Tag Info

New answers tagged

-4

I don't know anything about the application you are working on but if you are dealing with peoples information. Take a look into SQL Injection, its an easy way to steal information and something people who know nothing about hacking can do. That's if you are dealing with peoples information, else then I don't know cause I don't know the application.


2

When you are talking about preventing Cross-Site Scripting (XSS) injections: No, this is not sufficient in all possible cases. When you have no idea what you are talking about (your own words), then you should leave data sanitation to people who do and use a library for this. Which libraries can be recommended depends on what technology you use server-sided. ...


-1

Hm. It really depends. There is many things to fix. Here are the most common hacker methods: 1. SQL Injection: Look up "How to prevent SQL Injection". SQL injection is a method hackers use to grab information from your site, like passwords. 2. Denial-of-service: Denial-of-service, or DOSing is a attack on a website by sending an overflow of packets. This ...


0

This is an extremely wide question. A short answer would be to start with the OWASP Web site and look at the introduction slides.


2

I don't know what he is trying to do but returning 400 is fine. It stands for "Bad Request" so you server did not process the request further. You don't need to do anything as this request did just nothing.


1

Mixed-content warnings occur when an HTTPS page is asked to load a resource over HTTP. This is dangerous because the insecure resources and vulnerable to alteration by an active attacker or eavesdropping by a passive attacker, which violates the user's expectation of security for an HTTPS page. An anchor <a> link does not cause any resource to be ...


0

Per recent announcements from Google regarding their parsing and execution of Javascript and CSS ( http://googlewebmastercentral.blogspot.com/2014/05/understanding-web-pages-better.html ) and confirmed by 3rd parties (http://searchengineland.com/tested-googlebot-crawls-javascript-heres-learned-220157) , the likelihood of fooling spam bots using these old ...


3

If the linked resource is an image or a script, often the main concern is not that an attacker could read it, but that an attacker could hijack the request and inject a modified version of the resource to change the look or behavior of the page - scripts especially, as they could be modified to do something malicious like redirecting the user to another ...


-1

HTTPS secures your connection to the server. The content you transfer over the HTTPS is encrypted. On the other hand HTTP is plaint text, which means the content you transfer over HTTP is not encrypted. Now if someone is sniffing your traffic, then in case of HTTPS the attacker can only see the encrypted data, but in case of HTTP the attacker can see the ...


3

This could conceivably be abused for HTML injection. Imagine if a user searched for the term waterfall</a><a href="http://maliciouslink.com">Click Here The </a> in the search term would terminate the mailto link, and then insert a second link with the words "Click Here". URL encoding will of course mitigate this problem. Also, make ...


2

You need to URL-encode SEARCHED_QUERY_HERE, otherwise if a user searches for &body=something, the body of the e-mail message will be set to something. Also, if you don't URL-encode it, if the user searches for a literal %20 (or similar) it will appear as a space in the message instead. This is not a security risk, though. The other, obvious risk is ...


0

I don't think so, but the greater concern is that you're allowing user input to modify the returned page. Make sure you're using a good API for validating user input (as it is used to generate the query) and that you are properly protecting the output in this page. Use OWASP's ESAPI if possible.



Top 50 recent answers are included