Hot answers tagged

92

You are right, the regression to HTTP is pointless. Note that all your points apply to one particular kind of attack, where the adversary is able to access the data transport between client and server. That could be the owner of a WiFi hotspot or your ISP acting as a man-in-the-middle, who sits in between you and the server. This can be hard to accomplish ...


29

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


22

I would raise the following question: What's the point in having authentication in the application? If all the page contains is public content and verifiable in an outside way (eg. a debian mirror, where packages are with PGP) and your users don't mind a third party scrutinizing what they visit, the page might not need https. But not a login either. ...


11

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


8

Your credentials are safe, but Session Hijacking might happen One possibility could have been an attacker might have done a SSL Strip attack while acting as the Man In Middle, If that happens the HTTPS website will be served as HTTP to the victim. But as you have confirmed with the website that they have done it intentionally, so this possibility is striked ...


6

You are totally right. Excluding Google login credentials an attacker can perform a MITM attack and intercept all victim's requests. I suggest to you to communicate them the risks an reimplement the SSL protocol.


6

If someone just records encrypted HTTPS session and if the connection served over the secure TLS protocol version with the strong cipher suite, then the answer is no. Neither they will be able to decrypt your credentials nor replay traffic to create bogus session. TLS protocol provides message authentication and has its own replay attack protection.


4

I think that if you continue down that line of thinking towards a rock-solid solution, you're going to have to consider things like "what if the weekly email is spoofed?" ... "Maybe I need to digitally sign those lists", etc and you are going to end up inventing something very similar to a Certificate Authority. Use an in-house Certificate Authority I ...


3

Is there a way to allow users to submit their username and password from an insecure site without compromising security? No. As you realized yourself in your question the site could be compromised and everything replaced. And this could be done in a way that the user is not aware of this. Training the users to trust such an insecure site is a bad idea ...


3

As of today (April 5th, 2016) The project was shut down due to lack of contribution, and there is no plan for it to return. As of today, a decision has been made to shut down the Open Sourced Vulnerability Database (OSVDB), and will not return. We are not looking for anyone to offer assistance at this point, and it will not be resurrected in its previous ...


3

As far as I know it is impossible to insert a completely fake Referer header within a normal browsing session. But there are various ways to make sure that no Referer header is sent at all. Thus as long as you only allow to be framed if the Referer header is set and that the domain in the Referer is explicitly allowed to frame your site you should be safe. ...


3

I did something similar a while back to ensure we were keeping up with security updates. It's all manual, though: I can't help you automate it but I can tell you how long it took me and give an example of what I ended up using. The initial setup took a couple days (we use > 75 libraries), and since then it's just been an hour or less per week to maintain it ...


3

No, I don't think so. It could be circumvented by creating an iframe with display: none, containing the page add-users.php. Then all the attacker has to do is to fill in the form fields and submit the form with JavaScript, and the attacker has successfully added a user without the victim's consent or knowledge. Checking the referer header would not stop ...


3

Yes. Do not write CGI scripts in pure bash. Bash is one of the worst languages if it involves untrusted input. After the shellshock incident, people looked at bash more carefully and noticed it was absolutely packed with security issues. Sadly, bash isn't just bad because the interpreter itself is insecure, though it most certainly is. The very paradigm of ...


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


2

While Austin is correct, it is also a risk that the file itself contains an exploit. Office applications are utterly massive and have a truly humungous attack surface area. If you have time on your hands, open up an instrumented fuzzer like American Fuzzy Lop (AFL) and run it on your Excel processor. You will find a stunning amount of very scary-looking ...


2

Shouldn't it be possible to use referrer checks as CSRF protection which work even if an XSS vulnerability exists? Nope. If you are injected script, you can create a <form> pointing at the same origin, include a purloined CSRF token, and submit it with the expected Referer header. (Also referrer checks are problematic in general of course, and ...


2

Yes, and quite easily (if I understand the question correctly). If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like: <script ...


2

Install a VM hypervisor on your server(s) and create a separate virtual machine for each user which runs an own webserver and database instance. When you don't have an unique public IP address for each user, then you can point all the DNS entries to the same public IP where you run a reverse proxy which routes each request to the LAN-IP of the correct VM ...


2

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security assessments, and more specifically towards bug hunting in bug bounties. Make sure to also check the video :)


2

Careful! Based on what you're saying, you've already donned the Hat, and now it's up for interpretation whether it's a Black, Grey, or White Hat. Depending on localities, you may actually have already committed a felony. System administrators can get very protective of their systems, and they don't always see the honest-guy-shows-you-your-lock-is-broken ...


2

Very broad question, but here is a baseline of security additions I would add Firewall rules to block ALL except authorized sources Remote syslog/event logs Web Application security test This is beyond broad, and scattered. The reasoning? I have no idea what your risk is. Only you and your organization can determine that. So a quick risk analysis on a ...


2

No, there's no other way to know if the file exists or not. However, if you can find out what OS is running on the system, then often you will be able to find the right path to certain files quite easily. In rare cases websites have a script or page which iterates through files in a folder specified by a POST or GET parameter which you could manipulate to ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


1

Data URI is a standard for embedding the data you want to use directly within your page (that is - not be in need to use an external file). This is handled by the browser and is essentially a Base64 version of the binary file (a picture in your case). So, client wise, you are as safe as your browser is. I did not fully understand your question but you are ...


1

When the FBI finally found the server it was due to the silkroad server leaking an IP address via captcha. The FBI was able to use that to track down the hosting provider. They showed up with a warrant and grabbed one of the drives. The Raid controller happily re-built the mirror onto a fresh drive and the operators never noticed. The FBI then had an ...


1

Giving away information in the URL An URL might be accessible even to a person that is not supposed to have access to the actual page it leads to. After all URLs can show up in links all over the web or leak via referer headers. Therefore there should be no sensitive information in the URL. The Mongo ID contains information about the time the object was ...


1

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References entries. An attacker that can figure out how to exploit such an direct reference will have far more power than they should. The OWASP actually recommends using ...


1

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure. Granted you should be aware, the mongo _id consists of: a ...



Only top voted, non community-wiki answers of a minimum length are eligible