Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [owasp]

For question about OWASP products or the practices of the organization. Do not use just because the vulnerability you are asking about is included on the OWASP Top Ten list.

Filter by
Sorted by
Tagged with
2 votes
0 answers
32 views

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...
user avatar
  • 121
1 vote
1 answer
46 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
user avatar
0 votes
0 answers
121 views

Azure WAF support for OData

I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF? 1. ...
user avatar
0 votes
1 answer
293 views

ModSecurity rule 941160 triggered by WordPress legacy-widget-preview

We have an issue with ModSecurity rule 941160 being triggered by the WordPress feature legacy-widget-preview because the request to upload an image file into the widget matches "<img src="...
user avatar
  • 13
0 votes
1 answer
173 views

CORS without Access-Control-Allow-Credentials [duplicate]

I'm testing a web application and burp detected this issue: Cross-origin resource sharing: arbitrary origin trusted Looking at the response, I only see this header: Access-Control-Allow-Origin: https:/...
user avatar
  • 107
1 vote
1 answer
117 views

Fuzzing in OWASP ZAP through the command line

First of all, I'm running ZAP in a Docker container and will automate ZAP scans using Jenkins. The official docker image seems to have a script that performs spidering and active scans but does not do ...
user avatar
  • 11
0 votes
2 answers
664 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
user avatar
  • 171
0 votes
1 answer
406 views

ModSecurity OWASP CRS 3.3.0 false positives on a Wordpress site

The following search queries are blocked by ModSecurity and returns a 403 forbidden error: www.example.com/s=zip+someword & www.example.com/s=gzip+someword but not www.example.com/s=zip & www....
user avatar
0 votes
1 answer
183 views

XSS Payloads: <script> vs javascript:

Hello I was experimenting with XSS payloads and couldn't help wonder the syntax for javascript:alert(0) The most basic payload for XSS makes sense, since the tag is used for JavaScript in HTML. <...
user avatar
2 votes
1 answer
261 views

How to interpret "Verify the use of a secure software development lifecycle that addresses security in all stages of development"?

I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail. I am not sure what exactly the author of a ...
user avatar
  • 23
0 votes
0 answers
211 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
user avatar
  • 101
2 votes
0 answers
185 views

Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?

I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
user avatar
2 votes
1 answer
443 views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
user avatar
  • 217
1 vote
0 answers
186 views

Decoding burp XSS DNS resolution payload

I'm testing burp against a vulnerable application as part of work for my client. There was one successful xss payload related to DNS lookup which worked on form data at point of file-upload. Here is ...
user avatar
3 votes
2 answers
306 views

Is using PBKDF2 good protection against brute-force attacks on web application login pages?

We've recently had a penetration test for one of our applications. The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page. Ref: ...
user avatar
1 vote
0 answers
575 views

What's the latest thinking on website session expiry time? [closed]

Websites that persist any user-specific state (either a login capability or, say, a basket & checkout purchasing system) tend to have a deliberately expiring session that lasts a few minutes or ...
user avatar
0 votes
1 answer
144 views

Client-side password strength policy verification. CVSS3.1? OWASP WSTG?

Using the OWASP testing guide, if password strength policy verification is implemented only client-side, can that be considered a vulnerability? In which category? Also which CVSS it should have?
user avatar
  • 477
1 vote
0 answers
108 views

OWASP ZAP bruteforce 3 parameters Request from 3 payloads (parallel)

How I can fuzz a request with 3 parameters (locations) and 3 payloads: request1 => parameter1=payload1.1; parameter2=payload2.1; parameter3=payload3.1; request2 => ...
user avatar
3 votes
1 answer
482 views

MSTG-ARCH-7: All security controls have a centralized implementation

In the OWASP Mobile Application Security Checklist there is a requirement MSTG-ARCH-7 which reads: "All security controls have a centralized implementation". Now I'm struggling a bit by what ...
user avatar
1 vote
0 answers
109 views

Prevent XXE attack by preprocessing XML

I have an old project which parses XML files coming from an external origin, so it is at least in principle vulnerable to XXE. It is difficult to update the project to use newer versions of XML ...
user avatar
  • 149
0 votes
0 answers
251 views

Is `SecAction` order important for an OWASP ModSecurity config file?

Using a web server with Nginx + ModSecurity + OWASP ModSecurity Core Rules... On the OWASP config file crs-setup.conf is the order of the config section SecAction important or can i order them ...
user avatar
  • 101
2 votes
2 answers
3k views

Qualys WAS raises "150004 Path-Based Vulnerability" on an image file

Customer is running Qualys Web Application Scan and the WAS Scan Report reported: 150004 Path-Based Vulnerability on URL: https://www.example.com/mywebapp/Content/datepicker/images/ui-...
user avatar
1 vote
1 answer
546 views

OWASP CRS Anomaly scoring,, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines : setvar:'tx....
user avatar
  • 11
0 votes
1 answer
884 views

How to Create file name with Slash in it for Path traversal attack?

Yes I've read forums that says Forward Slash (/) is invalid character in a file name since it being File Separator in Windows and *nix based machines. But Without creating such an exploit file, I ...
user avatar
5 votes
3 answers
273 views

Is non-executed content still considered XSS?

I'm working through an OWASP Zap report that has flagged several URLs on the domain as being vulnerable to XSS, but the vulnerability is never output in a context that is executable by the browser. ...
user avatar
  • 151
-1 votes
1 answer
81 views

owasp zap api with generate param [closed]

my api is: localhost/api/aut/1111111111111111 I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
user avatar
0 votes
1 answer
179 views

What is the best way for OWASP Zap to handle Unique Fields and API Sequences?

