Questions tagged [web]
The web tag has no usage guidance.
142
questions
-1
votes
0answers
26 views
Difficulty understanding SOP and CSRF when using GET / POST [on hold]
Difficulty understanding SOP and CSRF
I'm UP-ing this question again because I did not receive a satisfactory answer (it's contradictory, he said that the owasp article is true, and yet said that SOP ...
0
votes
0answers
46 views
What are the most prominent attacks on web browsers and browser users one should know? [closed]
As a topic of inquiry, for those looking to gather insights into browser security, what do you consider as the most prominent attacks on browsers and the users of browsers, especially the ones that we ...
1
vote
1answer
67 views
Bypassing NET::ERR_CERT_DATE_INVALID
When I try to access the Openmailbox web site, Google Chrome returns a NET::ERR_CERT_DATE_INVALID error. The details state that "openmailbox.org normally uses encryption to protect your information. ...
1
vote
0answers
42 views
Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing
Someone requested my site's (Wordpress/Apache) 'includes' directory:
122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
Noticing the 200 response, I hit ...
1
vote
1answer
70 views
Is it possible to gain RCE from Arbitrary file write by an unprivileged user?
I am pentesting a PHP website running on Apache in a Ubuntu server.
I found a vulnerability that allows me to write files to the target system.
I know it's possible to write a php shell to the HTTP ...
1
vote
1answer
88 views
PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?
Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info.
This used to fall under the SAQ A ...
0
votes
1answer
29 views
How effective is Expect-CT against content inspection in an enterprise context?
HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
1
vote
1answer
83 views
Difficulty understanding SOP and CSRF
As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that
Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
-1
votes
1answer
130 views
How is this allowing me to bypass recaptcha [closed]
I was testing rate limit on the login page of a site. It was captcha protected. I could not even intercept the POST request on burp, so from Google Chrome I looked at the logs and in its POST request, ...
0
votes
0answers
42 views
What tools in SecurityOnion can be used for web application intrusion logfiles in csv format?
I have some web server logs from a breach. Is there a tool in SecurityOnion where I can upload the log files in csv format and have some sort of behavior-driven, static IDS/IPS identify when a breach ...
0
votes
0answers
61 views
How to make wfuzz perform a request to retrieve CSRF token to include in the main request?
How to make wfuzz perform a request to retrieve CSRF token to include in the main request?
I've previously used patator, which includes the options before_url and before_fgrep for performing a ...
4
votes
0answers
43 views
XXE OOB Large File Extraction
Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
2
votes
1answer
581 views
Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?
I am learning about file upload vulnerabilities using DVWA.
After cranking the website's security level to High,
the website checks both the post request's content type & file extension, so in ...
1
vote
1answer
45 views
How to secure embedded code containing REST api call
I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
1
vote
0answers
34 views
How to know what version of extensions are used in joomla-web-site from user's point of view?
The problem is: I'm a user and I'm to find out what version of extensions(modules, plugins and components) are used on Joomla-site.
In simple cases the version is already written,like here:
...
1
vote
2answers
106 views
Non SSL website with external SSL secured service
I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
0
votes
1answer
94 views
When should you give up on attempting a xss on part of a website? [closed]
I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
0
votes
0answers
52 views
Web Site Access - Port Whitelisting
I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
2answers
121 views
Identifying a script used for vulnerability scan
The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
0
votes
0answers
134 views
'=' 'OR' SQL Injection Login Bypass Question [duplicate]
I was testing SQLI Cheatsheets on a vulnerable test site.
This particular injection '=' 'OR' seems to work on the login page.
Why does that injection work? What's the back-end SQL code, if I could ...
0
votes
2answers
101 views
Cross Site Scripting href=/\evil
I've seen
<base href=/\evil>
and
<base href=//0>
as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
2
votes
1answer
320 views
Websocket Authentication at Opening Handshake Sufficient?
Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header.
Suppose the websocket ...
0
votes
1answer
77 views
Published URL File APP.CSS
I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. ...
