An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
1answer
97 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
21
votes
3answers
3k views

What are the disadvantages of implementing HTTP authentication in a web application?

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
-1
votes
0answers
40 views

Amazon login request on port 843 to fnes.amazon.com [on hold]

I wonder if anybody knows why amazon, on their login page (both for amazon.com and for aws console login) does a request on port 843. This request is apearantly to name fnes.amazon.com My question is ...
-1
votes
0answers
19 views

Drawbacks of OpenVAS [on hold]

Delibrate on any major vulnerability detection capability missing in OpenVAS compared to its commercial alternative solutions. Please.
2
votes
2answers
2k views

XSS cookie stealing without redirecting to another page

I'm practicing in VM following the OWASP guide. I know that is possible to steal the cookie by redirecting to "False" page etc. but I would like to steal the cookie without redirecting on another ...
2
votes
1answer
154 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
3
votes
1answer
124 views

How secure are Google (Drive) Web Forms?

My child's school is using a Google Web Form to collect student and parent information, including occupations, addresses, maiden name, birthdays, contact information, and who the child resides with. ...
-1
votes
0answers
29 views

How to install webgoat on ubuntu with lamp server [closed]

Can any one give me the breif instructions for how to install Webgoat on Ubuntu 14.04 (not a server) step wise I am facing problem with setting java_home variable to java 1.5 jdk
1
vote
3answers
94 views

Prevent someone from using your site for phishing?

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then ...
3
votes
2answers
325 views

How to keep someone from analyzing our site?

For the past days some script kiddie has been scanning our site with w3af and some basic manual checks. Although I know the site is "secure" because I analyze it almost everyday, I'm not perfect and ...
4
votes
2answers
135 views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
4
votes
3answers
503 views

is it safe to allow external images to be attached to Blog or any Web content?

I am filtering all images that attached to any content of my blog: Check for file extension. Check content type using $finfo = finfo_open(FILEINFO_MIME_TYPE); I also save the image temporary on my ...
35
votes
7answers
3k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
21
votes
9answers
2k views

Is a web application firewall necessary if the application is secure?

Recently I've been reading about Web application firewalls and the fact that they protect against most frequent attacks like injections, XSS or CSRF. However, a good application should already be ...
13
votes
3answers
3k views

Is encrypting SALT with given user's password more secure?

I'm learning about web security. I understand that passwords are hashed with salt. Why aren't the salts encrypted with same user's password? Cloudn't this make password cracking much harder? ...
1
vote
0answers
45 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
1
vote
2answers
132 views

Can my University see what Stack exchange account I am logged into?

I have to log into an account to use the university internet, so I imagine they can see all the sites I view, but can they see what account I am logged into, and can I do anything to hide this?
1
vote
1answer
192 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
1answer
74 views

Securely send password to script as parameter

I have an expect script on my server which opens a WebDAV connection to another server, expects a username and password, and then sends $arg1 and $arg2 as the username and password respectively. ...
0
votes
0answers
36 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
0
votes
1answer
64 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
100 views

Execute a remote PHP shell which is inside a file I dont have permission to access

Hi need some help here. I am trying to exploit an unsanitized file upload with a PHP backdoor. Basically the file uploads successfully and I can see my backdoor inside the web applications /images/ ...
1
vote
2answers
116 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
-2
votes
1answer
63 views

Scanner / tool to generate a list with all forms and input fields of a website [closed]

I'm not very experienced with information security but know some basics about injection attacks and other web based attacks. Is there a tool / crawler to find all forms and input fields of a whole ...
1
vote
1answer
84 views

Is Payment using an iframe more secure than using as Javascript library?

Traditionally most Payment providers only provide Hosted Payment Sites via redirect or iframe. But now an increasing number is also supporting payment integration via a Javascript library. I imagine ...
7
votes
4answers
4k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
73
votes
17answers
8k views

Does an established ssl connection mean a line is really secure

From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
1
vote
1answer
34 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
2
votes
1answer
120 views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
1
vote
2answers
71 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
0
votes
1answer
51 views

Secure Django Application

What are some of the recommended configuration settings to secure your Django application? i.e. best practices for settings.py file. I researched and came across some: SESSION_COOKIE_SECURE = True ...
0
votes
1answer
52 views

Securing user postal address in a database?

I've been assigned a web project that deals with shipping goods between two parties. I am unsure what a secure database scheme (if any) would be for storing the recipient's postal address and whether ...
2
votes
1answer
77 views

How does Mylar ensure encrypted data remains secure even if the live app code is compromised

Because Mylar does the decryption in the browser, the key is never stored on the server. Nice. This moves the threat to the browser, where, if the attacker is able to get a malicious script to be ...
1
vote
2answers
77 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
5
votes
3answers
323 views

Escaping rich text editor output

When having a rich text editor on a web application, what is the best way to escape HTML entities and prevent XSS attacks but keep the formatting (<b>, <i>, <u>, ...etc.) ?
5
votes
4answers
542 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
1
vote
2answers
124 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
2
votes
1answer
172 views

Are there HIPAA requirements to encrypt our database hosted in AWS

I'm developing Medical Billing & EHR Software. On completion we are planning to use AWS for hosting and thus provide SAAS. Do we need to encrypt the MySQL database in order to keep HIPAA ...
54
votes
1answer
3k views

“Allow __ to be fullscreen?”

I have been asking myself for a while what's the purpose of that popup showing up in pretty much all the modern browsers upon entering the full-screen mode of a video or website. It appears to be a ...
13
votes
6answers
7k views

Disable insecure/dangerous PHP functions

Typically my job description limits me to code-review of web applications. More recently I've been asked to assist with some server-side PHP optimization where, although I am familiar with it, I lack ...
1
vote
2answers
80 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
5
votes
3answers
417 views

What exactly determines what version of SSL/TLS is used when accessing a site?

If I click on the little lock icon in Chrome it says that the site in question is using TLS v1. I also checked using openssl and was able to hit the site using TLS1, SSL2 and SSL3. From what I ...
-1
votes
0answers
31 views

Considerations for distributed authentication with online/offline app?

I am developing an application that will exist across three groups of machines: 1) A central web server. This is a publicly available site accessible via http. 2) Browser-based clients. Any number ...
6
votes
2answers
665 views

What are best practices for implementing ACL

I have a website that has certain menu items that need to be hidden from end users. The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM ...
1
vote
3answers
120 views

Where can I find a list of frowned upon usernames for web sites?

There are some usernames that shouldn't be allowed to register on online services, for example: administrator, admin, root, system, owner, hostmaster, webmaster, sitename or sitenameadmin As far as ...
1
vote
5answers
100 views

Reply to email or text as verification?

I've seen plenty of websites that, during the signup process, require me to verify my email address or cell phone number by clicking an emailed link or by entering some one-time-use code that's been ...
9
votes
2answers
3k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
1
vote
3answers
116 views

What is Reflected XSS?

Fed up with the following definition. Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that ...
0
votes
1answer
97 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...