Tag Info

Hot answers tagged

63

On production (contrary to development) environments, stack traces and error messages should be logged to file instead of dumped on screen. This is because an attacker may learn things about your system that could help compromise your system. Information such as operating system, web server version, PHP version and more. Some stack traces may contain ...


23

There are two different aspects to this: Is the bug causing the stack trace a security vulnerability. Is the framework configured to show stack traces to outsiders. The error message Invalid Character Error sounds a lot like forgotten escaping, which can very often be exploited in some way. So you should be concerned about the stack trace because it is a ...


13

There are two issues here, and the OP asks about the less important issue. Showing the trace This is the issue that the OP asks about. There are debates regarding how much of an issue showing a trace is in general, and this particular example displays nicely that displaying a trace can be a security issue. The reason for that is that it lets us (you, me, ...


6

Notice that stack traces include parameters. If there are function calls that pass in passwords as arguments, those will end up in stack traces. It's obviously a disaster if one user can cause the password of another to be displayed back at him. Less obviously, user passwords are now sitting in log files; which will make your users very mad. At the ...


5

There are two considerable weaknesses in the live demo which make it quite trivial to break: There are only 5 possible answers to the captcha question, so a bot has a 20% chance to solve the captcha by picking a random symbol. The demo didn't ban me after picking a wrong answer over 20 times in a row, so there is no reason why a bot can't just keep ...


5

This isn't just bad, this is a disaster. Just knowing the email address of someone allows you to buy stuff using his credit card if he happened to be the unlucky customer of this horrible site. They are either storing complete credit card data in reversible format, and given that this security disaster was overlooked I wouldn't be surprised if it was stored ...


5

...sounds to me like Improper Access Control. From CWE-284: Description Summary The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Extended Description Access control involves the use of several protection mechanisms such as authentication (proving the identity of an actor) authorization ...


4

That is the correct behavior. In the case of client-side JavaScript, it is by design that the script source is sent to the client to be executed. So, the fact that you can manually browse to the URL for the script file is irrelevant. It gives you no more access than the application intends for you to have. A source-code disclosure vulnerability is when ...


4

Correct, the majority of mainstream browsers have now included built-in XSS protections. With regards to possible workarounds: You can disable this feature in Chrome by starting the browser with the "disable-xss-auditor" switch. (i.e. C:\\chrome.exe –args –disable-xss-auditor) Another option is to set a header in the hosting web-server to disable such ...


4

"Average length of time that an announced vulnerability has widespread exploitation", T "Attractiveness of server as a target", A, on a qualitative scale of 1-5 (higher number representing more attractiveness). "Ease of exploitation", E, using the CVE score as a basis of common comparison (T/A) x E = N Considering that T is now considered to be measured ...


4

Both cases are serious vulnerabilities, and the security approach is wrong. First of all, the form itself shouldn't escape anything. You might want to check the input, but you do not manipulate it. Escaping is done in a specific context like a database query, not globally. No, it's not secure to simply prepend a backslash to single quotes in the ...


4

The problem is that there are a whole load of ways to get XSS in such a case: <style src="http://ha.ckers.org/xss.css"/> <a onclick=alert(1) style="position:absolute; display:block; z-index: 9999; top:0; left:0; width:10000px; height: 10000px"></a> <div onmouseover='alert(1)'/> <svg src=x onerror='eval("...")' /> Just to name ...


4

Your question is highly dependant on your jurisdiction and the jurisdiction of the server. But, in many jurisdictions, what you have described is "unauthorized access" and would be considered illegal/against terms of service/unethical. As for your specific liability, you would need to ask a legal professional in your jurisdiction.


4

In your example, the people can see the structure of your directories which they could use for potential attacks. You'd be surprised how much a 'hacker' can do with very little information. So Yes in general it's a big problem in terms of security. Like Alasjo is saying, it's also not user friendly and an error page is a good alternative. For example in ...


3

No - I would't not consider the ability to submit an empty form as a security vulnerability. I can't think of a reason that the ability to submit an empty form would be more vulnerable than the ability to submit a form with valid or even dummy data. It is an indication of a poorly written application - and if I came across this I would suspect that there ...


