Tag Info

New answers tagged

0

An Android client application should not be vulnerable to CSRF attacks (except for a browser application like Chrome, but it is not the application here that is vulnerable, it is the website being browsed). This is because for an CSRF to succeed, the client needs to be able to send cookies to the vulnerable website. An Android application would only access ...


1

Burp Suite's extender has a couple of CSRF plugins which might help improve your experience. They either attempt to spot requests with no CSRF protection token as part of the passive scanner, or perform active checks to see if the requests can be performed (i.e. get a 200 OK response) without the tokens. You might also be interested in zaproxy, which is an ...


1

This is not a vulnerability as shown as the system is simply taking the value of the first parameter. An HTTP Parameter Pollution (HPP) vulnerability is when you can use the behaviour of the application to some advantage. For example, in my answer here a toAccount parameter is injected: amount=1000&fromAccount=12345&toAccount=99999 This is known ...


1

I believe this attack if successful is called as HTTP Parameter Pollution(HPP) and the ability to inject parameters is called HTTP Parameter Injection. More on that at: https://www.owasp.org/index.php/Testing_for_HTTP_Parameter_pollution_%28OTG-INPVAL-004%29 Now, as far as the scenario you described is concerned, in my experience, a lot of servers will ...


2

There's always been a trade between UI and security. To my knowledge, CSRF Tokens at login page is to protect against brute-force attack, which might also be achieved by other means like Captcha verification. It may also be abused, if possible, to make victims login to attacker's account and do some nasty stuff, but that's rare, I guess. The best, I think, ...


2

(this question might be better suited for the User Experience site) Change the error message to "We need you to log in again because you were inactive for more than XX minutes." Problem solved. Let the user know how long they have exactly, because if they have to submit a complex form they need to be aware that they will need to collect whatever ...



Top 50 recent answers are included