Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [owasp]

For question about OWASP products or the practices of the organization. Do not use just because the vulnerability you are asking about is included on the OWASP Top Ten list.

2
votes
1answer
70 views

Concerning The OWASP Security Guidelines As They Apply To Site Registration / Could honeypotting work?

I'm tossing an idea around in my mind. I want to bounce it off the community to see if this holds any water. First - the OWASP guidelines never specify any method of action when you're dealing with ...
0
votes
0answers
35 views

Should Session-Timeout events be logged

I am working on Audit logs for an ERP project and searching for all kind of events to be logged. In this project, session, timeouts on inactivity. I was wondering if logout by session-timeout should ...
0
votes
1answer
28 views

Adding a static token to ZAP vulnerability scanner

I am currently trying to get the OWASP ZAP scanners working on a peculiar website. When authenticated on this website, each GET request needs a "token" (most likely a anti-CSRF token) as a parameter. ...
2
votes
2answers
640 views

What are the common features to identify XSS attack from Apache log file?

I have tried some XSS vulnerability on web application such as webgoat, OWASP mutillidae, bWAPP. I want to know the features/keywords/footprints of cross site scripting attack in apache log file and ...
1
vote
0answers
128 views

Custom payload SQLMap from OWASP Zap vulnerability report

I ran OWASP Zap over my site. In the vulnerability report I read that there is an SQL injection problem: Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment) (see img for ...
0
votes
3answers
335 views

Injecting <script>alert(“1”)</script> to OWASP Juice shop doesn't work

I've just learned the theory behind XSS attacks and now I would like to test my knowledge in a legal way. I wanted to "hack" OWASP Juice shop by following steps from this book section "Perform a ...
0
votes
1answer
170 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
1answer
51 views

What parameters can be used to configure context-sensitive authorisation?

I recognise that context-sensitive authorisation to applications is a good security control however I can currently only think of location being an example of a sensitive context. I don't consider ...
0
votes
2answers
52 views

How should I interpret, "access controls on the presentation layer are enforced on the server side?

This question is with reference to the OWASP standard (Access control rules on the presentation layer are enforced on the server side - OWASP ASVS 3.0 - 4.9) I'm trying to deeply understand what it ...
1
vote
1answer
299 views

Sanitizing JSON deserialization

I'm currently investigating best practices for secure JSON deserialization of untrusted input for object mapping. After researching, it seems like... the default jackson mapper: https://...
2
votes
0answers
98 views

OWASP Testing Guide Equivalent for Desktop Applications [closed]

I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications? I had no luck searching the Internet. I am looking for something ...
-1
votes
1answer
87 views

fuzzing xss mutillidae with OWASP ZAP

I am playing with XSS fuzzing and find the zap proxy very good, since I am able to utilize the fuzz option. I don´t have burp pro, so I can´t import lists into repeater. My problem is that, I´m able ...
0
votes
2answers
42 views

/cron path found when testing site

I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
1
vote
1answer
69 views

Can someone highlight the key difference between CRLF Injection, HTTP Response Splitting and HTTP Header Injection?

I believe each one of these is closely interlinked, for instance, HTTP Response Splitting will occur in event of CRLF characters injection (%0d%0a) and this will also involve injection of HTTP headers ...
3
votes
1answer
416 views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
1answer
72 views

Lost my custom data files for OWASP ZAP (Forced Browse) - where do I find the data in ZAP?

The tool used to be called dirbuster. I imported my own lists then lost the source files. I can't export the wordlists from ZAP. How can I find the data in ZAP so that I can recreate the source files?
1
vote
0answers
59 views

OWASP scan on SQL Server Compact Edition

On running a dependency check on my projects library, the tool reported multiple vulnerabilities in System.Data.SqlServerCe.dll, and CVE-2012-1856 with the highest score of 9.3 The version of the ...
1
vote
1answer
141 views

Origin Header Vs Token based mitigation

OWASP CSRF Prevention cheatsheet talks about two popular mitigations for CSRF - Origin/Referrer header check and Token based. Are there any issues Origin/referrer check based mitigation that could ...
0
votes
1answer
578 views

What is the risk of private IP address disclosure if it is the user IP?

