New answers tagged

0

Not a bug, the Session Cookie is created regardless of 'user' authentication. The sessID cookie is ONLY an Identifier (X Client has X Cookie). Once a user has been authenticated with the server you may continue to use that cookie to identify the authenticated user. Edit, detail.


2

Would a password combination of images be stronger for users login regarding keyloggers? Yes, it would be stronger... a little bit. That is not saying much. A keylogger will catch only the keystrokes and not the selected user images, right? If you want to be technical, a keylogger logs keys. In the real world, many "keyloggers" also log things other ...


9

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story. You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn'...


26

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


1

Forms-based authentication over proper, validated TLS is the modern way forward for web application authentication that require non-SSO (Single Sign On) capabilities (e.g., SAML, OpenID, OAuth2, FIDO, et al). NTLM authentication is only utilized in legacy networks. Microsoft no longer turns it on by default since IIS 7. Microsoft Domains and/or Forests with ...


2

What you need to do is encrypt the file(s) before uploading it to the cloud provider, and decrypt them on download. Assumptions You do not want to cloud provider to by able to read (decrypt) these files. You would like something simple to implement Do This Use a symmetric algorithm to encrypt the files. The most common secure algorthm is AES There ...


-1

AES is available in any crypto library. Use AES. Or better than that, use a blackbox library like NaCl or libsodium with the defaults, which was designed by a top-notch cryptographer, meaning you don't have to worry about screwing up the implementation which you are indeed quite likely to do if you try and implement this yourself.


-1

The one that fulfills your requirements. If you just want to upload and download it, don't encrypt it. If you want to encrypt it because encryption sounds so cool, just XOR it with 01010101b. If you want to encrypt it to be secure, define what secure means for you. Do you want to prevent the cloud provider from automatically analyzing your file? Do you ...


0

Your need is just for storing the file in the cloud and assuming that the key will always be with you and only you. Here is the list of algorithms that you can use: Triple DES RSA Blowfish Twofish AES You can encrypt with anyone of these and upload them to cloud and for decryption, you will only be having the key.


2

The error you get is from MySQL, not from modsecurity. It informs you that the SQL statement the server has constructed is invalid. For example, maybe the SQL query is contructed like this: UPDATE clients SET useragent='$useragent' With your example, this would become UPDATE clients SET useragent='brick') order by 15 --+' This is clearly invalid, ...


22

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6. From the PCI DSS 3.4 Standards Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not ...


0

your question title is different to the question in your post. is it secure to get the token via JavaScript from the server - this depends on the server side validation method in place. assuming these are OK manipulating the token in JavaScript and then sending to a web socket should be fine as long as server side validation is good.


0

CSRF for login generally yes but does depend on your application. an attacker can log you into a malicious account eg in Google and then monitor all your site visits. CSRF for logout - yes absolutely can prevent DOS


1

You can normally upload the file using standard HTTPS way, however, exposing application server for uploads is always very risky. Especially if the application server has a lot of libraries built-in and so on. So ideally: Create dedicated Tomcat instance just for file uploads with minimum set of libraries Enable HTTPS on it and disable HTTP, harden HTTPS ...


0

@AEonAX : you can use the double handshake token method to use authorize and take care of security. Encryption of token can also be done. Sheldon


1

Text entities in HTML can't do anything interesting, and the content between span tags is interpreted as text. To do anything interesting, you'll need to inject a new entity (which is done using < and >), or you'll need your input to be injected into a non-text location (such as the parameters of an entity, or inside a <script> block, or similar)....


2

If you're sure that you don't want to get your site indexed on this perticular Search Engine, then you can block the Crawler by modifying .htaccess file. In .htaccess file you need to match the bot with the specific User Agent and respond with a custom response. This can be done with Apache RewriteEngine(similar functionalities would be available for other ...


1

If I didn't misunderstood, you mean the URL of asd.com. The visit is made by a crawler/robot of a search engine. The string starting with Mozilla and including the URL is the User Agent provided by its HTTP request. It tells the server of your website what kind of client it is, and the URL tells you which search engine does it belong. They simply fetch the ...


0

You could definitely hijack the session by getting cookies, if you can execute the Javascript in that page/frame by sending the message. Refer : How to send cross domain post request via javascript The minimal requirement here is, you'll need a server which you control. So that you can configure the Access-Control-Allow-Origin header of the response ...


