Tag Info

New answers tagged

3

Create a cryptographically secure random token and associate it with the user id in your DB Perform an HMAC on the token the cookie value will then be token+HMAC This way an attacker would have to know your HMAC key in order to brute force the token and that is not possible. For validating the cookie you first extract the HMAC, validate the authenticity ...


0

The most important Things in this case is security. We want to give some HTML text from user or maybe by ourselves, then store it for exam in DB, then get it and show in webpages without fearing from any type of attack and misused by users with bad intention. I'v been researched about the best way to do that about 4 days and found 2 base ways. Please let me ...


0

There is the sand cat projet which provide a lot of pen testing tools, like scripting in lua, better view over the console and dynamic injection tools, and a lot of other good surprise.


3

When something like Burp finds an XSS vulnerability, I can't ever verify it when using something like TamperData. If you are already using Burp to find the vulnerability, why not use the intercepting proxy functionality to modify the request and to inject the XSS payload?


5

Your best bet would be mantra from OWASP: http://www.getmantra.com/ Contains a myriad of tools for penetration testing out of the box. Also open source should you need to add/modify anything.


8

Most browsers allow you to disable the function. For instance with chrome you need to start the browser using C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security For Firefox you have to go type about:config in the address bar. Then you need to set the browser.urlbar.filter.javascript to False. For Internet Explorer ...


0

There's no need to reconstruct the URL. SQLMAP accepts the following variations: www.target1.com/vuln1.php?q=foobar www.target2.com/vuln2.asp?id=1 www.target3.com/vuln3/id/1* Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage


1

Look up the OWASP Top 10 (which is the most relevant resource for your question) proposed by edvinas.me and the list of Web-oriented attacks covered by fel1x. I don't have good advice for Web server security because I haven't done it in ages, but make sure you keep your servers up to date and that they run with only the privileges they need (separate OS ...


2

Please do NOT consider disable_functions a security feature. See my previous answer to a different question on stackoverflow - even PHP does not consider disable_functions and similar as a real security feature(s).


70

The question is asked mostly to protect you from phishing attacks. The website may fake an Operating system, and ask you to enter sensitive information like passwords. To quote the spec: User agents should ensure, e.g. by means of an overlay, that the end user is aware something is displayed fullscreen. User agents should provide a means of exiting ...


0

Remove wp-config.txt, wp-config.php.original, etc. (but not wp-config.php!) If those files don't exist, then it's a bug in the scanner. If the file contains passwords (like a database password), change them immediately. How your Wordpress got hacked and how those files were created is anyone's guess. Each installed Wordpress plugin can be vulnerable, as ...


0

Are input fields that don’t have name="" sent via the browser Not by the standard HTML form submission process. However JavaScript on the client side can read the contents of the fields and send that data themselves. Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? Yes. All content on a ...


2

Yes. Any HTTP request that isn't protected by SSL/TLS/HTTPS is vulnerable to MitM attacks. Without the integrity that is provided by HTTPS, any component of the HTML served over HTTP is vulnerable to attack or modification by a man-in-the-middle. For instance, the form's action could be changed, so instead of the form being POSTed to your intended page, ...


0

When a client wants to send data to a server using SSL/TLS, a client must first go through a handshake to authenticate itself with the server. This handshake starts with the “ClientHello,” where the client sends to the server a version of SSL or TLS that it supports, the supported ciphers, and other session data. In older versions of SSL (version 2), it was ...


4

This is really the wrong solution to the problem: trying to prohibit "administrator"-like names will become a constant game of whack-a-mole with increasingly creative impersonators. A blacklist of official-sounding names can be a starting point, but you should also provide an easy way to positively identify admins, such as a unique naming pattern (only ...


1

Here is a list of reserved usernames http://blog.postbit.com/reserved-username-list.html https://github.com/shouldbee/reserved-usernames/blob/master/reserved-usernames.txt


1

You can start with a bad words list, such as: http://www.noswearing.com/dictionary then tack on any other strings you feel are unsafe or undesirable user names. I suggest you use substring matching, otherwise it's very easy for users to manipulate the results, such as registering account "Administrator01" instead of "Administrator". If you want to be ...


1

Installing, configuring, running, testing, monitoring, and updating a secure, robust, and efficient system to automatically parse and take action based on received emails is not trivial. Doing those things for a web system is also not trivial, but someone running a web site already has that infrastructure in place. Spreading your time and expertise over ...


