Tag Info

New answers tagged

0

You don't need to crawl through ALL combinations - you just need to find ONE that you are not authorized to access. That proves the method is broken. Because it is an MD5 hash, it is also likely the same length each time, which makes it easier to narrow in on a valid link. I believe that a crawler would take less than about 5 lines of code, and less than ...


1

There are a couple of issues to consider with "secret" URLs. First, they offer a different level of security against discovery when served over HTTP vs. HTTPS. Over HTTPS, the path is protected. Over HTTP, it is not. This means that when using HTTP, anyone in the path of the traffic (people sniffing wireless traffic, proxy servers, caching servers) ...


14

In addition to the other points mentioned, another significant drawback to HTTP Basic Authentication (vs, say, forms-based login) is that it has no concept of "logging out". Once the user inputs their credentials, the browser stores them internally to send with every subsequent request. This means that you can't have a timeout or "Log out" button/link to end ...


10

Basic access authentication over HTTPS has clear advantages over Digest access authentication over HTTP. Even with digest access authentication, you can actually store your passwords hashed with an unique salt (realm + username), but first this salt is guessable (this makes attacks against single users and small groups easier), and second you can't use ...


33

Basic authentication has a number of drawbacks, one of which is that the username and password are passed in the clear with every request. This is clearly unsafe under HTTP, but is somewhat less vulnerable under HTTPS. However, because the credentials are submitted with every request, it's still worse than any other method (including digest) that does ...


0

What about just adding a notice at the bottom of the page that reads : Never submit usernames or passwords through <your site's name>. You can go even further by adding something like this and manually reviewing surveys that were reported : If this survey asks you for credentials, do not enter them and click here to report this form. The ...


0

We've had a lot of problems in the past with spammers using our webmail for sending spam (after phishing passwords from our customers), and that's a similar problem. It stopped as soon as we set up our webmail software to rate limit message sending to 1 message every 15 seconds. Spammers like convenience and automation, and making message sending more ...


3

I would focus less on preventing this one person from analyzing your site and more on doing as much as you can to be sure your site is secure. Even if you do block this one person, someone (or something) else will come along eventually. It sounds like you have taken steps to make the site more secure (which is awesome!), but make sure you are taking the ...


4

If there is no discriminating feature of the traffic that you can analyse for and block, and a WAF is not possible then blocking the IP is your only real option. Your coordinator is correct in that blocking the IP could result in you locking out authentic traffic, so the question is whether the potential for loss from the hacking attempts is greater than the ...


1

You can use a cloud-based password manager and a USB dongle. This would be the safest and most convenient solution especially if your phone is unavailable. USB dongle can be strengthened with a code. The token serves as a "something you have" factor and the code is "something you know" just like with your credit card. The database of your login credentials ...


0

In addition to the reasons others have given already: Additional work required to set up HTTPS on the server The server administrator needs to purchase and renew certificates for each domain. The process of installing a certificate is time-consuming as for obvious security reasons you can't simply re-use the same certificate or just generate one yourself, ...


5

Assuming the school has a valid need for this information, and you are happy to provide it, this is probably one of the better ways to collect it. Compared it to asking for this via email, or paper form that then gets entered into a school computing system. Email is sent in clear text, anyone sharing the same network can see this traffic, including your ISP ...


-1

As thexacre says, it doesn't impede brute force methods, because the guess can be used to decrypt the hash. However, if there turns out to be (i.e. future discovery) a systematic vulnerability in the hash used, then an encrypted salt might prove valuable. Depending on the nature of the attack, though, it might be possible to derive both salt and password ...


0

... and can I do anything to hide this? Yes, the advice is the same as for all "hostile" environments: don't use their computer, and don't use their network. ..Or at least don't use their network without a VPN to a trusted network, but best to just not use it at all. And certainly, certainly, don't use their computer.


1

If you use http to access stackexchange, the university can access which account you are logged in with, as there is a link to your own account in the top bar. Note that it is a theoretical "can". If you use https and there is no university certificate or compromising software on the device you use, the university can't know that without using some very ...


0

If someone had access to the filesystem of the server, they could also read the password. If you run a ls -al /proc/<pid-of-another-users-process>/cmdline command, you can see that it can be read by everyone. There are multiple ways of how to solve this. The first stdin approach First, you start a process in php, and then communicate with it through ...


3

I have used both. You will get different results with a cloud based scanner versus an on premise scanner. Typically an on premise scanner would perform authenticated scans against your assets with no port restrictions, or hindrance from other security devices. This gives you a true snapshot of system vulnerabilities. Cloud based scanners typically scan ...


2

Several initiatives are ongoing to address this issue. Google has been working with the YubiKey folks to create a tiny dedicated USB dongle device to act as a second factor. You can see details here Forbes story here. You can also use YubiKey today to kludge up a solution if you are so inclined.


36

generate salt encrypt it with AES using user's password as key save the encrypted salt and hash You could do this and it would be an effective salt, however it wouldn't actually be any more secure than just using a regular salt. Let's consider two attack vectors: Password collisions Obviously we don't want two users with the same password to have ...


20

Salts are not intended to be secret — their only requirement is to be globally unique. Until you are more experienced, don't try to be clever with cryptography. Use out-of-the-box solutions like bcrypt or scrypt and leave the details to professionals. Cryptography is hard to get right, and adding more and/or unnecessary complexity only increases the ...


1

It really depends on the upload function and how it is designed. Have you tried looking at the request? Sometimes applications include a 'directory' variable, or even parse one sometimes when it's not there. Is it a custom application or one that you can download trial for? Also, does the application support other types of server side code? Here is a video ...