First Situation: I proxy through some requests to zap and want to perform an active scan on them. Zap active scan is working on one property at a time, and this particular request requires some of the ...
user avatar
0 votes
2 answers
828 views

OWASP ZAP API HTTP Sessions setup

I'm trying to create a script using the Node ZAP SDK. The script needs to perform an active scan of the site on localhost while signed in as a super admin; if no user is signed in, it can only reach ...
user avatar
  • 113
0 votes
0 answers
92 views

Preventing automated attacks on Tokens without relying on Firewall or Network Infrastructure

Our concern is more on application side prevention automated attacks. Although the firewall does it part to help prevent this, it has been mandated in our development team's security practices that we ...
user avatar
1 vote
2 answers
1k views

What is the best way to get OWASP ZAP to fuzz parameters with real data?

I'm trying to import and scan Open API Definitions and it seems to me that the url parameters and request body are not being replaced with real data. Is there a way for OWASP ZAP to automatically ...
user avatar
0 votes
1 answer
1k views

Stop an in-progress passive scan in OWASP ZAP 2.9

I would like to know if anyone knows how to stop or speed-up an in-progress ZAP passive scan on version 2.9. I have a 64000+ passive scan queue and it is not draining fast at all. I have disabled all ...
user avatar
0 votes
3 answers
142 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
user avatar
44 votes
8 answers
9k views

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

I'm developing an application over an intranet and is used only by an internal employee. There wouldn't be any external parties involved here and no external communication would be used by the ...
user avatar
  • 541
3 votes
2 answers
231 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
user avatar
0 votes
1 answer
557 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
user avatar
0 votes
0 answers
372 views

Unable to connect to internet after setting up ZAP configuration on Android using a hotspot connection

I am trying to configure ZAP on an Android device using a hotspot connection opened on another Android device. I followed the setup instructions available here: https://security.secure.force.com/...
user avatar
  • 101
1 vote
1 answer
274 views

Modsecurity - OWASP CRS 901001

Ubuntu 18.04 Apache/2.4.29 ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0 modsecurity-crs 3.0.2-1 This is a new server. The following message appears in modsec_audit.log ...
user avatar
2 votes
0 answers
215 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
user avatar
  • 21
0 votes
0 answers
105 views

Returning Social Security Number After Validation Checks on Web Based Form

I have a web based application form that is used to gather personal information for web based users. One of the fields is an SSN. My question is simple, in terms of security compliance (in general, ...
user avatar
  • 1,309
2 votes
1 answer
549 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
user avatar
8 votes
1 answer
743 views

Some doubts about SQL Injection examples, how exactly works?

I am a software developer starting studying application security and I have the following doubt related SQL injection. I am following a video course and there are these two examples: I have an ...
user avatar
1 vote
1 answer
69 views

Good Security API package for Java [closed]

Is there a good security API (all in one) for Java to prevent things like SQL injections, Cross site scripting and those owasp top 10 vulnerabilities?
user avatar
7 votes
3 answers
1k views

Usefulness of token sidejacking prevention mentioned by OWASP JWT Cheat Sheet

I was just reading through the "Token sidejacking" of the JWT Cheat Sheet of OWASP (https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html#token-sidejacking) At the ...
user avatar
  • 71
0 votes
1 answer
811 views

Use OWASP ZAP import URLs addon programatically and change the HTTP method

I was thinking of using this functionality in my script, but it seems that importing URL file automatically sets GET method for every URL on the list, so when Active Scan is run, it only performs GET ...
user avatar
-1 votes
1 answer
401 views

What is "Map Execution Paths Through Application"?

I am reading the OWASP Test Guide v4 to learn how to pentest a web application. In the documentation, there is a section called "Map execution paths through application (OTG-INFO-007)". I'm not sure ...
user avatar
0 votes
0 answers
81 views

Pre-flight request is triggering in Chrome but not in IE

I am testing an app for CSRF vulnerability and i observed that when i generate a Cross-domain XHR POC with burp and try to exploit, a pre-flight request is getting triggered but this is is not ...
user avatar
  • 33
3 votes
1 answer
1k views

Certificate Pinning for WebSockets

I have seen many implementations of certificate pinning for HTTPS connections originated from client-side apps running on mobile devices using native libraries and plugins. I would like to know ...
user avatar
2 votes
0 answers
511 views

Does OWASP recommend to include a CSRF-token in a header or to use it as a parameter (in a State-scenario)?

The CSRF Cheat Sheet by OWASP, concerning (Anti-)CSRF-tokens is quite confusing. For a State(ful)-scenario (the Synchronizer Token Pattern), they write: ... for AJAX calls it is recommended to add ...
user avatar
  • 133
0 votes
1 answer
614 views

Unable to proxy Webgoat localhost requests in spite of doing the necessary configurations

I am new to Webgoat and followed all the steps required to configure Firefox and Webgoat. 1 Setup Local proxies in webgoat to run on localhost 8090 2 Exported the certificate and imported it in ...
user avatar
0 votes
1 answer
192 views

Rule does not log X-Forwarded-For environment variable

The Apache web server is logging X-Forwarded-For environment variable as expected, but I have an Owasp rule where I'm trying to log this environment variable value too but without luck so far. Here's ...
user avatar