enough?

From what I read here, CSRF tokens from the cookie header cannot be read because of the same-origin policy. Is comparing the CSRF token on the cookie header with the form's hidden element be ...
1
vote
1answer
214 views

Is XSS prevention only on the frontend enough for JSON services? [duplicate]

We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by ...
1
vote
1answer
99 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
6
votes
4answers
5k views

Can Central Authentication Service (CAS) do authorization?

I have a few web applications that I'm trying to tie in via CAS, but I'm a little confused about the authorization, which I read CAS isn't supposed to do. Yet, I see something like groups, but don't ...
3
votes
1answer
63 views

Enabling Unsigned ActiveX

A third-party wants to provide a web app which they say only works if we enable unsigned ActiveX (unfortunately users are required to use IE). I understand what 'signing' is, as well as the basic ...
-1
votes
1answer
108 views

How strong exactly is a 3gbps booter?

I heard some people talking about how they had a 3 gigabyte per second drddosser. That sounds all fine and dandy, but what can that actually do? Could it take down a website? To what extent?
2
votes
1answer
221 views

How secure are PHP sessions?

Should i worry about securing PHP sessions for my users? How do hackers steal the sessions? The information users of my site can view is not at all sensitive and if viewed or modified by a hacker ...
3
votes
3answers
630 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
1
vote
1answer
234 views

'Ghost' access to a php file on a web server

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them. ...
5
votes
3answers
1k views

Can CSS file contain malware? [duplicate]

I know that javascript files can contain malware. However, I am not so sure about CSS files. They only affect how the page is displayed, right? I know that css files can be used for clickjacking but I ...
2
votes
1answer
2k views

Calling JavaScript functions from within a Style tag XSS

I've identified an XSS in a client's application where they've failed to properly sanitize a variable. The application, however, is written in ASP.NET 2.x and they have request validation turned on. ...
1
vote
3answers
249 views

Capture query to MySQL in Server

I want to capture queries to MySQL from my web-application on my Linux-based Server. MySQL port is 3306 and my web-application in on port 8181. So I started using tcpdump as follow: # tcpdump -x ...
1
vote
1answer
108 views

How can non-secure or non-https-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and https-only and remaining 5 are neither. In this scenario, in what all ways can we ...
1
vote
2answers
1k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
1
vote
1answer
177 views

Adding hash value to user supplied URL in a web application: any security benefit?

We administer a Java web application from an external supplier where we have access to the source code. The user is able to provide an external URL which is stored in a database and later on embedded ...
3
votes
5answers
6k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
0
votes
0answers
157 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
4
votes
1answer
109 views

Is limiting access to a web script with .htaccess secure enough when that script can run arbitrary commands?

Okay, so I don't have much HTML experience, but I recently started working on a project with a group of people that involves regularly manipulating files in a web server. I would like to work on this ...
2
votes
2answers
195 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
-1
votes
2answers
115 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
0
votes
0answers
139 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
2
votes
3answers
171 views

Are externally referenced libraries (CDN's) a security issue?

Today I read about an alleged malware attack targeting jQuery.com A german blogger who is what I would call an expert on IT security stated that Any website that is working with ...
-2
votes
1answer
61 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
-1
votes
3answers
183 views

Building a website with MAXIMUM website security [closed]

Well lets assume that someone is intending to build a website that will contain THOUSANDS of sensitive records such as credit cards etc. What would be a good checklist that would ensure that the ...
1
vote
1answer
162 views

Worst-case scenario OPEN URL REDIRECTION and why google not covering it in bug bounty

OPEN URL REDIRECTION as per in my opinion can be proved very dangerous by crafting attacks such as phishing. But it seems like google thinks it as a very low level bug and does not provide any ...
1
vote
0answers
112 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
5
votes
2answers
1k views

Generating one-time tokens from API-key?

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site. I intend to distribute secret API-keys to ...
8
votes
4answers
1k views

Can anti-CSRF token prevent bruteforce attack?

I am not much experienced with brute force attacks but I was wondering Suppose, you have a website www.example.com and you want to do brute force attack on that login form but that login form is ...
2
votes
1answer
73 views

What is x-frame content?

I tried scanning websites for vulnerabilities and found most of them are with low risk x-frame content and "nosniff" what is it exactly?
0
votes
1answer
514 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
3
votes
2answers
348 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...