An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
0answers
9 views

Mysql Double Query Injection

I'm trying to test a challenge website. When I tried to Exploit Sql injection in it I was able to get the database name But when i tried to get the table name The query that i used ! (select 1 ...
0
votes
1answer
24 views

How to secure Web directories allowing only me to acess them

I have a web folder with some PHP files that are hosted in my website(e.g. www.mysite.com/myfiles/my_file.php) that I access and trade information using ajax for a Web App that I have. My question is,...
0
votes
1answer
16 views

Session id remain same after and before logging in asp.net application

Before logging in to the asp.net application, i checked the headers and there was already a session id in cookie header cookie: ASP.NET_SessionId=3de0es3brpfbcmvkzhkidsmt And when i logged in to the ...
1
vote
1answer
120 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
0
votes
0answers
22 views

Client side encryption over SSL

I need to handle hyper secure data collected from webforms on a site. I was thinking of using whole site SSL encryption with client side encryption of the forms data. Due to a higher than usual risk ...
11
votes
3answers
1k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...
0
votes
0answers
19 views

Error based injection in Insert query

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds to ...
-1
votes
0answers
7 views

Knowledge base solution access [on hold]

Presently working on a knowledge-based solution platform which I want to be accessed both online /offline via data and sms by searching keywords.... Please I need help with regards to the offline(sms) ...
0
votes
1answer
38 views

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible?

Does the use of mod_rewrite make PHP array injection (web parameter key tampering) impossible? Let's say we have the following URL https://example.com/product.php?id=1&action=show Now example....
2
votes
1answer
41 views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
4
votes
1answer
58 views

Does using creating a seprate firefox profile cause a seprate security context protect against XSS and DNS Re-binding?

I read here that I should use separate security profiles for different sorts of things; accessing sensitive information, doing system administration vs. opening links from emails. I know that ...
2
votes
1answer
54 views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
10
votes
4answers
17k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
45
votes
2answers
8k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: /if(now()=sysdate(),sleep(10),0)/*'XOR(if(now()=sysdate(),sleep(10),0))OR'"XOR(if(now()=sysdate(),sleep(10),0))...
-3
votes
4answers
124 views

Which cryptographic algorithm should be used on client side to encrypt file before uploading to a cloud which is only for storing purpose?

I want to develop a website which will take the files from my computer encrypt it with my key and upload it on cloud which is only for storage purpose and decrypt it after downloading it on my ...
1
vote
1answer
96 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
11
votes
1answer
2k views

Properly masking credit cards

I'm wondering if the following masking of credit card would be considered PCI compliant. ######??????#### # Is plaintext ? is redacted Expiration date is available in plaintext Is it ...
3
votes
1answer
510 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
0
votes
2answers
83 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
12
votes
4answers
5k views

Must login and logout action have CSRF protection?

I am making a web application in Django which generates and includes CSRF tokens for sessions (a Django session can be anonymous or a registered user). Should I keep CSRF protection to the controllers ...
1
vote
1answer
68 views

What is the best way to upload a file securely? [closed]

What is the best way to upload a file securely? My client is a .NET Desktop Application and server is Apache Tomcat running JSP Files, running on a Linux OS.
1
vote
2answers
61 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
0
votes
1answer
69 views

XSS payload without using < and >

I am performing testing on a site that takes input from the user and places it between <span> and </span>. However, < and > from the user are encoded as &lt and &gt. Is ...
0
votes
1answer
104 views

Is WebRTC safe for connecting random clients to each other?

I am trying to implement a chatroulette-sque app, and WebRTC seems to be the best choice as far implementing something that doesn't take a vast amount of server resources. My current scheme is to ...
0
votes
3answers
189 views

Suspicious base64 code, no one knows from where. Is it harmless? [closed]

While doing some testing on my site I found this code at the bottom of several of our pages. It appears to be encoding for a scaleable vector file of Pinterest's logo, that's all fine and good, but I ...
4
votes
1answer
145 views

JS snippets on my live project do not appear in my code residing on my production server

I have a Django website project that is live (let's call it example.com). It's a forum where users can submit comments and reply to them. It has a Postgresql database, and gunicorn + nginx reverse ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
5
votes
3answers
99 views

Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?