1

You should look into OWASP's App Sensor project; it is doing exactly the type of things you are talking about. Its more a proof of concept / example implementation, but the idea works and has a lot of merit. The project is focused on defining detection points and potential actions; they feel that each site should setup the rules between the two. We all ...


1

If you are trying to catalog all possible attack inputs, creating a list of all form input fields would be incomplete and could lead you to having a false sense of security. There are many other potential origins of attack (parameters in the URL is a very common one). One thing that helped me when I began looking at website security was to start viewing it ...


2

Although the same-origin policy may stop an attacker from accessing the legitimate iFrame content, the problem is that the user has no way to verify that they're actually interacting with the legitimate iFrame (short of going to the source which most users won't do). An attacker could just as easily replace the iFrame source with a phishing page and gain the ...


0

No. Traffic analysis can still tell someone a lot. Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, ...


0

I Think people here does not understand the question: If you have a unsafe line, and you make a successful SSH/SSL Connection over this line, he now ask if its safe to make the assumption that the line is "secure" and that unencrypted data can be passed ALONGSIDE with the encrypted Connection (eg, in plain sight, not inside the encrypted SSL/SSH ...


0

I think this is a reasonable approach, as we have seen countless websites being hacked and millions of passwords being stolen. Using a two-factor authentication mitigates the risk. Depending on the security level of your installation, a hardware based OTP is not needed. Software-based OPT, like Google Authenticator, will suffice in most cases. You can use ...


2

My problem is that I don't want anyone else to be able to use the web service. Meaning that only the applications should be able to call the web service to get information or execute an action on another application. Is there any "simple" way to do that? There are several ways. You say you use HTTPS; so you can add a simple authentication ...


0

If you were using WCF you could use authentication to only allow specific users run specific methods. I use this in an intranet envoironment. I am not 100% but this might be a good starting point to use WCF or find an equivalent method in whatever technology you are using to call methods.


0

As you mentioned, password hashing is a great way to secure a client's password in a database (if done right). However, if you/your app needs to know the data that is being hashed then hashing alone cannot work as you need to encrypt the data. I assume you are concerned with data breaches themselves (attackers gaining access to the database and thus ...


2

Mylar requires using Meteor. Because of the separation of data and format in the Meteor framework, it can actually sign the application template. In a normal web app the browser receives the concatenation of the data and the presentation as one element; in a dynamic web app you can not sign the page because you don't know what the output will be at run time. ...


1

CSRF token should be part of a layered approach. You may employ other techniques or other checks on session (CAPTCHA, require logon, out of band confirmation, etc.). The cost to include a CSRF token is generally low, especially if you are working with a framework that can include it for you automatically. There are few cases where you will run into user ...


2

If the POST changes state on the server then not including a csrf token leaves you vulnerable. The level of risk depends upon the specific functionality served at that URL if the attacker abuses it with a csrf attack.


3

Create a cryptographically secure random token and associate it with the user id in your DB Perform an HMAC on the token the cookie value will then be token+HMAC This way an attacker would have to know your HMAC key in order to brute force the token and that is not possible. For validating the cookie you first extract the HMAC, validate the authenticity ...


0

The most important Things in this case is security. We want to give some HTML text from user or maybe by ourselves, then store it for exam in DB, then get it and show in webpages without fearing from any type of attack and misused by users with bad intention. I'v been researched about the best way to do that about 4 days and found 2 base ways. Please let me ...


0

There is the sand cat projet which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprise.


3

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?


5

Your best bet would be mantra from OWASP: http://www.getmantra.com/ Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.


8

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False. For Internet Explorer ...


0

There's no need to reconstruct the URL. SQLMAP accepts the following variations: www.target1.com/vuln1.php?q=foobar www.target2.com/vuln2.asp?id=1 www.target3.com/vuln3/id/1* Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage


1

Look up the OWASP Top 10 (which is the most relevant resource for your question) proposed by edvinas.me and the list of Web-oriented attacks covered by fel1x. I don't have good advice for Web server security because I haven't done it in ages, but make sure you keep your servers up to date and that they run with only the privileges they need (separate OS ...


2

Please do NOT consider disable_functions a security feature. See my previous answer to a different question on stackoverflow - even PHP does not consider disable_functions and similar as a real security feature(s).


71

The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec: User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting ...


0

Remove wp-config.txt, wp-config.php.original, etc. (but not wp-config.php!) If those files don't exist, then it's a bug in the scanner. If the file contains passwords (like a database password), change them immediately. How your Wordpress got hacked and how those files were created is anyone's guess. Each installed Wordpress plugin can be vulnerable, as ...


0

Are input fields that don’t have name="" sent via the browser Not by the standard HTML form submission process. However JavaScript on the client side can read the contents of the fields and send that data themselves. Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? Yes. All content on a ...


2

Yes. Any HTTP request that isn't protected by SSL/TLS/HTTPS is vulnerable to MitM attacks. Without the integrity that is provided by HTTPS, any component of the HTML served over HTTP is vulnerable to attack or modification by a man-in-the-middle. For instance, the form's action could be changed, so instead of the form being POSTed to your intended page, ...


0

When a client wants to send data to a server using SSL/TLS, a client must first go through a handshake to authenticate itself with the server. This handshake starts with the “ClientHello,” where the client sends to the server a version of SSL or TLS that it supports, the supported ciphers, and other session data. In older versions of SSL (version 2), it was ...



Top 50 recent answers are included