Hot answers tagged

89

If the site is based on ASPX files, then it is more than likely that this is a ASP.NET application - most probably hosted on IIS. IIS has a very simple checkbox to enable Windows Integrated Authentication. IE, on Windows 7, will by default send your credentials to any web server in the local intranet. (This is not your password, don't worry, but it is ...


72

The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec: User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting ...


45

The problem is that this one setting simultaneously controls the behavior of two similar but sufficiently dissimilar functions in the browser such that an optimal result is difficult to achieve. First, we have what you might call "smart" or "naïve" or "automatic" auto-complete. This is the original auto-complete technology. As you fill in forms on various ...


44

Assuming that you are coming from a BT connection, it's possible that this is part of the BT parental controls program. There is a discussion of a similar looking pop-up here , which seems to tie into what you're seeing, and also a thread here on the BT site which has a link to a process to turn off that setting. To test this theory you could log into ...


34

When I do pen tests, I report an issue if a form field asks for sensitive data (e.g. a credit card number), is NOT a password field, and does NOT have autocomplete=off. The rational is that browsers manage autocomplete for passwords quite sensibly: they give the user the option of whether to store the password, and (most) users can make a sensible decision. ...


32

That's incredible simple, and a really old trick. Create a different survey for each department, even if the surveys have the same questions. Everyone that answers to Survey X is from Department A. Everyone that answers to Survey Y is from Department B. Then, you just need to mash up the results and you're done! That alone is enough to do a lot of ...


28

For general comments, the script tags are properly escaped, so that it's just interpreted as text instead of as actual code. In this case, that sort of thing is handled via something known as HTML encoding, where your <script> tag would get turned into &lt;script&gt; and rendered as a text string instead of interpreted as code. That said, ...


28

The email includes references to an externally-hosted images, like http://example.com/[tracking_id].png, where the tracking company controls the server hosting the image. The company records how and when each unique image URL is loaded by a mail client. As you've noted, print operations can be logged by a tracking image in the @media print CSS directive. ...


23

Try this: " onfocus="alert(1)" autofocus=" It will expand to: <input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" /> Which will cause an alert box, demonstrating XSS.


17

The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-have-you. To quote OWASP: Note that client side validation is a fine idea for performance and usability, but it has no security benefit whatsoever. Server ...


16

Yes. You should always escape untrusted data. Here's an attack for your snippet (pseudocode): <noscript> <img src="<?php echo 'you should always escape everything, dependeing on the context. This context is url in an attribute, you should escape it appropriately. otherwise " /> </noscript&...


15

If they have the real old password in the field you can retrieve it by looking at the source of the HTML page. But usually there is only a placeholder like "this was the old password" which is used to detect if the user changes the password or if something else inside the formular gets changed. With proper security the site cannot even put the old password ...


14

The website will record your IP address. The Company's network assigns your IP address. Just associate the two ...


13

It is a security measure, as the description in the code implies. The iframe serves as a protection mechanism against XSS exploits through browsers' own measures against these very same attack types by preventing JavaScript access to frames and iframes when they're not published on the same domain. It isn't really necessary to write this part of HTML ...


13

You are in a correct path as you go with whitelisting, but implementing it bullet proof is tricky. I.e. your links can be fooled to execute JS by just writing: <a href="JAVASCRIPT:xxx">xss</a> Also, especially older browsers may execute JS in img src etc. I'd recommend you to go with HTMLPurifier, which, besides XSS, also helps you to deal ...


12

Yes, almost all HTML tags allow you to declare an event handler. Some of these events could be triggered when the page loads without user interaction: <img src=x onerror=alert(1) /> Event tags are not the only way to trigger xss: <a href=javascript:alert(1)>xss</a> One possilbe solution is to set the Content Security Policy for this ...


12

I see a few reasons why not to do that: The client browser may (and probably will) cache the received HTML page into some file on the local disk. It is usually not a good idea to have passwords "as is" in files on the disk. Since you store data on the client side (in the HTML), you must think about what happens when the client does not cooperate, i.e. ...


