New answers tagged

0

Separating these out may make your system much harder to attack. For example, say there's a SQL injection flaw on your website. The attacker may be able to use SELECT INTO OUTFILE to write a shell to your system. e.g. http://192.0.2.42/comment.php?id=738 union all select 1,2,3,4,"<?php echo shell_exec($_GET['cmd']);?>",6 into OUTFILE 'c:/xampp/...


1

First, control which scripts are loaded The most important reason to block ads is to protect yourself from malicious, dangerous and incompetent code delivered through these ads. Accordingly, script blocking is a far better method than ad blocking (alone). Once you do that, you can leverage that tool for fine-grained control. Let's first assume that you ...


1

The way these scripts work is by trying to detect if a HTML element that is supposed to be holding the ad exists or is empty since adblocks methods are to remove the content from the page. Adblocker's don't have much to do about it since they remove the elements/empty them which can be easily detect by Javascript with some code as the following: if (...


7

No confidential data should ever be sent via GET. The data may be leaked or stored by: referers if you link to a different page after a login your server logs which is an issue if these logs are ever available, for example via LFI, wrong server configurations, backups, etc. browser histories which is an issue if multiple people use the same browser - eg ...


1

In general, I agree with your implication that if you only have a single web application there is little security benefit to moving the DB onto a separate server. That being said, there could be some contrived scenarios where there might be a security benefit. For example, if the web application does not have full admin rights to the DB, then a compromised ...


0

Performance and scalability is enhanced by deploying it on two servers. I can imagine someone making configuration errors and opening up more ports on the database server. Due to the presence of the firewall this will not lead to a vulnerability easily.


0

That is Intentional behavior in their Web Application, The reason is PyPI is the official Third party Software Repository of the Python. It is just like catalog of all Open source Python Packages. The .htaccess Options -Indexes is not the problem here, as these are Open Source Packages and it's public faced so, anyone can go the Site and Download manually, ...


0

You could be sneaky and serve different content to "approved" and "unapproved" clients. See http://serverfault.com/questions/336586/apache-client-ip-based-documentroot Unapproved ip's could be served a honeytrap, or just a mockup "How is this for our new frontpage?" with lorem ipsum and placeholde.it images. Armoured doors and big padlocks might scare ...


0

You could place a reverse proxy in front of the device and connect to it over HTTPS. You could add additional authentication on the proxy to prevent someone from probing the device without credentials. Of course, you wouldn't be able to use the app with proxy authentication, but I'd imagine the web interface would work fine.


0

Personally I think this is a specific case of a more general problem in programming, that IDE's and languages are overly permissive. We give our developers immense power in the name of flexibility and efficiency. The result is "what can happen will happen", and security lapses are inevitable.


4

Yes, anthropologically, humans are stupid. Yes, politically, the incentive structure does not sufficiently penalize vulnerable applications Yes, the process is flawed-- code is written in a hurry; bad/old code is not always thrown away. And, yes, technically, treating and mixing data as code is harder to do by default. But, there's a more positive view ...


1

You can not reliably detect devices, and nor do you need to. Just use the timestamp to routinely delete sessions that are more than X hours old. Note it's perfectly fine to have redundant data in a working table such as this, which was your original concern. You will need to do that anyway since sessions should always be terminated server side as well as ...


3

Because such security issues are not covered during most 3-year education cycles and equivalent studies, and many developers followed such track (including myself). Given how wide the field is, actually 3 years is not even enough to cope with the actual study program.. So things like security are dropped. It is unfortunate, but since some of the new ...


1

It's not just technical security you have to consider. No online voting system is a secret ballot; there is no way to eliminate social pressure to vote a particular way. A dominant member of the household can bully other family members into signing, or simply use their email addresses to do it himself.


2

If you use prepared statements correctly, SQL injection is not possible. "If the original statement template is not derived from external input, SQL injection cannot occur." https://en.m.wikipedia.org/wiki/Prepared_statement Unfortunately people usually don't use prepared statements correctly, if at all. SQL injection would be a thing of the past if ...


