New answers tagged

0

One flaw with this system is that email addresses are often fairly predictable, and a lot of people have email addresses from a relatively small number of providers. This can mean that a targeted attack (spear phishing, for example) can use these type of forms as a way of confirming guesses at email addresses. For example, a user called John Smith might ...


1

I believe they do this in order to prevent spammers from entering random usernames and obtaining a list of email addresses, while still reminding the set address to the legitimate user (who might have more than one account). I personally don't see any major problem with that. Of course, someone might set up an account with an old email address, forget ...


2

I have a hypothesis that it is an identifier (non-social security number) that companies will sell to each other to track everything you do. So far I have been asked by: Vanguard, Fidelity, Bank of America, eBay, Amazon, Netflix, Yahoo, Google, LinkedIn. I think there are more, but I forget. It may be centralized because they all ask in the same manner, with ...


1

The 2008 paper from Blake Franz of Leviathan Security -- http://www.leviathansecurity.com/white-papers/flirting-with-mime-types -- identifies some of the original problem spaces with character sets. Some tools correctly identify and explain this problem, such as Burp Suite Professional -- ...


5

Decrease client-side attacks. For eaxmple : If the page that the XSS resides on doesn't provide a page charset header, or any browser that is set to UTF-7 encoding can be exploited with the following. for example (UTF-7 encoding): +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- And It Is hard to Prevent XSS Attacks more info : Xss with utf-7


1

Short answers : 1.) no not a requirement 2.) yes via authenticated client browsers being manipulated. SilverlightFox is correct in that the crossdomain.xml is not a web application requirement. Per Adobe's website the crossdomain.xml is a policy in the form of an XML file which "grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not ...


0

No, crossdomain.xml relaxes Flash's default cross-domain policy. Lack of a file will enforce default restrictions.


2

There are Yara rules submitted by SANS ISC to detect BeEF, and these could be repurposed by yarashop for the network layer as a early-warning detection system. The author shows how to utilize Volatility to read into a memory capture and look for BeEF-related signatures and communications -- ...


0

If the sole concern is "hook.js" browsers such as Mozilla, Firefox have script blockers addons (e.g. noscript), if you're using IE, you could enable script blocking which would render any javascripts moot. As for tracking the communications server, you could use netstat: netstat -an | findstr 8080 That would only work if whomever set a port to 8080. Your ...


1

can we use XOR enc to store data in the string itself to optimize the DB queries? Yes, but it will no longer be called a token, but rather a ticket (if using a symmetric encryption) or certificate (if using symmetric encryption). Like tokens, tickets and certificates are string used for authentication, but they actually contain encrypted and/or ...


6

Using os.urandom() is perfectly alright. It generates a cryptographically secure random stream of bytes. This would be impossible to guess for anyone. Using guid() is also pretty secure, although not totally random. Using XOR to encode parameters into your token is a bad idea. For one, it is vulnerable to bit flipping attacks. Even if the user can not ...


2

Using os.urandom() uses accepted cryptographically secure sources, so continue to use that if you can, otherwise there should be another way to access the same, or similarly secure random sources in the implementation you are using (php java). The most important thing is that it cannot be predictable, which means any sort of seeding done manually (for ...


0

This is how I would do it. Have the web app generate a public/private pair (say DH). Show the public key on the screen as QR code, the user then scans it with the phone. From this point onward, the phone can send anything to the web app securely.


0

So a lot of people are saying sanitize the input(great answer here), but a great approach to this would be to whitelist/blacklist and do string matches. Blacklist: If any part of the string contains something known as bad and checked against a list that can be remotely updated(say, a json of known string(s) in bad commands that can be updated from a ...


3

No, there's no other way to know if the file exists or not. However, if you can find out what OS is running on the system, then often you will be able to find the right path to certain files quite easily. In rare cases websites have a script or page which iterates through files in a folder specified by a POST or GET parameter which you could manipulate to ...


0

Simple. YouTube has a comments section, description box, and in-video annotations. This means anyone can post URL's on YouTube so clicking the "wrong" URL posted by someone else can potentially lead to malware or a virus.


