An application that is accessed over a network such as the Internet or an intranet using a browser.

learn more… | top users | synonyms

6
votes
1answer
53 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
3
votes
1answer
309 views

Is Two-way SSL sufficient for Multiple web servers communicating to each other?

I have a fixed number of web servers. Each web server represents a company and the users of the company talk to their assigned web server. I have this setup to decentralise the databases. So if one ...
3
votes
1answer
303 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
1answer
157 views

Encrypting data before sending to SaaS tool and decrypting on browser view

I'd like to send data to a SaaS tool, where the data is stored in the cloud. I'll use Google Analytics as an example, but it applies to any similar service. Google Analytics does not allow you to ...
1
vote
1answer
57 views

How to only let end user to access data in a web app

I've been read a lot about common encryption methods used in a django app. However, my requirements are very different. I am looking for a way to encrypt my web app data so only the owner of the data ...
1
vote
1answer
44 views

Security concerns of HTML echo endpoint

Consider a website with an endpoint that, when a payload of an HTML string (full document or partial segment) is POST to it, the server will transform the payload (and sometimes no transform is ...
1
vote
1answer
78 views

Is use of HttpServletRequest.getQueryString() for a response header vulnerable to response splitting?

I've been told that using HttpServletRequest.getQueryString() in a response header makes my application susceptible to HTTP response splitting attacks, but I just don't see how. It's clear in the ...
7
votes
0answers
73 views

Using certificates to secure

I'm working on an application that comprises of a C# WebAPI (on Azure Websites) and a native mobile app. Essentially, a client creates a series of messages using a Web interface and these can be ...
4
votes
0answers
69 views

Secure sensitive information sent from Server to mobile App

Okay, I have a rails backend server which is pretty much just a database server. The database contains information about different types of a substance, and that substance's confidential inherent ...
3
votes
0answers
86 views

What is pseudo-encryption key vulnerability?

An organization in a related business was recently hacked. The hackers downloaded several GB worth of files with private information and posted it on the Internet. The news article states: “They ...
3
votes
0answers
1k views

Apache vs Jetty with regard to Security

I am trying to design the architecture of an app that will run on an AWS Linux AMI, inside of a Docker container. The app will deal with sensitive financial data, so security is top priority. The app ...
3
votes
0answers
374 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
3
votes
0answers
370 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
3
votes
0answers
61 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
2
votes
0answers
42 views

Methods for allowing restricted access to web applications

Since I'm fully aware that allowing access for anybody to open web hosting control panel (login page), can be a little bit risky, I started to think about restricting access and allowing only for my ...
2
votes
0answers
34 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
2
votes
0answers
98 views

How do ad networks and analytics providers encrypt/hash their traffic?

I am trying to observe what types of information android apps are sending to ad networks that are integrated into apps. I used Fiddler to decrypt the https traffic. However, some ad networks seem to ...
2
votes
0answers
41 views

userWorkstations attribute in AD preventing users from logging into WebApp

For some of our users in AD, we have set userWorkstations attribute to restrict access to other machines. But this is preventing those users from logging into WebApplications (around 50+) protected ...
2
votes
0answers
99 views

Code execution through JSP RFI?

I'm working on improving my understanding of RFI (Remote File Inclusion), especially in JSP apps. I've created a vulnerable application that imports a JSP page from another server to replicate the ...
2
votes
0answers
37 views

How to safely decrypt user data in scheduled script

I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password. Upon request ...
2
votes
0answers
94 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
332 views

Session IDs number repeated under mac

I have run a penetration test on a web server. To generate session IDs with this Bash script : #! /bin/bash NUMBEROFSESSIONS=3000 for i in $(seq 1 ${NUMBEROFSESSIONS}) do curl -s -c cookie 'URL' ...
1
vote
0answers
31 views

Approach for testing xxe injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did : intercepted traffic using burp changed the request with ...
1
vote
0answers
101 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
1
vote
0answers
47 views

How to temporarily store data securely on a cache/relay server?

Sorry if the question title sounds unclear, I'll happily accept suggestions how to make it better. Background We are running a rather complicated SCADA/MES system with a Web interface through which ...
1
vote
0answers
64 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...
1
vote
0answers
61 views

Potential security issues in a two-part upload process

I use a pre-signed URL approach for uploading files to a private S3 bucket. A CloudFront distribution is configured to use this bucket as the source. The upload process is only available to ...
1
vote
0answers
59 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
1
vote
0answers
140 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
0answers
49 views

Adding intermediate page to navigate out of the current site

Can someone recommend me the best design to use to navigate out of the site. Here are the steps to navigate out of the current site. 1)Show the intermediate page warning the user that, they will be ...
1
vote
0answers
154 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
1
vote
0answers
145 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
1
vote
0answers
52 views

Steps for creating a test environment where GUIDs are exploitable?

I have been using GUIDs as un-guessable tokens in various situations for some time. I came across this question/answer which seems to suggest that while this is ok in some situations, it should not ...
1
vote
0answers
133 views

Industry average for security as a percentage of product budget?

Lets assume the product is pure software or a blend of software and cheap commodity hardware. Is there any work showing what the average industry spending is on just the security aspects as a ...
1
vote
0answers
510 views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
1
vote
0answers
116 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
1
vote
0answers
357 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
22 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
0
votes
0answers
24 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
45 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
0answers
36 views

Widget to client web encryption on an uncontrolled LAN

I asked a broader question related to this on serverfault, but I think probably the specific case I'm thinking of might be best considered here. My basic problem is this: I am providing physical ...
0
votes
0answers
59 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
0
votes
0answers
26 views

Struts standard administrative actions unprotected - so what?

In an Apache Struts deployment, the struts-config.xml has the following stanzas: <!-- The standard administrative actions available with Struts --> <!-- These would be either omitted or ...
0
votes
0answers
110 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
0
votes
0answers
115 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
0
votes
0answers
116 views

Bypassing Change Name Uploader

I have read all of the questions available on SE about bypassing the change name uploader. Consider an uploader which changes the file name each time you try to upload a file. The only allowed formats ...
0
votes
0answers
114 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
0
votes
0answers
108 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
0
votes
0answers
184 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
0answers
99 views

Should I be concerned about the following URLs that were tried to open on my webpage?

I don't know if this is some injection attempt or a weird bot or what ever. An IP opened several pages within my Drupal 7 website with the appendix ...