1

What would be the proper term for such a vulnerability? "Array injection"? In what vulnerability category does this belong (for example in the OWASP Top > 10 or CWE list)? This is called "parameter tampering" and has been called as such by PHP developers, OWASP, and falls under different CWE numbers with the parent being CWE-371, e.g. when the ...


1

The main risk of a persistent session is increased exposure for any existing client-side vulnerabilities (e.g. XSS, CSRF, session fixation, etc). That is, any malicious site targeting your users through exploits for the above would be more likely to succeed because the user is left logged in. With remember-me the above could apply too - Say the long-term ...


0

(I already had some thoughts on the matter but was seeking further opinions. Since I seem to have caused some confusion, setting them out here may help in understanding the problem I am trying to address). There are very definite functional impacts, particularly if the developer chooses to use the session substrate for storing transactional information, but ...


2

The risk isn't that a script such as http://attacker.com/omg.php runs on your domain, it is that a user manages to break out of the <div style='background-image: url("http://example.com/image.jpg")'></div> context where the URL is written to the page. Note the code has been corrected from your question (single quotes used for HTML attribute ...


-2

PDO (or other "safe" methods) is no more secure than mysql_ (or other "unsafe" methods). It makes it easier to write safe code, but it is even simpler to just concatenate the unescaped user provided strings into the query and not bother with the parameters.


12

I agree with a lot of the answers, but one very important point isn't made: code doesn't magically fix itself, and there is a lot of code out there which is 17 years old. I have seen many companies write clean and safe new code, whilst the application could still be attacked in some of it's older sections. And worst of all: fixing old code is expensive, ...


158

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence? When was the last time a company lost a big contract because their company website login page didn't validate ...


2

While the answer would be 'no', in this case it doesn't matter. All it is, is in 'indicator'. It doesn't need to be trusted to be 'looked at'. If someone were to do internet-voting, then this system would be a very, very bad idea to use.


8

I think the main reason is that developer training doesn't start with best practices, it starts with language understanding. Thus, new programmers, believing they have been trained with the tools to create something proceed to create the queries the way they've been taught. The next and most dangerous step, is to allow someone to develop anything without ...


3

The problem Imagine the following scenario: Alice logs in to your site on her computer at home, and stays logged in. Later she logs in on a computer at school as well, but signs out when she is done. What happends when she gets home? To make this system work, you would need to set the cookie column to NULL on logout. But that would log her out from all ...


1

Cause it's easier to use a session hijacking attack... More about it here https://www.owasp.org/index.php/Session_hijacking_attack


7

Firstly no one writes secure requirements properly, they say something like "The product shall be secure" Which in no way is testable Secondly Profession developers are not stupid, and to say so is rather disingenuous, they are all likely to have university degrees, and have been solving problems we haven`t even begun to look out... The problem is that ...


1

They can verify the name and post code against the electoral roll. When they say 80,000 fraudulent names removed, I expect those are the ones that don't match (I don't know this for sure). However, this is flawed because much of the electoral roll is public.


14

I don't know if this is how things are done in Britain, but this is how things are done in the Netherlands whenever a petition is submitted to the government: A random sample of the signatures is taken; These signatures are verified (I think they call people to ask if they've signed); the resulting ratio of valid:invalid signatures is then applied to the ...


3

You cannot match postcode to IP location, I use Plusnet in the UK and it shows up as being in Dundee (several hundred miles away) from me when I check my location according to location. So it cannot be using that to check. Similarly, you don't need millions of email addresses, just 1 with many aliases - assuming the email address is actually checked. I ...


6

Why did SQL injection vulnerabilities not got extinct yet? Metaphorically speaking, for the same reason that car crashes are still around since the very first car in 1895 and even the most innovating and modern self-driving cars today, Tesla model S (on autopilot) or Google self-driving car crash from time to time. The cars are created (and controlled) by ...


0

You can't make it failproof, but you can increase the amount of parameters to take into account so the maximal percentage of cheat becomes statistically insignifiant. Still, I live in France, have been to Wales once for a week or so in my whole life, and just signed the petition as a londoner that lives at 1 Jamaica St. My web browser has no permission to ...


