An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

3
votes
0answers
57 views

Is an application backend expected to potentially log sensitive customer data when in debug mode?

As I am working on a website that asks customers to enter data such as their name, address, phone number, obviously customer data that needs to be protected. I do my best to not log such data ...
3
votes
0answers
85 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
3
votes
0answers
452 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
3
votes
0answers
413 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
3
votes
0answers
65 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
2
votes
0answers
38 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
0answers
24 views

Continuous integration SaaS security considerations

How do CI SaaS products protect themselves from bad actors? When a CI server builds and tests arbitrary code, how can we be sure this code is not some sort of exploit? Are CI companies like Travis ...
2
votes
0answers
61 views

Methods for allowing restricted access to web applications

Since I'm fully aware that allowing access for anybody to open web hosting control panel (login page), can be a little bit risky, I started to think about restricting access and allowing only for my ...
2
votes
0answers
50 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
0answers
65 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
2
votes
0answers
144 views

Code execution through JSP RFI?

I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps. I've created a vulnerable application that imports a JSP page from another server to replicate the ...
2
votes
0answers
40 views

How to safely decrypt user data in scheduled script

I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password. Upon request ...
2
votes
0answers
98 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
166 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
0answers
343 views

Session IDs number repeated under mac

I have run a penetration test on a web server. To generate session IDs with this Bash script : #! /bin/bash NUMBEROFSESSIONS=3000 for i in $(seq 1 ${NUMBEROFSESSIONS}) do curl -s -c cookie 'URL' ...
1
vote
0answers
61 views

Decryption with two-way authentication

We have a Customer who wants his sensitive user-data stored with an encryption. These are the basic requirements: Sensitive user-data is stored in a database using encryption A remote-attacker who ...
1
vote
0answers
38 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...
1
vote
0answers
47 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I ...
1
vote
0answers
44 views

User Agents in e-mail Headers

I received a COX e-mail generated on a Surface tablet. The User Agent was exactly what I expected it to be: Mozilla/5.0(Windows NT 10.0 ETC. Then I received an AOL email with User Agent: JAS STD. I ...
1
vote
0answers
101 views

Approach for testing xxe injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did : intercepted traffic using burp changed the request with ...
1
vote
0answers
106 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
0answers
116 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
1
vote
0answers
66 views

How to temporarily store data securely on a cache/relay server?

Sorry if the question title sounds unclear, I'll happily accept suggestions how to make it better. Background We are running a rather complicated SCADA/MES system with a Web interface through which ...
1
vote
0answers
66 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...
1
vote
0answers
66 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
1
vote
0answers
63 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
1
vote
0answers
153 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
0answers
53 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
52 views

Steps for creating a test environment where GUIDs are exploitable?

I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not ...
1
vote
0answers
141 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
1
vote
0answers
556 views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
1
vote
0answers
122 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
1
vote
0answers
418 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
51 views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
0
votes
0answers
28 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
0
votes
0answers
53 views

LFI to RCE when log file isn't readable

During a penetration test, I came across an endpoint which lets me include local files and I can read /etc/passwd. However I don't have permissions to read proc/self/environ and /etc/shadow. The ...
0
votes
0answers
48 views

How to perform TimThumb remote code execution over Wordpress sites?

When I was scanning a web application, Vulnerability scanner shows me that wordpress application has a vulnerability called TimThumb Remote Code Execution (referring Webshot feature). I went through ...
0
votes
0answers
22 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
0answers
44 views

Targeting a specific machine and known setup with Armitage / Metasploit?

Most introductions to armitage / metasploit start with searching for potential targets. But if you want to pen test your own setup then it probably makes more sense to target the specific machine and ...
0
votes
0answers
63 views

UTF-7 JSON hijacking on Microsoft IE and Edge

After some research, I saw an answer on StackOverflow saying that it's still possible to perform a UTF-7 JSON hijack using Microsoft IE and Edge browsers. If yes how can it be done? I really need an ...
0
votes
0answers
39 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
0
votes
0answers
43 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all ...
0
votes
0answers
29 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
65 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
0answers
40 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
0
votes
0answers
71 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
0
votes
0answers
31 views

Struts standard administrative actions unprotected - so what?

In an Apache Struts deployment, the struts-config.xml has the following stanzas: <!-- The standard administrative actions available with Struts --> <!-- These would be either omitted or ...
0
votes
0answers
125 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
0
votes
0answers
147 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...