1

You should not only protect yourself from XSS by scanning HTTP requests for attacks. Such a scan will never be complete, and there will always be some smart tricks that slip through the net. Your first line of defence must always be to properly sanitize untrusted data, so as not to create any XSS vulnerabilities in the first place. For how to do that, see ...


-3

To be short I'd recommend you to download Arachni from here, start arachni_web (the WebUI) and to open the URL which will be displayed before. You will be able to test any web site for many existing problems inclusive XSS. I find Arachni very helpful. UPDATED: If Arachni will find some problem that it will provide detailed instruction how you can reproduce ...


0

Client certificates have all the nicest quality for authentication. But because of a chicken and egg problem users have no reason to acquire a serious certificate (costs money and time because the delivery should be a face to face operation) because few sites use them, and site administrators have no reason to actively support them since their users ...


0

I work developing a site which offers smart card authentication. The user connects a USB card reader, goes to the site, and when he wants to log in, he inserts the card and supplies a PIN. The issue is that the system uses a Java Applet, and these applets are no longer supported by Chrome or by MS Edge. New middleware is being developed which does not use ...


0

I've seen several web applications that implement a "sudo mode". In your example, it might look something like this: I, an admin, am logged into your application, and stay logged in for long periods of time (perhaps the session expires after 30 days). I protect this account with reasonable amount of security, but I'm not super paranoid about it. When I ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


0

You open yourself up to bad user behavior at that point. Really you want to keep them safe by making sure you protect against as much bad user behavior as possible. If an admin opens the web view it makes it easier for them to forget they are in the admin area and leave without signing out of the admin area, leaving it open to someone sitting down and ...


1

If it needs to be accessed by other companies, I suggest to use the VPN. But if the VPN is not possible, please consider the following points Tightened firewall allowing the traffic only through SSL If possible permit only your client's IPs through the firewall Make sure to run a full vulnerability testing on the site using softwares like OWASP ZAP or ...


2

Very broad question, but here is a baseline of security additions I would add Firewall rules to block ALL except authorized sources Remote syslog/event logs Web Application security test This is beyond broad, and scattered. The reasoning? I have no idea what your risk is. Only you and your organization can determine that. So a quick risk analysis on a ...


0

Here is a list of tools I evaluated for us. sysPass sysPass is a PHP web based Password Manager for business and personal use. AES-256 encryption in CBC mode RSA for sending passwords from forms Two factor authentication HTML5 and Ajax interface Users, groups and profiles management (up to 20 access levels) MySQL, OpenLDAP and Active Directory ...


0

Others mentioned that just retrieving a URL can provide crucial information to the host; usual the information is that you have read an email. That said, I assume that one option to inspect a web page securely which is not too uncomfortable or complicated is to open the URL in a text based browser like lynx (under Windows perhaps in a cygwin environment). ...


0

I think there might some reasons behind for not using lockout/retry counter: For any invalid username input or good username/bad password input, it should always return error message 'Invalid username or password'. Or the error message will leak user information. For lockout, it is not valid non existing users; locking out existing users might even worse ...


2

Careful! Based on what you're saying, you've already donned the Hat, and now it's up for interpretation whether it's a Black, Grey, or White Hat. Depending on localities, you may actually have already committed a felony. System administrators can get very protective of their systems, and they don't always see the honest-guy-shows-you-your-lock-is-broken ...


1

Yes, this is a serious security oversight and needs to be reported so it can be fixed immediately.


0

I like @Robert Mennell's answer, but I'll add that there is one way to see what the site is running, and that is to yank the disk and inspect it in another machine. That way, you're less likely to be impacted by a rootkit that's causing the OS to lie to you. Of course, the drive firmware could be lying to you, but that's a pretty specialized rootkit.


3

It's hard to inspect websites by analyzing their source code, because some sites have hidden codes in it. You might want to try reputation based analysis. You can add an add-on to your browser to analyze the site before you click it. Example of it is wot, a plug-in (web of trust). https://www.mywot.com/ You can also send the URL to a free URL Scanner. ...


12

Visiting a malicious site is often a hit or miss because you're talking to THEIR software that THEY control. You have no real control over it no matter what you do. It could appear non malicious for a long time, and then hit you. It could try to hit you as soon as you visit it. It could... Because there are literally infinite possibilities of how a site ...


