53
votes
Accepted
Is the OWASP recommendation regarding localstorage still valid?
Personally I see no issue with using local storage as long as you are happy with the user not having to re-authenticate between sessions. The linked answer provides the following argument against this....
- 10.9k
25
votes
Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?
Yes, internal applications should be secured with due diligence and yes OWASP can be a good guide for securing your application. Also look over Microsoft's Security Development Lifecycle (SDL), It is ...
- 941
18
votes
Is the OWASP recommendation regarding localstorage still valid?
The reason local storage is considered unsafe is because any JavaScript that executes in the context of the page can access this. This opens you up to session hijacking via reflective XSS and stored ...
- 3,260
13
votes
Accepted
Why are HTTPS requests blocked by Firefox when using ZAP proxy?
ZAP creates certificates, on the fly, in the name of the site Firefox is going to.
Firefox is saying "I don't trust the CA that signed this cert", which is reasonable, because it's a MITM by an ...
- 72.9k
10
votes
Accepted
Why OWASP Top 10 (web application) hasn't changed since 2013 but Mobile Top 10 is as recent as 2016?
The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015:
Historically, we've produced a new OWASP Top 10 ...
- 14.9k
9
votes
Accepted
How to convert risk scores (CVSSv1, CVSSv2, CVSSv3, OWASP Risk Severity)?
I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are ...
- 1,110
9
votes
Accepted
Injecting <script>alert("1")</script> to OWASP Juice shop doesn't work
I went ahead and tried to determine what endpoint in the OWASP Juice Shop application you are injecting your payload into. Please correct me if I am wrong, but it appears that the payload is injected ...
- 1,306
7
votes
Setting up OWASP ZAP Authentication
You can use the Zest functionality of ZAP to perform your authentication. In the icon bar on the top, on the far right you will find a tape icon that says "Record new Zest Script...". Hit it, choose a ...
- 71
7
votes
Owasp Zap's active scan harming the database
Run the active scans against a non-production environment (replica of production). Have a process/script to easily restore a fresh copy of the live database if you break your non-production database ...
- 619
7
votes
Accepted
Some doubts about SQL Injection examples, how exactly works?
You've misread the injection, specifically this part:
""=""
This isn't checking if the Name is an equal sign, but rather if an empty string is equal to an empty string. It's effectively the same ...
- 31.3k
6
votes
Accepted
Why does OWASP suggest using POST over PUT for file uploads?
TL;DR: PUT is not supported by a good deal of things. Sometimes it is only available as an extension, and enabling extensions increase your attack surface.
@iain is correct in comment that the SO ...
- 5,877
6
votes
Why does OWASP ASVS require HTTP responses to have a content header specifying a character set?
Decrease client-side attacks.
For example :
If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the ...
- 944
6
votes
Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?
Others already mentioned some good points about evil employees, infiltration, defense in depth... but it's much more practical than that. I can attack your internal intranet application from a random ...
- 32.9k
5
votes
How can I edit HTTP request in OWASP ZAP and send the edited request?
Did you try right click, "resend"? Then you get a new window and in the "Request" tab you can change the parameters. Maybe it doesn't work in the "Sites" pane and you need to go to the "history" tab ...
- 2,654
5
votes
Why are HTTPS requests blocked by Firefox when using ZAP proxy?
There's a core help for that, even has Firefox specific info (along with others): https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsDynsslcert#mozilla-firefox
After you've exported ...
- 584
5
votes
Owasp Zap's active scan harming the database
You shouldn't be running any tests against a live database, You should be using a segregated testing environment
- 99
5
votes
Accepted
External network pentest and Application pentest. The same?
In short, no, they are not the same.
OWASP stands for open web application security project, which is why its guide is focused on the application side of things. You might find what you're looking ...
- 458
5
votes
Accepted
Is OWASP ESAPI still the recommended way to secure JSP pages
The OWASP ESAPI is no longer considered a flagship or even an active project. Kevin Wall, the project owner for the Java implementation, himself back in 2014 conceded that the project is dying and ...
- 2,830
5
votes
Accepted
After a full web vulnerability scan, do we need to test each & every similar field for possible injections?
It all depends on how your application handles the fields.
If it handles them in exactly the same way then yes, in theory you only need to scan one of them. However this is not the normal case, ...
- 1,490
5
votes
Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?
Remember the giant Capital One breach in August 2019?
The root cause was a server-side request forgery (SSRF) vulnerability in an internal Capital One app.
So Yes, you need to worry about secure ...
- 58.9k
5
votes
Is non-executed content still considered XSS?
This is very common for automated scanning tools. They can only be so smart, and so false positives can always happen (as can false-negatives for that matter). As a result any flagged vulnerability ...
- 31.3k
4
votes
Accepted
How is Insufficient Attack Protection a Definite Threat/Risk to an Organization?
"Insufficient Attack Protection" is a horrible choice of words, but I don't have a suggestion on how to improve it.
I've overseen applications which were missing really basic detection abilities and ...
- 7,525
4
votes
Accepted
What wordlist does OWASP ZAP spider use?
For future reference:
ZAP works as spider. Spiders crawl through data and find connection points in nodes. Webspiders follow links, sources, anchors in HTML, JS and CSS. Every time a connection is ...
- 3,388
4
votes
Accepted
Bypass char filtering - security shephard
My answer got longer than expected, so just to give you the answer: <body onpageshow="alert(1)"> probably works, and if it doesn't, <body onpaonpageonpagonpageonpageshowshoweshowshowgeshow="...
- 29.6k
4
votes
Accepted
Is Blowfish validated against any standards?
Blowfish is an algorithm. An algorithm isn't validated against anything. What is validated is an implementation of an algorithm.
Blowfish isn't defined by any text that calls itself a standard, as ...
4
votes
Accepted
How to get user and verify password so that the usernames are kept private?
The easiest option I can see here is to avoid immediately returning from the first branch of the code. Instead, continue forward with a bogus hashed_password value and still do the verification.
...
- 370
4
votes
Accepted
What are the risks of publicly hosting OWASP Juice shop
If you're running nothing else on the same Azure instance, and nothing on that instance's filesystem contains anything sensitive, then there's not much of a risk factor.
I reviewed a writeup of all ...
- 135k
4
votes
Accepted
Certificate Pinning for WebSockets
Securing secure websockets
Secure Websockets start life as a standard HTTPS request and only connect if a valid HTTPS connection can be established with the server. As a result, websockets will ...
- 31.3k
4
votes
Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet
if an attacker is able to steal the JWT by performing a XSS attack and access the sessionStorage, the attacker can also send XHR-requests, so the Cookie is automatically send with it
The solution ...
- 768
Only top scored, non community-wiki answers of a minimum length are eligible