An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
1answer
50 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
2
votes
2answers
29 views

W3af and automated vulnerability scanners vs manual testing

How effective are tools such as w3af in looking for web app vulnerabilities compared to looking for vulnerabilities manually? Are they able to find all vulnerabilities from OWASP top 10 such as ...
0
votes
0answers
28 views

Ensuring security of web based games and contests

I have previously analysed an online contest and found that it was trivial to reverse engineer the handshake process since it was all done in javascript. As a result, it was possible to code an ...
1
vote
1answer
43 views

How zip symlink works?

I've seen lately some bugs that used zip symlink technique , can anyone explain how this vulnerability works , how attackers use it to exploit applications? Thanks
12
votes
6answers
1k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
0
votes
1answer
112 views

Securing user postal address in a database?

I've been assigned a web project that deals with shipping goods between two parties. I am unsure what a secure database scheme (if any) would be for storing the recipient's postal address and whether ...
3
votes
1answer
64 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
0
votes
1answer
75 views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
-4
votes
2answers
72 views

Which is more in demand Web or Wireless pen-testing.? [on hold]

I am familiar with both and wanted to know what company's are most interested in and will pay the most for. Please do not down vote this question, I think it is a good question for people who want to ...
0
votes
1answer
41 views

Is address information sensitive for companies or individuals during registration?

I am designing a web site that contains external suppliers to register and keep their information with the company up to date. We already have a db with EIN, SSN numbers and their addresses. One of ...
1
vote
2answers
88 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
0
votes
1answer
38 views

What technique should I use to prevent unpermitted access to my REST API

I need to build an REST API that can be accessed via HTTPS when given valid credentials. How should I implement those credentials? I am looking for advice whether I should use plain old passwords, ...
3
votes
1answer
723 views

Salt usage for Spring security?

I use the Spring security for Java web applications and I have written an authentication provider which is working without salt and now I want to either add salt or alternatively use the built-in ...
0
votes
1answer
100 views

How is Cross Site Flashing performed?

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
2
votes
1answer
701 views

Are there modules to harden Symfony 2 sessions?

We're looking at building a new app on top of Symfony 2, but security is our top priority. After digging around a bit, it seems that there are a number of built-in options for Session management (eg ...
1
vote
2answers
95 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...
11
votes
5answers
27k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
13
votes
2answers
2k views

Best practice in web application security authentication to avoid bruteforce attack

I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that ...
4
votes
3answers
165 views

Does PHP have a XSS API?

ASP.NET has a cross site scripting API by default, however does PHP have a cross site scripting prevention API?
-4
votes
2answers
50 views

What is the best exploit of XSS within 100 characters? [closed]

I found a vulnerable php script on my website. The script allows an user input (textarea), which is not encoded by htmlspecialchars(). Therefore it is possible to add html and javascript code. The ...
3
votes
1answer
125 views

XSS: terminology [closed]

Where does the name XSS come from? Why "cross-site"? Also, the book "The Web Application Hacker's Handbook" says that the name XSS is a misnomer when talking about "stored XSS" or second-order XSS ...
11
votes
1answer
686 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
2
votes
1answer
82 views

Best practice in securing a web server and an offsite worker

Suppose I'm hosting a web server and a separate box offsite that crunches data. The web server interacts with the worker using the worker's API over port 2888. What would be the design of a secure ...
4
votes
2answers
254 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
0
votes
1answer
201 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that tracks IP addresses to prevent abuse, ...
3
votes
4answers
704 views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
1
vote
0answers
36 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
0answers
47 views

Reflected file download Scenario

I'm making a Java-based web application that is intentionally vulnerable to Reflected File Download (RDF). White paper is here I read the requirements of reflected file download vulnerability as ...
3
votes
2answers
97 views

How to protect my API endpoints

I have an API written in nodejs and I have a frontendapp written in angularjs. I want my API to be called only through my frontendapp and not from any other source. e.g. I have an endpoint called ...
2
votes
1answer
202 views

Automated tools to test Struts OGNL security vulnerabilities

I'm looking for a way to find Struts2 OGNL vulnerabilities (specifically http://www.cvedetails.com/cve/CVE-2013-4316/ and http://www.cvedetails.com/cve/CVE-2013-2251/. ) I know that attackers ...
16
votes
2answers
2k views

JavaScript Injection using Man in the Middle Attack

Suppose I am connected to a wifi-hotspot hosted by a malicious attacker. Further, suppose that I am accessing a login page of an fictitious email site tmail.com over insecure HTTP connection. My ...
-1
votes
1answer
46 views

Where do I start securing my system? [closed]

I am working for a company with perhaps the least security possible. We have servers, databases, web applications, and websites that are all unsecured. There only exists one account: root, which ...
97
votes
2answers
54k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
2
votes
1answer
189 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
24
votes
2answers
2k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
0
votes
1answer
83 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
2
votes
3answers
97 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
36
votes
4answers
10k views

Why is the same origin policy so important?

I can't really fully understand what same origin domain means. I know it means that when getting a resource from another domain (say a JS file) it will run from the context of the domain that serves ...
1
vote
1answer
75 views

Securing user's data against an attacker that may gain server root

I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will. A user's secure data should only be visible to her, ...
2
votes
1answer
144 views

Is preventing XSS/HTML Injection really this simple?

A colleague suggested to me just to prevent letter characters from occurring immediately after an opening angle bracket as a way to protect against XSS and HTML injection. Obviously, this doesn't ...
1
vote
1answer
54 views

What is the difference between OWASP PHPSEC and PHP-ESAPI?

On the surface it looks like both libraries are designed to preform the same functionality with similar "drop-in" capabilities. Are there differences that I need to take into account when making a ...
27
votes
5answers
4k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
2
votes
0answers
54 views

Burp Suite Active Scanning Wizard options

I have been making use of Burp Suite's active scanning functionality for some of my recent web application assessments and I had some questions about the active scanners ability to remove urls from ...
1
vote
1answer
47 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
1
vote
1answer
365 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
4
votes
4answers
870 views

Why is this response splitting attack not working?

I'm working through OWASP's "WebGoat" (version 5.4) vulnerable web application, but I'm getting stuck on one of the earliest lessons which is to do with HTTP response splitting. I've looked in all ...
2
votes
3answers
168 views

How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

While using Firefox to browse my forums, I noticed that a malicious user posted an image (via hotlinking, not by uploading to my server) with the extension .png which complies with the forum rules ...
6
votes
5answers
5k views

Obfuscating JavaScript code

Some Flash developers are afraid of JavaScript. Their point of view: Stealing JS source code is effortless, one would just 'view source' and copy it. Yes, you can decompile Flash bytecode, however it ...
1
vote
1answer
59 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
0
votes
2answers
78 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...