An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

0
votes
4answers
63 views

Difference in Web Language Compilation and Execution

I'm trying to get a handle on the difference between certain web languages and the security implications of each. Specifically this is with regards to executing code in the context of the web browser ...
16
votes
4answers
5k views

Should sensitive data ever be passed in the query string?

Should sensitive data ever be passed via the query string as opposed to the postback? I realize that the query string will be encrypted, but are there other reasons to avoid passing data in the ...
3
votes
2answers
1k views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
0
votes
1answer
81 views

What are the best practices to store payment processor dev/API keys?

I am integrating with multiple payment processors which have their set of public/private keys. This would be used in conjuction with per user keys, to bill clients. I was wondering what is the best ...
2
votes
1answer
73 views

Suspicious GET request parameter list? [on hold]

Is there a public list of common suspicious GET request parameter ? I mean - SQLi, Command Injection, Admin access etc. I am interested in such list, to be used to detect suspicious GET request in ...
-1
votes
0answers
57 views

which programming language is best for developing vulnerable web application? [on hold]

I want to develop a vulnerable web application. I am just confused which programming language(python, java, php etc..,) is easy and best suitable to develop vulnerable web application.
0
votes
2answers
110 views

Restrict website access

I want website (A) to only work if a visitor came by clicking a link from a specific other website (B). Initially I thought of using the document.referrer from website A to check whether website B is ...
1
vote
0answers
49 views

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...
3
votes
0answers
75 views

Pawn in a nefarious porn marketing campaign?

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list ...
1
vote
2answers
180 views

Dangers of robots.txt?

During a recent scan of my website, a robots.txt file was found and in it contains Disallow: /subsite1/ Disallow: /subsite2/ In order not to show any paths in robots.txt, as I am afraid that ...
1
vote
1answer
41 views

What are some useful tags and payloads for HTML injection on CSP-protected sites?

I'm pen-testing a website that fixed most of its XSS vulnerabilities by just adding a Content Security Policy. There are still HTML injections in several places. I've tried to get a ...
5
votes
4answers
2k views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
12
votes
3answers
11k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
0
votes
1answer
180 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
-2
votes
1answer
42 views

Is VBScript an actual tool to attack users?

While I was reading a ASP.NET book I found that is supports VBScript but this made me think if VBScript is still a tool of hackers to attack other users, I guess only Internet Explorer users, As I ...
0
votes
1answer
65 views

Clarification on a website security

I am new to work on website handling and here are my questions. 1) How can I ensure that the pages accessing is secure enough for data transmission , sql injection and several other attacks. 2) How ...
14
votes
5answers
15k views

How can I find subdomains of a site?

One of the things I need to do from time to time is to find subdomains of a site for example. Starting with example.com sub1.example.com other.example.com another.example.com I'm ...
4
votes
2answers
12k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
2
votes
1answer
167 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket ...
2
votes
1answer
264 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
1
vote
0answers
47 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
-1
votes
3answers
74 views

Whats the most secure way to save user authenication Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access to this web application. All of them will use really ...
2
votes
1answer
59 views

Use the server's key to digitally sign the HTML content it delivered?

Is there any way to prove that a HTML page was delivered to my browser, and not modified in any way, after it was delivered over TLS? I need to prove integrity, and authenticity of the sender, ...
-1
votes
0answers
56 views

Safely release my ownCloud to the Web?

I have a running ownCloud installation in my LAN. I want to make it accessible from the internet. I am not an expert in security questions. What would be a good way to put my ownCloud online? ...
1
vote
2answers
107 views

Which unicode (control) characters should a web app (not) accept?

THIS IS NOT ABOUT XSS Threat: Mallory enters control characters in a public web application text field that other users might use in a terminal program (via copy+paste or by running a script). ...
0
votes
1answer
116 views

How to bypass XMLHttpRequest header protection for a CSRF attack

A client is only submitting forms using XMLHttpRequest with the use of a header (X-Header: [any value would be correct]) to protect against Cross Site Request Forgery attacks. I know this is not the ...
1
vote
2answers
160 views

How to keep database record secret even from developer having access to it?