12

If there is no external interface to the lookup table, then you probably don't need to scrub the data coming out of those tables for security reasons. But it might be easier to always scrub data you are presenting rather than adding exceptions. Also, if the data in the lookup tables is safe for HTML output, what happens when you switch to CSV output? Is it ...


12

Wikipedia and big popular sites are mostly safe, as any security holes are found quickly, usually long before the site gets its momentum. Smaller blogs/forums which allow user content are more vulnerable. I used to visit a Russian tech blog several years ago, and the posting form allowed some HTML formatting. Someone managed to include JavaScript code from ...


12

De-identification from surveys is a big issue in statistics, as what people think of as anonymous data usually isn't when aggregated. Even if you have a completely secure way of anonymously inputing data, and someone can't access the logs of who entered what, the responses in the survey are often enough to identify you. Consider this example survey: ...


11

Pros It can improve security when authenticating (in addition to a multi-factor device) If used as a "client certificate", it can make MITM attacks much more difficult The Keygen tag is implemented across most non-IE browsers, making it very easy to implement Works regardless of administrator permission. With IE Active X controls can be disabled and IE ...


11

Let's look at the technology stack of a dynamic website: Your code, in whatever language you chose, e.g. PHP or ASP.NET The script engine, e.g. PHP engine or .NET CLR The web server, e.g. Apache or IIS System services, e.g. SSH and FTP The operating system If you're on a VPS, the virtualisation technology that hosts your instance, e.g. VMware. The hardware ...


11

The Content-Security Policy or CSP allows you to create a page of user controlled HTML that does not execute JavaScript, and therefore not XSS. This is telling the browser not to execute JavaScript, which is a lot stronger than filtering the output, and using both will improve security. HTML filtering libraries such as HTMLPurifer, antisammy, safehtml, ...


10

Summary: Use an HTML sanitizer, but only in combination with a Content Security Policy as there are constantly new ways to bypass filters. After your own processing to allow the subset of white-listed HTML tags through, you should pass your content through a HTML sanitizer. As well as using some sort of HTML sanitiser, it is recommended to implement a ...


9

Yes. It's trivial. <div onmouseover="alert(1)" style="position:fixed;left:0;top:0;width:9999px;height:9999px;"></div> Might want to save your work before trying that, though - the alert might show repeatedly as you move your mouse across the screen. Of course, a better attack would involve destroying the div as soon as the JavaScript is ...


9

Banning opacity on elements containing an iframe would have negative impact of user interfaces (eg no nice fade effects when iframes are in play), but would not block clickjacking attacks. Even if transparent iframes were impossible, you could still achieve all the same attacks by using a 1x1 pixel iframe that followed the pointer. Positioning inside that ...


9

It is not clear what exactly the slide is referring to. Django's auto-escaping should be fine against HTML-injection in text content and properly-quoted attribute values. There are not other Unicode characters that can evade HTML escaping, but in principle there are byte sequences that could be misinterpreted as being in the wrong Unicode encoding: If the ...


9

A lot can still go wrong given an application that contains this small snip of code. An attacker could use a local file include vulnerability to obtain remote code execution by putting PHP code within the metadata of an uploaded image. An attacker could potentially write an image with a valid file extension in any directory using directory traversal. In ...


9

No, that's not going to fool spambots. I've seen a couple of spambots that were parsing the entire DOM using tools like html5lib or comparables. Of course, many spammers just "guess" at email addresses: the cost of sending emails when you have a botnet is basically 0, so making combinations of username & domains to guess works out well. Slightly ...


9

If you ever need to check a suspicious URL, you can use a service like urlquery to check if it has a malicious reputation, the HTTP transactions that take place, any java script that runs, etc etc. Very useful. They also provide a screenshot of what the visited page looks like. http://urlquery.net/



Only top voted, non community-wiki answers of a minimum length are eligible