Questions tagged [owasp]
For question about OWASP products or the practices of the organization. Do not use just because the vulnerability you are asking about is included on the OWASP Top Ten list.
166
questions
1
vote
0
answers
28
views
Benefits of certificate pinning to leaf with intermediate as a backup?
According to the OWASP Cheat Sheet on Certificate Pinning, their recommendation is to pin to the leaf certificate, but also pin to the intermediate CA as a backup.
Any security measure is only as good ...
- 111
0
votes
1
answer
96
views
Updating regular expressions for the rules 920600, 921421, 921422 and 922110 in CRS 3.3.4
After updating to CRS 3.3.4, I want to update the regular expression of the rules 920600, 921421, 921422 and 922110. but the command util/regexp-assemble/regexp-assemble.py update 920600 does not work....
1
vote
2
answers
133
views
ModSecurity / CRS: Need custom rule to deal with false positive (user-inserted HTML formatted listings)
ModSecurity 3.0.8
ModSecurity-Nginx 1.0.3
CRS 4.0.0-rc1
I have a marketplace where sellers can list anything for sale. On the "item description" section, we allow users to copy and paste ...
- 71
0
votes
1
answer
369
views
Execution error - PCRE limits exceeded
I have problem when implementing modsecurity and crs. Here is the issue, I hope anyone can give us some guide for resolving this issue.
Apache version :
Server version: Apache/2.4.29 (Ubuntu) Server ...
- 101
1
vote
1
answer
54
views
Interpreting OWASP prohibition: no sensitive-account login to any frontend interface
OWASP’s Authentication Cheat Sheet states unequivocally:
Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
- 123
0
votes
1
answer
67
views
Is using newsequentialid bad?
I found a project that uses T-SQL's newsequentialid() for one of their external ID columns which is used for public APIs.
When that column is added to an existing table, each row gets an incremented ...
- 179
2
votes
0
answers
36
views
Normative reference for a web application disclosing existing values of integration secrets to users
In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets.
The ...
- 121
1
vote
1
answer
74
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
0
votes
0
answers
288
views
Azure WAF support for OData
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. ...
- 101
0
votes
1
answer
596
views
ModSecurity rule 941160 triggered by WordPress legacy-widget-preview
We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="...
- 13
0
votes
1
answer
483
views
CORS without Access-Control-Allow-Credentials [duplicate]
I'm testing a web application and burp detected this issue:
Cross-origin resource sharing: arbitrary origin trusted
Looking at the response, I only see this header:
Access-Control-Allow-Origin: https:/...
- 117
1
vote
1
answer
231
views
Fuzzing in OWASP ZAP through the command line
First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins.
The official docker image seems to have a script that performs spidering and active scans but does not do ...
- 11
0
votes
2
answers
1k
views
Prevent URL encoding on form submit
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
- 271
0
votes
1
answer
703
views
ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site
The following search queries are blocked by ModSecurity and returns a 403 forbidden error:
www.example.com/s=zip+someword &
www.example.com/s=gzip+someword
but not
www.example.com/s=zip & www....
0
votes
1
answer
334
views
XSS Payloads: <script> vs javascript:
Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for
javascript:alert(0)
The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML.
<...
2
votes
1
answer
417
views
How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"?
I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail.
I am not sure what exactly the author of a ...
- 23
0
votes
0
answers
262
views
JWT implementation and protection against CSRF and XSS
I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that.
Flow is as below.
When authenticated ...
- 101
2
votes
0
answers
240
views
Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?
I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
- 121
3
votes
1
answer
748
views
What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?
I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was:
Do not rely exclusively on API keys to ...
- 227
1
vote
0
answers
248
views
Decoding burp XSS DNS resolution payload
I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
- 11
3
votes
2
answers
400
views
Is using PBKDF2 good protection against brute-force attacks on web application login pages?
We've recently had a penetration test for one of our applications.
The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page.
Ref: ...
- 33
1
vote
0
answers
1k
views
What's the latest thinking on website session expiry time? [closed]
Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
- 1,738
0
votes
1
answer
191
views
Client-side password strength policy verification. CVSS3.1? OWASP WSTG?
Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category?
Also which CVSS it should have?
- 557
1
vote
0
answers
118
views
OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)
How I can fuzz a request with 3 parameters (locations) and 3 payloads:
request1 => parameter1=payload1.1;
parameter2=payload2.1;
parameter3=payload3.1;
request2 => ...
3
votes
1
answer
754
views
MSTG-ARCH-7: All security controls have a centralized implementation
In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation".
Now I'm struggling a bit by what ...
1
vote
0
answers
113
views
Prevent XXE attack by preprocessing XML
I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE.
It is difficult to update the project to use newer versions of XML ...
- 149
1
vote
1
answer
339
views
Is `SecAction` order important for an OWASP ModSecurity config file?
Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules...
On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
- 111
2
votes
2
answers
4k
views
Qualys WAS raises "150004 Path-Based Vulnerability" on an image file
Customer is running Qualys Web Application Scan and the WAS Scan Report reported:
150004 Path-Based Vulnerability
on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
- 121
0
votes
1
answer
1k
views
How to Create file name with Slash in it for Path traversal attack?
Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
5
votes
3
answers
308
views
Is non-executed content still considered XSS?
I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
- 151
-1
votes
1
answer
92
views
owasp zap api with generate param [closed]
my api is:
localhost/api/aut/1111111111111111
I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
- 103
0
votes
2
answers
979
views
OWASP ZAP API HTTP Sessions setup
I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
- 113
0
votes
0
answers
106
views
Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure
Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
1
vote
2
answers
2k
views
What is the best way to get OWASP ZAP to fuzz parameters with real data?
I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
- 11
0
votes
1
answer
1k
views
Stop an in-progress passive scan in OWASP ZAP 2.9
I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all.
I have disabled all ...
0
votes
3
answers
174
views
Sending static registration links via email
In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
44
votes
8
answers
9k
views
Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?
I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
- 541
3
votes
2
answers
279
views
Testing web applications from an end user's perspective
I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable.
...
- 31
0
votes
1
answer
647
views
OWASP ZAP submit forms
I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:
I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
- 101
0
votes
0
answers
481
views
Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection
I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device.
I followed the setup instructions available here: https://security.secure.force.com/...
- 101
1
vote
1
answer
309
views
Modsecurity - OWASP CRS 901001
Ubuntu 18.04
Apache/2.4.29
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0
modsecurity-crs 3.0.2-1
This is a new server. The following message appears in modsec_audit.log ...
- 379
2
votes
0
answers
254
views
How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]
Let's say you have a Java app which has a query which can unlock/reset passwords for users like:
ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK
...
- 21
0
votes
0
answers
115
views
Returning Social Security Number After Validation Checks on Web Based Form
I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
- 1,339
2
votes
1
answer
693
views
How exactly works this SQL injection example related to the DVWA application?
I am a software developer converting do application security and I have some doubts about SQL injection example.
I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/
So I have ...
- 235
8
votes
1
answer
774
views
Some doubts about SQL Injection examples, how exactly works?
I am a software developer starting studying application security and I have the following doubt related SQL injection.
I am following a video course and there are these two examples:
I have an ...
- 235
1
vote
1
answer
70
views
Good Security API package for Java [closed]
Is there a good security API (all in one) for Java to prevent things like SQL injections, Cross site scripting and those owasp top 10 vulnerabilities?
- 1,931
9
votes
3
answers
1k
views
Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet
I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking)
At the ...
- 91
0
votes
1
answer
957
views
Use OWASP ZAP import URLs addon programatically and change the HTTP method
I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
-1
votes
1
answer
516
views
What is "Map Execution Paths Through Application"?
I am reading the OWASP Test Guide v4 to learn how to pentest a web application. In the documentation, there is a section called "Map execution paths through application (OTG-INFO-007)".
I'm not sure ...
- 425
0
votes
0
answers
85
views
Pre-flight request is triggering in Chrome but not in IE
I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
- 43