31

Why not just send the URL to Virustotal? Accessing a malicious website can be tricky. Using curl, wget, links -dump can be tricky depending on how the malicious content is served up. For example: <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{HTTP_USER_AGENT} RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|libwww\-perl|curl|wget).* [NC] ...


0

The refresh mechanism is precisely built to avoid saving credentials. Credentials give you access to the whole account, whereas the refresh token only gives you access to auth tokens that will work for the designated domain. You say you app is stateless, but if you can save credentials why can't you save a refresh token? Besides, your app should handle ...


0

As I mentioned in the comment, you can't trust javascript served by the server. The idea of keeping the client side downloaded on their computers is interesting, although that doesn't really solve the issue. The server can still include javascript as part of a response unless you are insanely careful. In this case I really wouldn't go with javascript. ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


0

Password-protecting a key, either symmetric or asymmetric, is a common practice. See the question Encrypting With Passwords - Encryption of Key vs. Data for an example. One problem is that users can choose weak passwords. This can either be, as you note, the same password that they use to authenticate to the site, or it can just be a generically weak ...


1

Data URI is a standard for embedding the data you want to use directly within your page (that is - not be in need to use an external file). This is handled by the browser and is essentially a Base64 version of the binary file (a picture in your case). So, client wise, you are as safe as your browser is. I did not fully understand your question but you are ...


1

When the FBI finally found the server it was due to the silkroad server leaking an IP address via captcha. The FBI was able to use that to track down the hosting provider. They showed up with a warrant and grabbed one of the drives. The Raid controller happily re-built the mirror onto a fresh drive and the operators never noticed. The FBI then had an ...


0

"What can go wrong": If you do that with an API, then all iOS applications designed for iOS 9 and running on iOS 9 using that API will stop working. It's called "App Transport Security", and unless the developer creates an exception for your domain, http is not accepted, and https with not sufficiently secure connections is not accepted. Since your API ...


0

There is a strong chance that her device is infected with malicious software, this may be the result of visiting just a link that has been send to you. Try Lookout, A predictive security app which I use often and recommend to friends and clients. You can install the Android or iOS app to enable app scanning, it enables continuous, over-the-air protection ...


1

Giving away information in the URL An URL might be accessible even to a person that is not supposed to have access to the actual page it leads to. After all URLs can show up in links all over the web or leak via referer headers. Therefore there should be no sensitive information in the URL. The Mongo ID contains information about the time the object was ...


1

The OWASP mentions that simply having any sort of direct identifier can be bad, as explained in the Top 10 2007-Insecure Direct Object Reference and Top 10 2010-A4-Insecure Direct Object References entries. An attacker that can figure out how to exploit such an direct reference will have far more power than they should. The OWASP actually recommends using ...


1

I can't think of any real security risk to exposing the mongoDB id (versus some other counter id), other than exposing creation time according to the server to the users. Having the mongo primary key vs some other unique key (like a counter) shouldn't make a difference in terms of exposure. Granted you should be aware, the mongo _id consists of: a ...


1

This exposes meta information in the MongoDB ID as stated in the answer from dr jimbob which is a security concern in some aspects. Another way to post this question is What is the best practice for not exposing meta information about the entries in my DB in links and URIs? The answer to that question is simple: Use a unique identifier field for the ...


0

Normally this would be a "fake encryption key". In the response to the report: Now you are making **** up. As it turns out, I was told what you might be hinting at here, and it’s clear you have no idea what the **** you are talking about. In other words, in this context it's just a made up thing. However, there are other situations, for ...


8

Your credentials are safe, but Session Hijacking might happen One possibility could have been an attacker might have done a SSL Strip attack while acting as the Man In Middle, If that happens the HTTPS website will be served as HTTP to the victim. But as you have confirmed with the website that they have done it intentionally, so this possibility is striked ...


2

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security assessments, and more specifically towards bug hunting in bug bounties. Make sure to also check the video :)


22

I would raise the following question: What's the point in having authentication in the application? If all the page contains is public content and verifiable in an outside way (eg. a debian mirror, where packages are with PGP) and your users don't mind a third party scrutinizing what they visit, the page might not need https. But not a login either. ...



Top 50 recent answers are included