5

The reason for the delay is that there has been little change in the Web T10. As stated by Dave Wichers, the Web T10 project lead, on 30 June 2015: Historically, we've produced a new OWASP Top 10 every 3 years because this seems to balance the tempo of change in the AppSec market, all the work everyone does to map their tool/process/other thing to ...


3

Forcing the user to pick a password you generated is an efficient way to prevent password reuse. That means both (a) that your passwords will not be usable on an other site if an attacker steals them, and (b) your users accounts will not be breached even if they were all on LinkedIn, MySpace, Sony and Ashley Madison. On the other hand, it will wake them way ...


2

It will obfuscate the actual location of the script, but on it's own there is nothing preventing an attacker from guessing/dirbustings/etc the product.php file and accessing it directly. The attacker would have to then identify the correct parameter names (id & action). Once the attacker is accessing the file directly the rewrite rule does not apply. So ...


0

Having an unique password per site isn't about people targeting that individual site, but instead the problem of 'cross contamination' from other sites. People are notorious for using the same password on multiple systems. Its been well documented that attacks take place by setting up a website of similar interests to your target (for example, a World of ...


1

Lets imagine that there is admin-account in specially crafted webapp and that account has rights to get certain files from server (like, if admin requests /getfile.php?filename.txt, the getfile.php returns content of "filename.txt"). Then you could inject ajax-request to admin's client side and request files with that.


2

There is a variant of XSS, sometimes called "Server-side cross-site scripting". It is much less common than client-side XSS. In fact, I have only seen it once on a live web site. It occurs when the server renders HTML documents. This can happen when the server produces a PDF (e.g. a printable invoice) and HTML is part of the chain. If the attacker can ...


2

You are mixing up scripts that run on the server, and scripts that run on the client. When you do XSS, you inject script on the client. Usually it is JavaScript, but it could be VBScript or some other client scripting language. You can not use document.write to write PHP. That function is JavaScript, and is therefor executed on the client. It writes in the ...


3

No. XSS makes it possible to run Javascript in a browser of another user. This makes it possible to do request on behalf of that user. Since the code is only run in the browser, you cannot use PHP code. If you have XSS and you want to run code on the server, the best approach would be to steal the cookies of a logged in administrator using XSS, and use the ...


0

I do not believe the Diffie-Hellman (DH) choice is legacy, which means obsolete and superseded, it just is not used very often. In my opinion, that's because it's not the first one in the dropdown when choosing your Cryptographic Service Provider when making a certificate request. If someone is actually doing their homework when they make their choice, ...


2

Why no update? I'm not sure but, likely there was no need, or too much discussion in the OWASP community to be able to update the web top 10 list from 2013. Also, the mobile world is evolving rapidly last years, probably that's why different vulnerabilities and needs are required and so the (mobile) security industry had to develop faster along with the ...


2

They don’t update it every year and its done by volunteers in their spare time so updates can be slow as it's very comprehensive and takes alot of work. However, they are currently working on updating it this year and are asking for people to submit data towards it. The OWASP Top 10 project is launching its effort to update the Top 10 again. The current ...


2

I could imagine the following scenario: Bob reads the email and think "Not for me, but this site would be perfect for my good friend Mallory". Bob forwards the email to him. Mallory now has the ability to sign up with Bobs email. Mallory uses the ability to impersonate Bob to e.g. stage social engineering attacks, or just to smear Bobs reputation. ...


0

Using root privileges throughout your system is similar to leaving your house keys near the window, even though it's shut. If you have experience breaking through web applications (or any other entry points) using weaknesses, then you will understand that defense-in-depth is very important. Why? Because applications always have vulnerabilities, they just ...


2

What is it? What you have are harmless SVG vectors (that are base64 encoded) being parsed using data uri in the image tag. This is a legitimate way of serving SVGs. Decoding these strings gives valid SVGs - which you can render online - https://jsfiddle.net/ykdss3b3/ (rendered as a "Save" button: https://jsfiddle.net/psL3p1hy/) <svg xmlns="http://www.w3....


1

I've seen this a number of times on various sites, it's just a technique to provide those button images that scale with the button. It could be an attack I suppose, but what's more concerning is that you have no idea where code comes from on a site that you manage. You need to be looking into source control, at the very least for stability of your website so ...


