Questions tagged [owasp]

For question about OWASP products or the practices of the organization. Do not use just because the vulnerability you are asking about is included on the OWASP Top Ten list.

Filter by
Sorted by
Tagged with
0 votes
0 answers
42 views

unsafe-hashes an alternatives

I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine. <script th:inline="javascript"> /*<![CDATA[*/ var ...
Shaunyl's user avatar
  • 101
1 vote
1 answer
37 views

Verbose Headers/Information Leakage via HttpResponse Headers vs fingerprinting via named headers

I understand that a header like X-Powered-By can reveal details about the operating environment that can be used to find known vulnerabilities because you often get the language and compiler/...
JoSSte's user avatar
  • 149
0 votes
1 answer
163 views

Compatibility of ModSecurity Core Rule Set 4

OWASP Core Rule Set has many versions the latest is version 4.0 (release candidate), but I cannot find any indication about compatibility among various modsecurity releases. Could these be used with ...
AndreaF's user avatar
  • 103
1 vote
1 answer
146 views

Benefits of certificate pinning to leaf with intermediate as a backup?

According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup. Any security measure is only as good ...
jon's user avatar
  • 111
0 votes
1 answer
250 views

Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4

After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
user288156's user avatar
1 vote
2 answers
401 views

ModSecurity / CRS: Need custom rule to deal with false positive (user-inserted HTML formatted listings)

ModSecurity 3.0.8 ModSecurity-Nginx 1.0.3 CRS 4.0.0-rc1 I have a marketplace where sellers can list anything for sale. On the "item description" section, we allow users to copy and paste ...
peppy's user avatar
  • 91
0 votes
1 answer
1k views

Execution error - PCRE limits exceeded

I have problem when implementing modsecurity and crs. Here is the issue, I hope anyone can give us some guide for resolving this issue. Apache version : Server version: Apache/2.4.29 (Ubuntu) Server ...
navotera's user avatar
  • 101
1 vote
1 answer
71 views

Interpreting OWASP prohibition: no sensitive-account login to any frontend interface

OWASP’s Authentication Cheat Sheet states unequivocally: Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
Jim Ratliff's user avatar
0 votes
1 answer
116 views

Is using newsequentialid bad?

I found a project that uses T-SQL's newsequentialid() for one of their external ID columns which is used for public APIs. When that column is added to an existing table, each row gets an incremented ...
David Klempfner's user avatar
2 votes
0 answers
43 views

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...
rmc47's user avatar
  • 121
1 vote
1 answer
111 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
边明凯's user avatar
1 vote
0 answers
496 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
CuriousGuy's user avatar
0 votes
1 answer
853 views

ModSecurity rule 941160 triggered by WordPress legacy-widget-preview

We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="...
Peter's user avatar
  • 13
0 votes
1 answer
820 views

CORS without Access-Control-Allow-Credentials [duplicate]

I'm testing a web application and burp detected this issue: Cross-origin resource sharing: arbitrary origin trusted Looking at the response, I only see this header: Access-Control-Allow-Origin: https:/...
moskino11's user avatar
  • 117
1 vote
1 answer
337 views

Fuzzing in OWASP ZAP through the command line

First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins. The official docker image seems to have a script that performs spidering and active scans but does not do ...
Roshan's user avatar
  • 11
0 votes
2 answers
2k views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
user121099's user avatar
0 votes
1 answer
1k views

ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site

The following search queries are blocked by ModSecurity and returns a 403 forbidden error: www.example.com/s=zip+someword & www.example.com/s=gzip+someword but not www.example.com/s=zip & www....
skinnedpanda's user avatar
0 votes
1 answer
482 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
letsplayrust5346's user avatar
2 votes
1 answer
496 views

How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"?

I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail. I am not sure what exactly the author of a ...
soro's user avatar
  • 23
0 votes
0 answers
346 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
sujeet's user avatar
  • 101
2 votes
0 answers
274 views

Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?

I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
user1821961's user avatar
3 votes
1 answer
1k views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
Script47's user avatar
  • 227
1 vote
0 answers
294 views

Decoding burp XSS DNS resolution payload

I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
user316389's user avatar
3 votes
3 answers
506 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
Silvercroft's user avatar
3 votes
0 answers
2k views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
Robin Winslow's user avatar
0 votes
1 answer
248 views

Client-side password strength policy verification. CVSS3.1? OWASP WSTG?

Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category? Also which CVSS it should have?
Maicake's user avatar
  • 567
1 vote
0 answers
134 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
KirillPutchenko's user avatar
4 votes
2 answers
871 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
A security researcher's user avatar
1 vote
0 answers
128 views

Prevent XXE attack by preprocessing XML

I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE. It is difficult to update the project to use newer versions of XML ...
John Donn's user avatar
  • 149
1 vote
1 answer
433 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
intika's user avatar
  • 111
2 votes
2 answers
5k views

Qualys WAS raises "150004 Path-Based Vulnerability" on an image file

Customer is running Qualys Web Application Scan and the WAS Scan Report reported: 150004 Path-Based Vulnerability on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
Jeff Mergler's user avatar
0 votes
1 answer
2k views

How to Create file name with Slash in it for Path traversal attack?

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
user154's user avatar
5 votes
3 answers
376 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
Noah Heck's user avatar
  • 151
-1 votes
1 answer
100 views

owasp zap api with generate param [closed]

my api is: localhost/api/aut/1111111111111111 I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
Grenoblois's user avatar
0 votes
2 answers
1k views

OWASP ZAP API HTTP Sessions setup

I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
Josh's user avatar
  • 113
0 votes
0 answers
132 views

Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure

Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
user229317's user avatar
1 vote
2 answers
2k views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
user8348136's user avatar
0 votes
1 answer
2k views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
Keeper of the Grove's user avatar
0 votes
3 answers
198 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
user227480's user avatar
44 votes
8 answers
9k views

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
Gaming's user avatar
  • 541
3 votes
2 answers
306 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
ndantonio's user avatar
0 votes
1 answer
768 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
Andrzej Gis's user avatar
0 votes
1 answer
609 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
VictorB's user avatar
  • 101
1 vote
1 answer
373 views

Modsecurity - OWASP CRS 901001

Ubuntu 18.04 Apache/2.4.29 ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0 modsecurity-crs 3.0.2-1 This is a new server. The following message appears in modsec_audit.log ...
user1801810's user avatar
2 votes
0 answers
303 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
Garret's user avatar
  • 21
0 votes
0 answers
139 views

Returning Social Security Number After Validation Checks on Web Based Form

I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
TroySteven's user avatar
  • 1,349
2 votes
1 answer
852 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
AndreaNobili's user avatar
8 votes
1 answer
823 views

Some doubts about SQL Injection examples, how exactly works?

I am a software developer starting studying application security and I have the following doubt related SQL injection. I am following a video course and there are these two examples: I have an ...
AndreaNobili's user avatar
1 vote
1 answer
73 views

Good Security API package for Java [closed]

Is there a good security API (all in one) for Java to prevent things like SQL injections, Cross site scripting and those owasp top 10 vulnerabilities?
JinPangPang's user avatar
  • 1,951
9 votes
3 answers
2k views

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking) At the ...
Chris's user avatar
  • 91