0

As a sometimes web-dev, it is far easier for me to send an email, than to parse one. It is far easier for me to accept an inbound request with a validation token in a query parameter, than to parse email. So... You get an email with a link. This lets me validate that someone with access to the email, can click a link - i.e. it might not be a cunning hacker, ...


0

This is often because of the way the e-mail system itself works. While it isn't immediately obvious to someone using the system, e-mail is actually composed of multiple distinct systems that work together to for "e-mail". You have an SMTP server which is responsible for actually sending and receiving mail on the SMTP protocol, but then it has to be saved ...


1

Email reply with unique token is still a standard on all mail lists I can think of. And I don't see how it can be less secure than link-click, both methods are based on email confidentiality, if intruder can access email content, he can also use a link. On the other hand it might be technically harder for intruder to send a valid reply to an email, so it can ...


2

I agree with you that this would be convenient but I suppose there could be a few motivations not to do this. Issues from the user perspective: Firstly in the case of the reply to the text message - This most likely has a monetary impact. Where I live, and I can only assume most other countries, text messages are charged for. The cost might be ...


0

So let's say you navigate to www.example.com/page?main.html and it puts you on the main page of example.com. Now you navigate to the index, which is located at www.example.com/page?index.html. You start to wonder, what other pages are there? So you type in www.example.com/page?foo and hit enter, and you get an error page which will say something like ...


1

A very simple explanation: Reflected XSS: The attack payload is included in a parameter when the victim follows a URL to the site. Stored XSS: The attack payload is stored in the site itself and when anyone visits the page, regardless of the URL followed, the attack executes.


4

Reflected XSS I send a victim a link to http://example.com/page?var=<script>alert('xss')</script> and somewhere on the page that value is echoed back to the victim. The value is only on the page if they follow my special link. The downside of this type is I have to specifically attack one victim or a group of victims who I can get to click on a ...


1

Depending on the language and framework you are using, maybe it's time to look at some machine learning libraries for spam detection. If you use this malicious user's methods as the training set you maybe able to lower your false positive rate.


0

The standard approach to this would be to e-mail the user to confirm the account and if this doesn't occur in a pre-defined period of time, to delete the registration. You could combine this with some Anomaly detection so for example if you got large numbers of registrations from a single IP address you could assume that this is hostile and block that IP ...


1

The main concern I would have with your proposed method of generating card grid data is whether the resulting grid numbers are sufficiently random. Since you are running randomly generated data through a HMAC (which should be fine) but then also a "mathematical formula" it is possible that could bias the resulting numbers. If an attacker knows that certain ...


1

You seem to be engineering a lot of unnecessary complexity in...unless I've missed something. If you have 64 cells generate a 64 character sequence of crypto random digits and store it. Print your card from this. And check responses to challenges against it. It's really very similar to having a 64 character password and asking for a few characters from ...


1

Basically, you need to encrypt the data you want to protect using a symmetric key (e.g. AES key). This key is only known to the group of users who are permitted to access the encrypted data on the server. The key you used to encrypt the data should not be stored on the server. The encryption and the decryption happen on the client side inside the client ...


1

It is a null byte character. It is used if the code always appends an extension to the included file. For example, if the code is <?php include($_GET['lang'].".php"); ?> However, you, as the attacker wish to read ../../etc/passwd using the LFI. If you use the null byte character you can append this to the request URL as %00: ...


0

It's a null character. I used this decoder to save it to a binary file that I then opened with Notepad++ to verify. Whatever it's doing there, that � is how your browser (as you mention in the comment you're using Firefox) decided to represent it in output. It's not malicious since it doesn't do anything at all except prevents certain Base64 decoders to ...


0

I agree with your client. I would much rather see a 3 tier architecture than a Web/Proxy communicating directly to a DB server on your internal network. (2 Tier) Ideally you would have: (Web DMZ) --> (App DMZ) --> (Internal Network) Or better yet: (Web DMZ) --> (App DMZ) --> (Database DMZ) Please reference: The WebDMZ is the ...


1

WAN or LAN? would exposing just 80 or 443 still compromise the security? Yes it would - there could be numerous vulnerabilities in the web app that an attacker could use to gain control of it. Can a hacker push bots or take control of the server and in turn reach the internal network? Yes, once they have control of the web server they might be ...