I am checking a web application with OWASP Zed Attack Proxy (ZAP). There is a vulnerability (low) that says "private IP address disclosure" and when I check for more details I found that it is my IP,...
0
votes
1answer
285 views

How to redirect any response to an arbitrary location in OWASP ZAP's request editor?

I am trying to find stored XSS in an application. Luckily, the application allows me to insert and edit the description of myself that is displayed to anyone visiting my profile. The location where ...
1
vote
1answer
398 views

Authenticating With OWASP ZAP Script

I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can ...
1
vote
0answers
560 views

Insecure Deserialization in C# (.NET) - How to identify and test

I have been reading up on Insecure Deserialization and how it can affect Java applications. https://owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization If the captured traffic data include ...
0
votes
1answer
288 views

Understanding OWASP 2017 A8 Insecure Deserialization

I'm reading up on Insecure Deserialization and remembered a vulnerability that I read about in some JSON Web Token (JWT) implementations at auth0. https://owasp.org/index.php/Top_10-2017_A8-...
0
votes
0answers
274 views

XSS Filter Input validation failure potential vulnerability?

I was testing an XSS filter of a java-based web server. Most everything was escaped, but when I typed \\" (backslash backslash double quote), the system threw an error, "Input validation failure". ...
1
vote
3answers
293 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
1
vote
1answer
115 views

Why isn't XXE part of Injection in the OWASP Top 10?

I'm trying to explain to myself why XXE doesn't fall under the Injection category, as it is a form of XML injection. XML External Entity is an attack that manipulates the XML parser/interpreter, to ...
0
votes
0answers
69 views

Shouldn't I follow the OWASP DOM based XSS recommendations no matter where the payload is injected?

I heard/read at various contexts that DOM based XSS is caused by untrusted client side input and developers need to follow instructions at the OWASP "DOM based XSS Prevention Cheat Sheet" in order to ...
0
votes
1answer
1k views

Fuzzing with Owasp-Zap

I am doing web application testing and mostly performing injections into fields etc. Instead of having to do these manually in each form field how do I go about making this automated against all form ...
1
vote
3answers
121 views

nikto's results differ from other vulnerability scanners , is it more or less accurate?

I was doing some scanning on a web application, I used OWASP zap and Nessus. The risks that these two detected were medium to low, very few vulnerabilities. Then I tried nikto, and the results were ...
0
votes
0answers
206 views

How can I scan WebGoat7.1 with OWASP ZAP

I'm trying to make a presentation on how to scan a website using OWASP ZAP 2.7.0 and I'm trying to use WebGoat7.1 as a target for this purpose. I would like to first use the AJAX scanner to discover ...
1
vote
1answer
638 views

Does the OWASP Zed Attack Proxy project have a list of all the vulnerabilities it tries to find/exploit?

I'm trying to compile a list of vulnerabilities that ZAP tries to find when you run the "Active Scan" in ATTACK mode on a webapp. Does this list exist in the documentation anywhere? If it also has a ...
1
vote
2answers
93 views

After a full web vulnerability scan, do we need to test each & every similar field for possible injections?

I ran a zap scan for my project and found some medium & low level vulnerabilities. But going through some posts, I found that we should run injections (sql, xss, command) on text fields also. But ...
2
votes
1answer
1k views

OWASP ZAP teaching spider to use custom header

I need some help with setting up OWASP ZAP to correctly crawl my One-page Angular website with the spider. I successfully set up a zscript which will handle the login and add a HTTP Session I can set ...
5
votes
1answer
170 views

Malicious NPM Package - Does it fit into OWASP Top Ten 2017?

