Hot answers tagged

100

Lets say an attacker has your password. You log in and reset it. If the reset doesn't invalidate all existing sessions, the attacker still has access, as long as they don't let their session expire. The reset hasn't actually achieved anything in this scenario. Depending on what the site does, there could also be issues with having you signed in under a ...


41

Protecting sessions on possibly compromised account There is no need to actually redirect to the login page if session management upon password change is done securely. That is, as long as all current session identifiers are invalidated and the current session is attached to a new session identifier (usually issued as a token in an authentication cookie - ...


32

The other answers are probably more correct from a netsec perspective, but I wanted to add that you also get to make sure that the user is actually able to log in with their new password. This might make it more obvious if something is going wrong, like the browser is autofilling an old password. It also prevents users from using the password reset as a ...


26

In a formal review of an application's security, all libraries should be vetted for security defects. However, this is not the point of OWASP-2013 A9. The core of OWASP-2013 A9 is about having a policies in place to ensure that an application isn't compromised due to negligence. OWASP states the following: Identify all components and the versions you ...


11

To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes. As far as security best practices, I have several suggestions: To avoid XSS, abide by the rules found ...


10

My experience is it depends on industry, regulations, and business relationships (not necessarily company size). Examples: <10 person company, building a web app that retrieves credit history, they were required by business partners to have a full webapp pentest <50 person company, building a web portal allowing customers to view point of sale ...


10

The issue is not as much direct object references as it is insecure direct object references. For example, let's say you have a script that displays a private message, and that script takes an ID as a parameter. If you view the list for your user, you'll see links to the messages you have access to. But if you can change that ID in the parameter, and use ...


9

Short answer : NO. It is indeed shocking to know that most companies do not care about the security stature of their product or are ignorant about it. Usually, the QA teams in these companies perfrom the testing, and maybe the test cases would include some attack vectors for XSS, SQLi etc. But I'm pretty sure that they would not have a dedicated process ...


9

There's a couple of free resources I know about which could be good introductions for this kind of thing. Security Innovations have a free OWASP top 10 CBT, Security compass have something similar here as do Trustwave Beyond these basic ones at least two of those companies will have more options that are pay for, but these ones could be a good, free, ...


9

The basic piece of HTTP Response Splitting (HRS) that gets left out most often, is the proxy. HRS is not an attack between a webserver and a browser, or even a browser and a webserver. The attack is on the idiosyncrasies of semi-compliant HTTP devices, namely, the web server and the web proxy. Specifically, the attack takes advantage of the fact that the ...


9

Actually there is another more important one, due to the lack of a time constant implementation of equals, a timing attack can be used to work out magic. See http://codahale.com/a-lesson-in-timing-attacks/ public static boolean isEqual(byte[] a, byte[] b) { if (a.length != b.length) { return false; } int result = 0; for (int i = 0; ...


7

There is only one possible security-related reason to send you to the login-page, as all old sessions can be invalidated and your current active session you changed the password from replaced automatically: It makes using the password-reset for logging in more cumbersome, thus leading to you less often using it, and thus keeping it more secure from ...


6

Also, why is whitelist approach better than blacklist approach as mentioned by OWASP. Why not just block a handfull of characters used in XSS like < , > , etc Blacklists are static in the sense, they prevent 'known bad' from happening. The problem with this is, there are new attack vectors found everyday and you would need to constantly update ...


6

I work with everything from small local businesses to Fortune 100 and FTSE 100 companies and one of the things I do find is that all sizes of company are trying to do something about security. Sure, the extent to which a small company can implement some security controls is limited by budget, but there certainly isn't a 100% correlation with big corporates ...


6

If users are allowed to have the browser store their passwords, redirecting the user to the login page will allow the browser to capture the new password at that page. Otherwise, the next time the user logs in the browser will "helpfully" pre-fill the password field with the old password--an action which is likely to cause confusion if the user doesn't ...


6

Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


5

Good answer from alexwen, although I think his answer is more of a generic parameter sanitization problem, not exactly what OWASP is referring to. I think OWASP may be referring to any of the following concepts. Revalidating Data From Redirect OWASP is talking about a different kind of scheme where one URL does some processing (i.e. validation), then ...


5

The core mindset you want is: Build it as if it were real, not virtual. What would you want in place? Firewalls, access controls, logging etc For a lab running virus analysis etc., you would normally segregate that from the rest of your network, so do the same here. I don't know of any malware yet that is specifically designed to break out of a VM in ...


5

Standard practice is for your client to engage a security test, but I am seeing more developers hiring security testers to provide some assurance to the client. But there is no way to say 'this code is guaranteed secure' - there is only 'this code seems appropriately secure' or 'fit for purpose'


5

If you don't provide documentation of your compliance (either an SAQ or your AoC and RoC) to your processor/acquirer, they stop processing transactions for you, which is sort of like a fine in that you start losing money and customers. To quote the overview to the PCI DSS Self-Assessment Questionnaire (SAQ), you may be required to share [your SAQ] ...


4

@Graham's answer is very good, a few additional points to consider: You'll need a different set of guidelines for each programming language / technology / platform. C++ coding guidelines, have a lot in common with .NET guidelines, but even more not in common. They should preferably be tailored to your projects context / needs / technology / etc (e.g. ...


4

It is not just a block of handful characters that you need to blacklist. In security we go by this dogma: "There are things we know that we know. There are known unknowns. That is to say there are things that we now know we don't know. But there are also unknown unknowns. There are things we do not know we don't know." Blacklist might help you ...


4

I think you might have rejected ESAPI too quickly. To defend against XSS, I recommend you do output escaping: any place where you insert data dynamically into an HTML document, escape the data (in a way suitable for that parse context). ESAPI provides libraries for the escaping and is very useful. This does not involve "changing your input". For more, ...


4

What is "output encoding", and can someone provide a concrete example of how a validation routine could make use of it? Output encoding means that the data is encoded appropriately for the context into which it is being placed. Example, say you want to dynamically display a name from an untrusted source : Your name is:<b>Foo bar</b> If the ...


4

Much though some vendors would like you to think that a WAF is - (a) a requirement and (b) a black box you can dump down in front of your webapp to protect it from all possible attacks - it really doesn't work that way. A WAF configuration isn't binary 'secure' or 'insecure'; it will just be more or less effective at addressing particular forms of attack. ...


4

From an auditor's point of view, I do not expect you to go through every single line of code of used libraries IF the library is commonly used and vetted. If you are using "random code you found on the internet" for a transaction system then I expect you to have had a review on the code. Now for the more used and vetted libraries I would simply review the ...


4

Here, if a user knows the magic string he gains admin privileges if he sends a request which contains the string "sf8g7sfjdsurtsdieerwqredsgnfg8d" as value for the parameter "magic". Magic credentials / strings are often used by developers for testing. Often they forget to remove them when deploying the application to production stages which results in a ...


4

Because of possible session fixation: http://en.wikipedia.org/wiki/Session_fixation In computer network security, session fixation attacks attempt to exploit the vulnerability of a system which allows one person to fixate (set) another person's session identifier (SID). Most session fixation attacks are web based, and most rely on session ...



Only top voted, non community-wiki answers of a minimum length are eligible