Tag Info

Hot answers tagged

36

generate salt encrypt it with AES using user's password as key save the encrypted salt and hash You could do this and it would be an effective salt, however it wouldn't actually be any more secure than just using a regular salt. Let's consider two attack vectors: Password collisions Obviously we don't want two users with the same password to have ...


34

Basic authentication has a number of drawbacks, one of which is that the username and password are passed in the clear with every request. This is clearly unsafe under HTTP, but is somewhat less vulnerable under HTTPS. However, because the credentials are submitted with every request, it's still worse than any other method (including digest) that does ...


20

Salts are not intended to be secret — their only requirement is to be globally unique. Until you are more experienced, don't try to be clever with cryptography. Use out-of-the-box solutions like bcrypt or scrypt and leave the details to professionals. Cryptography is hard to get right, and adding more and/or unnecessary complexity only increases the ...


14

In addition to the other points mentioned, another significant drawback to HTTP Basic Authentication (vs, say, forms-based login) is that it has no concept of "logging out". Once the user inputs their credentials, the browser stores them internally to send with every subsequent request. This means that you can't have a timeout or "Log out" button/link to end ...


11

Simple. You read the anti-CSRF token from the newly requested login page and each time the token is attached to the server's response. In this case, before you submit a POST request, you first read the response to your GET request from the server and the new token will be attached to it. Then you use it to generate new brute-force POST request. There may be ...


10

Basic access authentication over HTTPS has clear advantages over Digest access authentication over HTTP. Even with digest access authentication, you can actually store your passwords hashed with an unique salt (realm + username), but first this salt is guessable (this makes attacks against single users and small groups easier), and second you can't use ...


7

An attacker can conduct a bruteforce attack using Burp Intruder, with an extender extension to handle the CSRF token. Adding a captcha to the login page doesn't solve the problem, it raises the bar by forcing the attacker to break the captcha cracking service at 1,000 solutions for $1. To answer your question, neither a captcha nor a CSRF token is ...


6

Yes: CSS can contain malware, though in my experience, its usually been tied to a vulnerability, e.g. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3971 As far as it containing JavaScript, that's certainly a vector, though successful exploitation should generally be limited by vulnerabilities within the Browser, the OS and the JavaScript engine. ...


5

Assuming the school has a valid need for this information, and you are happy to provide it, this is probably one of the better ways to collect it. Compared it to asking for this via email, or paper form that then gets entered into a school computing system. Email is sent in clear text, anyone sharing the same network can see this traffic, including your ISP ...


5

CSS rules can actually contain JS code (supported by at least some browsers), so from that perspective CSS can be "as bad as" JS. This SO answer might be helpful if you want more detail. http://stackoverflow.com/a/482088


4

If there is no discriminating feature of the traffic that you can analyse for and block, and a WAF is not possible then blocking the IP is your only real option. Your coordinator is correct in that blocking the IP could result in you locking out authentic traffic, so the question is whether the potential for loss from the hacking attempts is greater than the ...


3

It is safe. You have used SqlParameters so you don't need to worry about SQLi in this case. There are situations where using parameters might not protect you from SQLi, like using a parameter to construct dynamic SQL in a stored proc, but there isn't anything like that going on here. This is a textbook example of when parameterization prevents ...


3

I would focus less on preventing this one person from analyzing your site and more on doing as much as you can to be sure your site is secure. Even if you do block this one person, someone (or something) else will come along eventually. It sounds like you have taken steps to make the site more secure (which is awesome!), but make sure you are taking the ...


3

I have used both. You will get different results with a cloud based scanner versus an on premise scanner. Typically an on premise scanner would perform authenticated scans against your assets with no port restrictions, or hindrance from other security devices. This gives you a true snapshot of system vulnerabilities. Cloud based scanners typically scan ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


2

CRSF attacks work by tricking a user (usually already logged in), into performing a request that servers the end of the attacker (either by getting him to click on a hyperlink, through a method such as XSS). An anti-CSRF token protects sensitive requests, by requiring an unpredictable value (provided to the user on an earlier page) to be sent as part of ...


2

X-Frame-Options HTTP response headers are useful in that they tell the browser to not allow framing from other domains so that it protects against clikjacking. For your second question, you can read from here: Sending the new X-Content-Type-Options response header with the value nosniff will prevent Internet Explorer from MIME-sniffing a response ...


2

There are a couple of issues to consider with "secret" URLs. First, they offer a different level of security against discovery when served over HTTP vs. HTTPS. Over HTTPS, the path is protected. Over HTTP, it is not. This means that when using HTTP, anyone in the path of the traffic (people sniffing wireless traffic, proxy servers, caching servers) ...


2

The answer to this question has two sides... First: If you host the libraries yourself then you have to check the security notices on the library regularily and update the library accordingly. This can be a very time consuming task if you include several libraries which must be updated independently. On the other side you can audit each library you use. ...


2

This is not susceptible to SQL injection. This method incorporates the prototypical advice for avoiding SQL injection, which is to use parameterized queries. This explicitly separates the data in the arguments from the executable code.


2

Usaually the user's browser stores some cookies with a random string identifying the user on the server. More secure variants of this additionally check other parameters as the browser version, OS of the user and approximate location. Basically, if you visit a webpage like facebook with a cookie, you get authenticated only with the random string in the ...


1

Ok, I figured it out. Since the application send local query to local database, in order to capture these queries I should capture lo packets with tcpdump: # tcpdump -xx -i lo This works perfectly.


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...


1

You will get that error when you access Gmail, and there isn't really anything you can do about it, except to try different browsers. This is due to HSTS (HTTP Strict Transport Security) which Google has implemented along with the option to include certificate pinning. This means that in order to access their sites without this warning, you need not only ...


1

The best you could do is use a ssh connection to work on those files. If that is not an option you should try to make it possible. If ssh is really not possible you should check the following: use https with a valid certificate (without that password will be send as plain text!) your .htaccess uses a strong password (otherwise it might be brute forced) ...


1

As per the comment on Uwe's answer, there's only a security advantage if the URL you use reference a library with the security problems fixed. Although, to expand on my comment there, the jQuery team have been working with Google to make the latest production release (i.e. with security fixes) available at a (new) non-varying URI. However Google still need ...


1

You seem a bit confused about the concept. An open redirect is just a redirect. You browse to http://google.net/redirect?http://stackexchange.com and it tells your browser: please go to http://stackexchange.com. That it is an open redirect means that I can make it send you to anywhere (like an attacker web page), usually by embedding in the link the page ...


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...


1

You can use a cloud-based password manager and a USB dongle. This would be the safest and most convenient solution especially if your phone is unavailable. USB dongle can be strengthened with a code. The token serves as a "something you have" factor and the code is "something you know" just like with your credit card. The database of your login credentials ...


1

If you use http to access stackexchange, the university can access which account you are logged in with, as there is a link to your own account in the top bar. Note that it is a theoretical "can". If you use https and there is no university certificate or compromising software on the device you use, the university can't know that without using some very ...



Only top voted, non community-wiki answers of a minimum length are eligible