3

OWASP offers some solid advice on their site: https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet You'll be safer and better off using a well-respected resource than inventing your own solution through trial and error. However, learning how an attacker works through experimentation like you're doing, is one of the best ways of learning ...


3

It would be security through obscurity so no, it wouldn't improve security. It's been shown time and time again, if your only defense is that "nobody knows the mechnanism in place, then all it takes is for one person to stumble across it and, within minutes, hundreds of people will know. It MAY make things harder, but it just takes one witty person to ...


3

Depending on your library you should be able to configure your parser to ignore entities.


3

Setting the X-XSS-Protection: 0 header is the correct solution, but you have to add this header in the response, not in your request. Steps: Make sure you have an actual cookie which is not secured with the HTTP-only flag. (You can edit the JSessionID cookie for example) Use a correct JS command to retrieve the cookie (test it first in console), for ...


3

There's a number of areas that you can focus on with rails apps, depending on the level of access you have. Some initial ideas If you have source code access (and I would highly recommend it), you can use Brakeman to find some issues. Even if you can't get source code access, you may be able to request the output of the 'rake routes' command which should ...


3

I always use the Web Application Security Consortium classification. You may use it to classify the threat regarding two of its aspects: Attack (the method used to achieve the result) and Weakness (the flaw that was exploited by the attack) Using that classification, the attack should be categorized as Abuse of Functionality (as you are entitled to ...


3

What is one of the best ways to determine whether or not a user is abusing IPs? There's no good way, and it probably shouldn't be your goal. The fact that you've been "tracking actively-used IP addresses for each user" means that you already have a tracking mechanism better than IP addresses that you should use instead. As we've been tracking ...


3

If you are allowing shell commands to be executed from the browser, then what you are effectively doing is allowing the user to log-in and execute commands on your system as the user that the web-server is running as. Ask yourself if that is what you want to do? The answer is definitely no. No-way. No, not never. In fact, hackers spend a lot of time trying ...


2

A source code disclosure vulnerability is an involuntary disclosure of source code. Since JavaScript code runs client-side, on the browser, it's disclosure is intentional. Under this definition, only exposure of the server-side code is a source code disclosure vulnerability. The example you give actually has the GPL on it, so it's already disclosed ...


2

It depends if you're going to get a budget or not to do this. Welcome to the world of IDS/IPS and SIEMs. My favorite tool that I used as an intern, and still use is OSSEC HIDS (Open Source Security Host-Based Intrusion Detection System). It's a really sweet open source tool if you only need a small cluster of hosts monitored and don't have the funds to ...


2

To try it out, I've written a small bot that tries to post the the visual captcha demo. If first initiates the captcha session, telling is only wants 2 options using http://demo.visualcaptcha.net/start/2. Than it picks one of the two possible results and posts to http://demo.visualcaptcha.net/try. Result: ✓☓☓✓✓✓☓☓☓☓☓☓☓✓✓☓☓☓☓☓✓☓✓✓☓✓✓☓✓✓☓✓✓✓✓✓☓✓☓✓✓✓☓✓☓✓☓✓✓✓ ...


2

The main thing your enabling that is a problem is your opening your shell to subshells. e.a. just executing a command like /bin/bash would allow an attacker to gain access to your server. If you really wanna keep running a service like this i would suggest you limit the options the end users (and an attacker) can use, by only allowing commands you know are ...


2

RCP and RAP applications are typically built using the Eclipse E4 Tool package. There may be test cases unique to the target underlying operating system -- Eclipse runs on OS X, Linux, Windows, and a few other OSes. First, get the Delta Pack -- http://download.eclipse.org/eclipse/downloads/drops4/R-4.4.2-201502041700/#DeltaPack The Delta Pack contains all ...


2

I am going to answer your question with a barrage of other questions. Well does your app actually need to hit the open internet ? or can it simply exist on a company intranet? The majority of 'java exploits' are simply ways that java's sandbox can get broken out of and of little consequence to legitimate java applications since it is really a apples and ...


2

TL;DR Yes, if done properly, the system you've designed should provide a small security gain, but it probably isn't the best option. The expanded version: When we design security into a system, we first develop a threat model, and then we figure out how our system is going to mitigate those specific threats. So, the question for you is: "What is the ...



Only top voted, non community-wiki answers of a minimum length are eligible