13

JavaScript, the Definitive Guide, 4th Edition - published in 2001 - mentions these in a bit more detail. The relevant section appears to be freely available. It's right at the bottom of that link. Here's the excerpt: 12.2.5. JavaScript in Nonstandard Contexts Both Netscape and Microsoft have implemented proprietary extensions in their browsers, and ...


0

Possibly the reason is that by logging-in the user as part of the password reset process, you create a new security surface, that you have to audit - in addition to "standard login" and "password reset" you now also have "login while resetting password". By forcing the user to go through the standard login process, you eliminate that issue, by always doing ...


0

This behaviour does indicate one good security practice: all sessions are invalidated on change password. Perhaps the user is changing password because the old one has been compromised. In that case, invalidating all sessions helps protect the user. It is true that there is no real need to invalidate the session that performed the password reset. But a ...


1

There's absolutely no security reason for forcing the user to enter the password again after they've just changed it. Whoever set the password knows it now, so you might as well log them in. I suspect plain laziness or ignorance: Adding an automatic log-in requires the programmer to actually think about the problem and write extra code. It's easier to just ...


2

There is no reason this cannot be done technically, and I see the occasional site doing it. But it would require extra code to be built, so it's cheaper to let you handle the login ;-) The same thing happens with the confirmation link when registering: in most cases you still have to login (but in this case there are relatively more sites that auto-login, ...


0

I'm not 100% sure, but, after you clicked that password reset link, of course your password is changed, which means you cannot login with that credentials that have been provided with that link or password whatever it was. The credentials which had been logged you into that website somehow are expired. And after you successfully change your password, you can ...


0

An attacker can send you a link your browser will open when you have a session in your protected application. This can happen even by showing images in an email. In this case the request from your browser contains the session cookie but not the anti-CRSF token and the server can invalidate the malicius request from the victim's browser. CSRF tokend have to ...


10

Stay calm, and be nice to the person reporting this. If they are contacting you, they only want to help, so do not threaten them. Also don't ignore them, make sure they understand that you are interested in fixing this. Explain to them that you need time to do this; ideally you can give them a time frame in which you think that you can have this fixed ...


1

If it were me, I would ask the student to supply the email address(es) for the parent(s), then create accounts for each of those email addresses (if they don't already exist) with access to the student's account. If it's a new account then email the password and the URL to the supplied address. Embedding a complex password into the URL is a better solution. ...


-1

I think just an URL is not good enough to prove that your site is insecure(in most cases). I assume that you might know neither the security architecture nor the functionality of your site, i suggest you to take things(reported URL) to your IT department. It would be great if they are able to identify the problem. If not ask that critic for more ...


0

First thing is to follow Tim's advice with regard to responding to your contact. If it isn't clear what the nature of the problem is it would be worth asking them for more information as they appear to be interested in helping. I suspect since you are asking here you don't have access to developers with experience of secure development or an IT department ...


0

If you don't have any specific protection against DDOS you are probably vulnerable, those measures are usually quite expensive and many customer prefer to use services like cloudflare and others. Here some tips which may apply or not depending on technology/language: fingerprint your webserver version and openssl version and look for public known common ...


0

The likelihood is you are vulnerable. If you use a scale-able cloud application platform and have enough resource budget or you use a massive CDN (content delivery network - http://en.wikipedia.org/wiki/Content_delivery_network) you might not be. Likewise if your ISP is especially pro-active in mitigating such threats you may be ok. So in terms of how you ...


5

Do you have a site? If so, you're vulnerable. A distributed denial of service attack (DDOS) consists of a number of computers throwing data at your site faster than it can handle it. Unless you're operating on the scale of Google, you're vulnerable. Your main defense is to not be a target worth the effort of attacking. A conventional denial of service ...


2

Since you have postal addresses send them a letter via mail merge that contains a long random code. They enter the long random code and perhaps some other information they should know such as D.O.B. to validate they have physical possession of the letter and some knowledge of the student. This tells you they are: Someone with access to the mailing address ...


1

As others have noted you can never trust the client, ever. You can make it difficult for people but there will always be attacks they can perform: Artificially inflate measure of round trip time (RTT) Extract encryption keys Alter local clocks Monitoring for suspicious behavior / timing irregularities may be possible though extremely difficult. For ...



Top 50 recent answers are included