New answers tagged

0

From my understanding there are 3 tracks on a card. Forget track 3 as it is not/hardly used. Swipe and sign cards (without EMV) have just track 1: %B1234567890123445^PADILLA/L.^99011200XXXX00000000?* EMV cards have track 2, which is just a copy of track 1, but without the first and second name in the middle: ...


4

On Windows and Unix - no. There may be obscure operating systems that use different path separators. To handle encoding securely there is a simple rule: fully decode before doing sanitisation. If you fail to do this, you sanitisation can be circumvented. Imagine an application that does open(urldecode(normalize(path))). If the path contains ../ then ...


0

There are a few free static analysis tools for PHP, take a look at this OWASP link for more details. RIPS is now abandoned, but according to their sourceforge page, a new version is in the works... DevBug is an online tool, but its reporting is basic. Static analysis won't find every possible bug, it should be used as part of a more complete testing ...


6

Utilizing Unicode, it's possible to encode \ and / into multi-byte characters. If the string comparison functions are not unicode-aware, there could be a bug which allows these characters through. Wikipedia has a section on this in relation to an old attack on Windows servers: When Microsoft added Unicode support to their Web server, a new way of ...


0

One of the most important laws of security: Never ever think about trusting the client. No exceptions. If your client can send any file for you and have direct access to it later, you are asking for trouble. If your files are pictures, make sure they are really pictures. Searching for .png on the extension or Content-type: image/png is not enough. You must ...


0

There are multiple layers of encryption available on iOS devices which I feel are best explained before saying what can and can't be accessed. Whole Disk Encryption For iOS 3 Apple introduced whole disk encryption where the entire hard-drive is encrypted when the device is locked. However the key for this encryption are held within the device so whole disk ...


0

I assume that there is an authentication mechanism not visible in the example URLs you have shown us, and that the traffic is protected by SSL. The only time someone can see the request but not the response is in the server logs - do you really store these differently from how you manage your application data? If you do manage access to your logs, since ...


0

Since GET request are more prone to be saved in various logs, it is considered unsafe to place private or confidential information in them. Using an ID is perfectly fine since it is anonymous data. If your user ID is not a surrogate key, then you should create a new one and use it for externally identify the user.


2

If there is no HTTPS on the pages that redirects to Qgiv, a Man-In-The-Middle could intercept the redirection page and replace the redirect to Qgiv with a redirection to the attacker's site. The attacker's site might use HTTPS and will capture the card details as the user will be unaware whether the site is the legitimate payment gateway or not. Of course, ...


1

First of all SSL and TLS are cryptographic protocols designed to provide communications security over a computer network. For your case: If the website has no SSL/TLS (I strongly recommend TLS) then all the data sent to that specific website are in plain text. If the website has no SSL/TLS but the payment form is embedded in that specific website with ...


0

OWASP Top 10 categories cover almost all the issues for the web applications. This is the list of 10 issues,however if you dig deeper you will come to know the categorization behind this. Please read https://www.owasp.org/index.php/Top_10_2013-Top_10


2

Your analysis is incorrect. Not all browsers do that, as some googling spits out an excessive blog post that seems relevant. The blog post is old and IE is old, but this should be enough proof that not all browsers encode this, as you expect. So: it is a real vulnerability, it poses a thread to your users.


-1

You're confusing what XSS is, and what it does, I suggest reading the following. The XSS is being executed on the viewer's system, not the server. The goal is to leverage your server to disaffect whoever visits it. Let's explain with an example: An attacker injects malicious code to exploit say IE8. When someone visits your server, or a forum, or gets ...



Top 50 recent answers are included