Imagine a web-based email app, such as GMail. The email should only be readable by the sender and the recipients. No one else, including the developer having access to the database server or ...
3
votes
2answers
106 views

How secure is MD5 for TLS message authentiaction?

I was recently viewing a website and saw its certificate info as follows: Given that MD5 is badly broken and not recommended for hashing, how good is it for use in TLS? And why?
1
vote
1answer
261 views

Is opportunistic encryption support optional for HTTP/2?

I'm a little unclear on the subject of opportunistic encryption of the HTTP:// address scheme in HTTP/2. According to the bug report, it looks like it's kinda optional, and an afterthought: ...
12
votes
3answers
3k views

Is it dangerous to show all the JavaScript functions in my web application? [duplicate]

Right now I'm developing a web application and it uses a lot of JavaScript functions so I'm putting all of them in different JS files to access from the HTML, but the functions are "easy readable" so ...
1
vote
1answer
97 views

Is it a security risk to have 'Control + j' functionality enabled in a production instance of PeopleSoft?

The control + j feature within PeopleSoft outputs a list of potentially interesting data for a potential attacker. The feature is generally used to aid in debugging. Here is a the [censored] output ...
2
votes
0answers
127 views

Is my server being used as a proxy or being attacked?

I have an Ubuntu, Apache, Passenger, and Rails 4 project on AWS EC2. I am a beginner full stack developer and am unfamiliar with the security and server side of my project. Recently, my site was ...
4
votes
2answers
326 views

How to work effectively to win bug-bounties?

I really want to prove myself (to my parents) by winning a proper bug bounty How should I best prepare for this and go about actually finding bugs? Edit So can anyone give some web sites ...
25
votes
3answers
2k views

How long should an e-mail address confirmation link last and why must it expire at all?

After a user registers an e-mail is sent to them with a link they must click on to activate the account. I know other sites have a limit on the amount of time the user has to click the link, else the ...
2
votes
5answers
199 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
2
votes
1answer
46 views

Secure the config file of a service

I have a service running on a linux box, started with upstart, that runs as user "the_user", it has to read a config file. Having the file owned by root would make things more secure, but would ...
1
vote
1answer
88 views

How can I tell if a user is access website with a forged IP?

there is a username (USERX). It's a suspended user. It it appearing in my user login files. It always appears in the middle of someone elses attempt (USERA) to reset their password, and WITH USERA's ...
0
votes
2answers
50 views

How to exploit Open Redirect Vulnerability?

Redirect/Forward attack code: <?php $redirectUrl = $_GET['url']; header("Location: $redirectUrl"); ?> exploit (Sends user from your page to evil page) : example.com/?url=example.com/faq.php ...
19
votes
2answers
4k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
3
votes
3answers
599 views

Flash ignores Content-Type header, allowing XSS?

I recently read that the Flash plugin ignores the Content-Type header in certain circumstances. In particular, you can give Flash a URL, and the Flash plugin will happily fetch the content at that ...
0
votes
2answers
57 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
2
votes
3answers
512 views

Tracking IP address to prevent abuse without logging user metadata

I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information. I am constructing a web app that allows for secure messaging. In part ...
1
vote
1answer
78 views

How to pen-test RAP applications

Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google ...
43
votes
6answers
6k views

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...
3
votes
1answer
145 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
1
vote
0answers
22 views

JKS - Keystore protection and configuration file

It appears that Java Keystore is often used by web server using a configuration file, with the password opening the JKS written in it and also the password protecting the specific entry. How could ...
1
vote
1answer
108 views

“It is safe if only Port 443/HTTPS is accessible from Internet!” Is it? [closed]

I was in discussion with a vendor to implement a backup solution and as flexible as most cloud applications nowadays, it needs to be access from anywhere on Internet without VPN or any special ...
0
votes
1answer
118 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
21
votes
5answers
3k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your php application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps ...
0
votes
2answers
147 views

Is this the most secure encryption/hashing system? [closed]

I've been doing some research regarding password security and after reading several topics and the Kerckhoff's principle. I came up with what I believe is a really secure system regarding online ...