Questions tagged [owasp]

For question about OWASP products or the practices of the organization. Do not use just because the vulnerability you are asking about is included on the OWASP Top Ten list.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Is this the only form of session fixation?

From what I understood and read, the typical scenario is the following: ATK visits a login page which sets a session ID (realistically a cookie). The attacker already tested that after the login in ...
0
votes
1answer
55 views

Client-side password strength policy verification. CVSS3.1? OWASP WSTG?

Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category? Also which CVSS it should have?
1
vote
0answers
33 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
3
votes
1answer
81 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
1
vote
0answers
63 views

Prevent XXE attack by preprocessing XML

I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE. It is difficult to update the project to use newer versions of XML ...
0
votes
0answers
38 views

What tool/methodologie is used in security orchestration of OWASP appsec pipeline?

I'm reading materials about appsec pipeline. It seems interesting. OWASP has a project about it here https://owasp.org/www-project-appsec-pipeline/ I was reading a slide share about it but the author ...
0
votes
0answers
29 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
0
votes
1answer
512 views

Qualys WAS raises “150004 Path-Based Vulnerability” on an image file

Customer is running Qualys Web Application Scan and the WAS Scan Report reported: 150004 Path-Based Vulnerability on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
1
vote
0answers
47 views

OWASP CRS Anamoly scoring,, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines : setvar:'tx....
0
votes
1answer
120 views

How to Create file name with Slash in it for Path traversal attack?

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
4
votes
3answers
145 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
-1
votes
1answer
36 views

owasp zap api with generate param [closed]

my api is: localhost/api/aut/1111111111111111 I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
0
votes
1answer
68 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
0
votes
2answers
209 views

OWASP ZAP API HTTP Sessions setup

I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
0
votes
0answers
44 views

Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure

Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
1
vote
2answers
285 views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
0
votes
1answer
291 views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
0
votes
3answers
95 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
41
votes
8answers
8k views

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
3
votes
2answers
133 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
0
votes
1answer
248 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
0
votes
0answers
86 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
1
vote
1answer
118 views

Modsecurity - OWASP CRS 901001

Ubuntu 18.04 Apache/2.4.29 ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0 modsecurity-crs 3.0.2-1 This is a new server. The following message appears in modsec_audit.log ...
2
votes
0answers
101 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
0
votes
0answers
58 views

Returning Social Security Number After Validation Checks on Web Based Form

I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
2
votes
1answer
197 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
8
votes
1answer
604 views

Some doubts about SQL Injection examples, how exactly works?

I am a software developer starting studying application security and I have the following doubt related SQL injection. I am following a video course and there are these two examples: I have an ...
1
vote
1answer
30 views

Good Security API package for Java [closed]

Is there a good security API (all in one) for Java to prevent things like SQL injections, Cross site scripting and those owasp top 10 vulnerabilities?
7
votes
3answers
498 views

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking) At the ...
0
votes
1answer
347 views

Use OWASP ZAP import URLs addon programatically and change the HTTP method

I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
-1
votes
1answer
212 views

What is “Map Execution Paths Through Application”?

I am reading the OWASP Test Guide v4 to learn how to pentest a web application. In the documentation, there is a section called "Map execution paths through application (OTG-INFO-007)". I'm not sure ...
0
votes
0answers
47 views

Pre-flight request is triggering in Chrome but not in IE

I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
3
votes
1answer
649 views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
1
vote
0answers
302 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
0
votes
1answer
292 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
0
votes
1answer
86 views

Rule does not log X-Forwarded-For environment variable

The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far. Here's ...
4
votes
1answer
2k views

How do I use sqlmap to dump the OWASP Juice Shop schema?

I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've tried to be very specific in my sqlmap ...
1
vote
1answer
118 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
3answers
808 views

Setting up OWASP ZAP Authentication against 2 page forms authenication

My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
1
vote
1answer
214 views

What are the risks of publicly hosting OWASP Juice shop

For those who don't know it: The Juice shop is an intentionally vulnerable webshop which 'supports' SQL injection, XSS, DoS and all this kind of nasty stuff. It's nice to run on localhost and play a ...
2
votes
1answer
117 views

How to get user and verify password so that the usernames are kept private?

According to the OWASP guidelines: Authentication failure responses should not indicate which part of the authentication data was incorrect. For example, instead of "Invalid username" or "Invalid ...
3
votes
2answers
505 views

Is Blowfish validated against any standards?

OWASP ASVS 3.0 V7.7 states the following: Verify that cryptographic algorithms used by the application have been validated against FIPS 140-2 or an equivalent standard. Blowfish is not included in ...
2
votes
1answer
121 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
0
votes
1answer
286 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
1answer
151 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
1
vote
2answers
3k views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
3answers
3k views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
970 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
1answer
128 views

What parameters can be used to configure context-sensitive authorisation?

I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context. I don't consider ...
0
votes
2answers
331 views

How should I interpret, "access controls on the presentation layer are enforced on the server side?

This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9) I'm trying to deeply understand what it ...