0
votes
1answer
292 views
How is Instagram detecting me and blocking me each and every time I try to create a new account through different medium?
I have two Instagram accounts, one is mine (Account A) and the other (Account B) is for random images with my pets and a lot of other stuff.
Account B is private and has been from start, recently I ...
50
votes
5answers
11k views
What exploit are these user agents trying to use?
I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
3answers
136 views
Best practices to prevent logging of LDAP credentials by intermediate apps
I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use.
We also have some internal web-based tools that interface ...
1
vote
0answers
173 views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
0
votes
1answer
39 views
CSRF protection for an email subscription website - are there any risks of having it turned off?
I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
1
vote
0answers
65 views
How to determine if a website has been hijacked?
I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL.
I was surprised by this change, ...
0
votes
0answers
25 views
Does limiting the length of a password help prevent DoS attacks? [duplicate]
I was told that you can DoS a server with unlimited password length because of the time that it would take to hash it. But isn't the password hashed on the client's side before leaving the user's ...
-1
votes
1answer
62 views
what are steps to do in order to secure my appli web [closed]
I'm asked to secure an appli web and I don't know really which steps I can follow to secure my appli web.
0
votes
0answers
37 views
Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be.
Is it ...
2
votes
2answers
107 views
Is it ok to send plain text credentials in a XHR GET request?
When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
0
votes
0answers
39 views
How do I verify that a user on a remote system has root access?
Let's say an anonymous user somewhere on the internet claims that he or she is the admin/root user of the system/server behind some public IP Address.
I was thinking, what can a root user do that a ...
0
votes
2answers
85 views
How to detect website active routes?
I'm building a website using Laravel and I'm just thinking about security.
I would like to know if there is a way for attacker to detect all active web routes for a website ?
For example:
http://...
1
vote
1answer
275 views
What scenario does CORS protect against?
My understanding of the same origin policy is that it prevents scripts from making requests to resources outside of the domain from which they originated. One motivation of this is to prevent a ...
1
vote
1answer
100 views
What kind of redirect of websites is this? [closed]
Some websites can redirect you, but they're not using http 301 or 302. After that the url will be changed and you can't go back to the previous page using your web browser's back button. For example, ...
1
vote
1answer
456 views
Securing Flask admin pages
We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities.
The ...
-1
votes
1answer
3k views
Does an employer see if you try to access a blocked site? [duplicate]
Today while browsing on my mobile phone connected to my employer's wifi, I clicked on the link to a tumblr page. I then got an error message saying the web filter had blocked the page deeming it ...
1
vote
0answers
263 views
How to find no of columns using sql injection
I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error:
OraOLEDB error '80004005'
ORA-01756: quoted ...
1
vote
0answers
92 views
Webauthn and TLS channel binding
my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook?
TLS channel ...
0
votes
2answers
603 views
Is telegram SMS login secure?
TL;DR: Can
1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or
2) A "telegram ...
57
votes
1answer
4k views
Does a client certificate identify the owner to unrelated websites?
If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it?
I once visited an ssl diagnostic site that immediately ...
1
vote
1answer
32 views
Liquid security scenario
I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
0
votes
1answer
40 views
Why did a subdomain from a trusted website download a file?
I clicked on a link for the subdomain of a trusted website (the subdomain slackin.brilliant.org of the website brilliant.org), and instead of being directed to another page, a file called "download" ...
2
votes
1answer
264 views
Why does my Chrome still trust Thawte certificate?
Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
4
votes
2answers
209 views
Telegram (or other messenger) message as second factor in 2FA
Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
1
vote
1answer
57 views
Real life scenario for remote file execution
This is a commonly demonstrated attack because it is easy to explain and understand.
The premise is that the victim does something like (oversimplified PHP example):
include( $_GET['file']);
And ...
0
votes
1answer
55 views
Remotely included script cannot set session variables
I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging ...
4
votes
3answers
1k views
Is hijacking a webcam after visiting a website a plausible threat?
(I made a throwaway to ask this question, since this situation is pretty embarrassing)
Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless ...