-1

As you can see in my edit, I actually decoded the base64 encoding for you. It seems to be harmless: http://www.w3schools.com/svg/svg_path.asp EDIT: For reference <svg xmlns="http://www.w3.org/2000/svg" height="30px" width="30px" viewBox="-1 -1 31 31"><g><path d="M29.449,14.662 C29.449,22.722 22.868,29.256 14.75,29.256 C6.632,29.256 0.051,22....


4

@ThiefMaster's answer does a great job of enumerating the risks of using an externally controlled Content-- which basically fall under the category of executing or displaying arbitrary code and content on a user's browser. I will mainly focus on your last question: How are those risk mitigated? which was unaddressed-- a lot has since changed (in 4 years). ...


1

VisualCaptcha is an excellent solution for UX, but can be broken with 100% success rate. As Proof-of-Concept, there is a little script to break 100% VisualCaptcha included in this blog post There are several techniques to increase the security of VisualCaptcha. These techniques will not be integrated in the "core" of VC, but a developer can decide to ...


2

You should never say never, but there is no reason to believe you could exploit that line to gain RCE. The base64_decode function does exactly what the name implies - it decodes base64. To get the parameter value executed you would need a function that executes code provided to it, like eval. You don't seem to have that, so you are out of luck. With that ...


3

Is the best choice to use some fake text to show in the box and then check that fake text on save? Yes, this sounds like the way to go. This option doesn't show the true number of characters for what they originally typed in. Is there a better method? I would see that as an advantage. I would see little benefit in revealing the number of ...


0

The real answer is that SSL certificates in their current form are comically hard to use. They are so unusable that it threatens the security of certificates, as people take shortcuts to just get stuff done. I say this as somebody who routinely deals with 2-way SSL (PKI certs), the TLS stack incompatibilities that are created by the complexity of the spec, ...


1

The base64_decode() function is not risky by itself but running arbitrary code on your system is. Having a script that calls system($_GET['cmd']) is almost an invitation for hackers to mess up your server. As soon as anyone skilled finds it, they will have loads of fun at your expense. If you're worried about security in any way, you will never let your ...


4

The way a keylogger can defeat 2FA is if the attacker is in the middle and logs in for you. If this happens, you will not see unusual activity, you will see logins exactly when you logged in, but perhaps not from your location (if your account logs that). A captured 2FA code is only useful for a few seconds. What MIGHT happen, is that the 2FA protection ...


2

Assuming the site/service does not provide the ability to remove activity then reviewing activity is, in my opinion, the best way to ensure account safety. Obviously this is dependent on the criteria of what appears is held and presented in the history.


0

A way around this would be to write the file you want directly from PHP instead of invoking a shell and a binary (which may not even be installed on this server, or something, perhaps a firewall is preventing wget from working). Also, I am not sure how a PHP file could have write permissions. Permissions are usually applied to the directory you want to ...


3

Example 1 & 2 This is because your query is applying this clause: '1'='1/*' If you have a comment character inside of your quotes the comment is not respected by the query parser, you would have to exit the quoted context first. 1 is returned as count because that's how many users have that email address. Try this instead for example 1 (the same ...


3

Others have touched on the classic issues surrounding systems designed by humans for other humans: The reality is laziness and—sometimes—stupidity coupled with “Why would this happen to me?” arrogance. Oh, how many hours of my life have been spent patching systems and—more importantly—fighting with management to get the time/resources allocated to patch ...


4

The root problem The web was simply not designed to allow secure multi-authorship or rich interaction. Nobody talked about separating content from presentation until the late 1990s. By that point, like the QWERTY keyboard, we were basically stuck for no good reason with an existing system. Nobody wanted to "break the web", so mistakes were copied and ported ...


2

It depends on what you want to protect, and when. If your server hosts a number of services, or a number of websites, then you would want the control closest to the target so as to not deny the IP from the other services/sites. If your server hosts a website and an email server, and someone pentesting you rightly triggers a block, you don't want them ...


1

Depending on what kind of service you are running you might want to do it in different places. The advantage of iptables is that it runs on linux kernel and prevents data from ever reaching your processes. Meaning that if something like heartbleed or shell shock ever happens again, attacker will never be able to reach vulnerable application. It is very ...


21

It seems easy, but is hard First of all, the attack surface is huge. You need to deal with XSS if you want to display user input in HTML anywhere. This is something almost all sites do, unless they are built purely in static HTML. Combine this with that fact that while XSS might seem easy to deal with, it is not. The OWASP XSS prevention cheat sheet is 4 ...



Top 50 recent answers are included