2

Your assessment of the risk is correct: leaking this data could facilitate an attack by helping the attacker collect information. So even if there is no direct risk, it could speed up the information gathering phase of an attack. If you have any concern, the usual solution is to sanitise your responses as needed - you could replace those 403's with 404's ...


17

General comments Can you be 100% sure that every signature is from a real person? No. Can you take some precautions to make it harder to cheat? Yes. Here are some things that the British government could do (no idea if they actually do it): Require a successful CAPTCHA after X attempts from the same IP. Rate limit by IP. Sure, five persons in the same ...


76

The petitions site is purely a mechanism to see whether there may be high enough numbers to support something, and if so, that something will be discussed in Parliament. There are some checks and balances (for example 80,000 fake votes were identified and removed) but there is no need for a strong level of trust here, as nothing is decided by any of these ...


3

For the governement tool : I see one interesting point : there is a map showing the distribution accross the votes : http://petitionmap.unboxedconsulting.com/?petition=131215. We can see here that the votes have been made accross all the country, and the distribution seems to follow ppopulation density (more votes on London,...). An elaborate bot could ...


25

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe". This works, and your application seems to work fine. Then, one day, someone names their child Robert'); DROP TABLE Students; -- (little Bobby Tables). https:...


18

Steffen makes good points in his answer, but I'd like to add to it. The why, I think, can be broken in to the following topics: Lack of knowledge or education of developers Churn in an enterprise development environment Pressure to deliver ahead of schedule Not enough emphasis from the top on security So let's break those down. Developer training There'...


77

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax trees as first-class objects, not by concatenating strings that represent fragments of a language. There has been a bit of progress in recent years with the ...


286

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one still has to use these techniques. And many developers are simply not aware of security problems. Most care that the application works at all and don't care ...


3

What are some reasonable/interesting ideas of ways to address this issue practically? GPG encryption, with steganography to hide the fact that you're using encryption in plain sight. The basic idea you need to avoid mandatory compromise to encryption, is find any data channel that is not blocked and use non-compromised encryption over that data channel. ...


0

You can try to create a SSH tunnel to tunnel HTTPS through it. I guess this post explains how to perform this in an effective way, otherwise you can find a lot of guides on the web explaining how to create a SSH tunnel.


0

You can secure your code in a limited fashion. Create a dedicated development environment where: The developers can connect with remote desktop only. All shared drives, clipboard sharing, local printing, etc. is disabled. The environment has no Internet access - or if it does, it's heavily restricted. With this setup, developers can view the code but ...


0

How can you place measures to prove later in court that that source code is yours? Place a copy in escrow prior to showing the code to anyone. When you form a partnership or employ someone, you might get them to sign a statement, preferably in front of witnesses, that acknowledges your ownership of a specified body of code. The statement might include a ...


1

You're trying to do the impossible here. You're having the localhost server authenticate the client application running in the browser. This is impossible to do securely. What you would want is to write a browser plugin/add-on. The browser plugin/add-on should only activate itself when visiting authorized sites.


2

Must say a self explanatory question written by a man who knows exactly what he wants. You've got some fine responses already, contributing my penny as below. It is extremely common to have code base accessible to developers/testers(employees) however there should be precautions to be taken like if any encryption keys are present they'd not be part of ...


1

What would the benefit to an attacker be if they could see client-side code they are not supposed/allowed to use? Even if the hacker is not allowed to / unable to use the code they see, they can still gain the benefit of additional information, which they use to later attack your site. A particularly valuable source of information is the JavaScript ...


3

What would the benefit to an attacker be if they could see client-side code they are not supposed/allowed to use? It may be easier to exploit vulnerabilities such as CSRF or missing access control if an attacker has access to the client-side code and thus to the requests that may be performed. It may also be easier to find vulnerabilities such as XSS. ...


2

This is an interesting question why I was looking into the source code of Chromium too see how they do it. The Answer It is nearly impossible to implement a 100% reliable feature to prevent a screenshot that will be used in the most visited view. You have to hide the sensitive content right the moment the service is storing the data. Which might happen all ...


0

hi you can test this python script to search for admin page https://dl.packetstormsecurity.net/UNIX/utilities/AdminpageFinder.py.txt



Top 50 recent answers are included