Latest edition of OWASP Top 10 for web application was in 2013 and for mobile applications, it is 2016. Why is it so? Can we say that the pattern in the web application vulnerabilities is settled? ...
0
votes
2answers
65 views

Security of picking unique passwords for users [duplicate]

I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
1
vote
4answers
79 views

How to use XSS vulnerability to read file on server?

Can I use an XSS vulnerability to read files on the server by injecting PHP code to the page? Ex: Use document.write to inject PHP code that read the file.
14
votes
5answers
12k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
10
votes
4answers
38k views

Why Do we Need CAPTCHA? In what case we should use it?

In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
2
votes
0answers
52 views

How can I protect my PHP app against XSS?

I am upgrading the security of an existing site (so can't redo everything with a framework that has xss functions built in), so I am looking for a way to protect against XSS attacks such as the ones ...
4
votes
2answers
52 views

Verification-less signup when user has been invited?

The typical signup procedure is of course: Alice enters email address and desired password (and possibly other data). A verification email is sent to the address Alice provided. Alice confirms her ...
34
votes
3answers
5k views

Do simple Linux servers really need a non-root user for security reasons?

Playing devil's advocate, Let's assume I purchase a Linux server from a hosting provider. I am given a password for the root user and am told I may login using SSH. The only purpose this server has ...
8
votes
2answers
1k views

What are the security risks when using free Content delivery networks (CDNs)?

I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
2
votes
0answers
60 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
5
votes
5answers
2k views

How strong is visualCaptcha?

I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives: Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right ...
0
votes
1answer
31 views

How to GET security answer values via AJAX for user edit

I have an issue where our app had an app scan issue. The application is using GET to retrieve info for a user profile page (written in HTML/Javascript). This page has the user's security questions ...
0
votes
2answers
120 views

Remote code execution vulnerability in PHP's base64_decode?

I'm trying to pentest a PHP script. This is the last line of the script that I want to exploit: Header("Location: ".TOP_DIR."/".base64_decode($_GET['ref'])."&imgid=".$_GET['imgid']); Is it ...
49
votes
9answers
6k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
0
votes
3answers
96 views

Web application penetration testing methodology

I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them. While I understand the need to identify all the ...
1
vote
1answer
42 views

RCE in a PHP script that doesn't have write permissions

So i've found a RCE vulnerability in a PHP script (it's in a file called viewfile.php). Basically, from this file I can execute whatever PHP code I want, for example, <?php echo phpinfo(); ?> ...
-2
votes
2answers
51 views

Two factor authentication + saved logins are safe?

I have two factor authentication. I understand that by using a keylogger an attacker can bypass that authentication. However I think that if I check regularly on saved logins or past logins I will ...
9
votes
7answers
5k views

Why does XSS affect so many websites?

According to an article I read 65% of all websites globally suffer from XSS. Why can't developers find and fix it? Please help me understand. I'm not from a security or tech background.
0
votes
1answer
82 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
227
votes
16answers
50k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
1
vote
3answers
57 views

When is IP blocking OSI level 7 only and what is the purpose of doing so on multiple locations?

Let's say there is an application that has IP whitelisting, all other IP's are denied. This check takes place on three different locations: iptables, .htaccess, PHP script. Now in what OSI layers ...
2
votes
1answer
215 views

How can non-secure or non-HTTP-only cookie affect security of an HSTS website?

If a website is running on HSTS and it is setting about 20 cookies. Out of those 20 cookies 15 are both secure and HTTP-only and remaining 5 are neither. In this scenario, in what ways can we ...
0
votes
0answers
21 views

Path Relative Style Sheet Injection: Switching on the quirks mode

This Portswigger article talks about PRSSI where an attacker can exploit relative URLs and trick browser to import HTML pages as stylesheets. My questions: Quirks mode must be enabled to exploit ...