On various security forums I have seen links to a post about a fictive malicious NPM package harvesting information. The posts title: I’m harvesting credit card numbers and passwords from your site....
41
votes
4answers
6k views

Is the OWASP recommendation regarding localstorage still valid?

I am currently working on an Application which is a single page application built with Angular. It is served over HTTPS, using HSTS. For authentication, we are using Auth0. The Auth0 documentation ...
1
vote
1answer
649 views

Not able to get response via OWASP ZAP

I have performed the below steps to capture request/response in ZAP :- Generate the dynamic certificate in ZAP. Add the Certificate to the browser (FireFox). Set the local Proxy to 127.0.0.1 and ...
1
vote
0answers
201 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
3
votes
1answer
198 views

How does OWASP rank the top 10 risks?

I was reading articles about OWASP A2 (2017) and the found below comparison chart. One thing I noticed was that "Broken Account and Session Management" has changed place over the years: In 2003 and ...
1
vote
0answers
63 views

Mobile internet not working via zap proxy [duplicate]

I have to test the native android application on device, so I Installed the zap certificated on my device and set the proxy in my device to my system ip where zap is installed and port to 8085. In ...
5
votes
2answers
3k views

Is OWASP ESAPI still the recommended way to secure JSP pages

I noticed OWASP ESAPI hasn't been updated in a while (minor update in 2016, and before 2013). Are there better alternatives to using it i.e. using a more maintained framework's utilities for say ...
2
votes
2answers
373 views

How to start OWASP Shepherd using Docker? [closed]

I have pulled the Security Shepherd Docker image and followed all the instructions for the Docker setup. I believe all steps were successful. Now I don't know how to run the Shepherd application, ...
0
votes
0answers
2k views

How to run OWASP ZAP automatically using command line operations (i.e. Jenkins)

I am trying to run OWASP ZAP automatically using command line opoerations. I have tried using the APi as described here, but I am getting these errors. I have also tried with zapr, but it's also ...
0
votes
1answer
156 views

External network pentest and Application pentest. The same?

I'm trying to create a pentesting process to test the network and applications of a company. I'm using for this the OWASP Testing Guide 4.0, because i do not have experience about pentesting and I do ...
1
vote
3answers
654 views

Owasp Zap's active scan harming the database

I want to integrate OWASP Zap security tests in my continuous integration chain using the official Jenkins plugin. However, since it injects harmful payloads in database, I don't want the database to ...
-1
votes
1answer
146 views

sql injection attack or vulnerability? Where can i find list of web application vulnerabilities and attack types ? [closed]

I can't separate OWASP Top-10 security risks, Sql Injection is attack or vulnerability ? If Sql injection is web application attack type(and other owasp security risks), then where can i find ...
1
vote
1answer
34 views

MASVS 1.12: “Endpoints verify that clients use up-to-date version”

In the current OWASP MASVS (as of now v0.9.3) we can find the following requirement for MASVS-L2 in Security Verification Requirements: MASVS 1.12: "Remote endpoints verify that connecting ...
4
votes
1answer
264 views

Is a non-authenticated CSRF still a CSRF?

OWASP defines Cross-Site Request Forgery (CSRF) as an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. (emphasis mine) ...
3
votes
2answers
3k views

How is Insufficient Attack Protection a Definite Threat/Risk to an Organization?

Recently, OWASP introduced two new set of categories as of 2017, April - to it's OWASP Top 10: Insufficient Attack Protection Unprotected APIs I understand, Unprotected APIs does have an immediate ...
1
vote
2answers
961 views

How to get CSRF token on authorization request with OWASP ZAP in bruteforce mode

I am a new in OWASP ZAP, so I need your help. I have vulnerability site - DVWA. I am trying to work on token (CSRF) in bruteforce. When page load I have HTML form with login, password and user-token....
8
votes
2answers
892 views

Why does OWASP suggest using POST over PUT for file uploads?

When browsing the OWASP security recommandations for file uploads, I ticked reading the following : Try to use POST method instead of PUT (or GET!) I don't see how one method is better than ...