2022 Developer Survey is open! Take survey.

Questions tagged [web]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
60 views

Advice on how to organize web folders to prevent paths from being found out

In a private area of a website, I need to create a folder tree containing documents belonging to different clients. The contents of these directories can only be accessed if you are logged in, but I ...
user avatar
  • 1
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
user avatar
  • 107
0 votes
1 answer
54 views

Is a HTTP Request Smuggling a concern when using load balancers?

CVE-2022-22720 (Apache HTTP Server 2.4.52 vulnerability) mentions that the risk is with HTTP Request Smuggling. My understanding of HTTP Request Smuggling is that a front server A transmits to a back ...
user avatar
  • 8,923
2 votes
1 answer
92 views

HTTP and HSTS Web Server

If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list? I ...
user avatar
  • 23
0 votes
3 answers
127 views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
user avatar
  • 1,224
0 votes
0 answers
34 views

Saving sensitive data unencrypted

Problem I am currently working on a web project which makes certain API requests with the user's data. I am using the Moodle API (Moodle is a platform for school related stuff) and the WebUntis API (...
user avatar
  • 1
0 votes
0 answers
31 views

Penetration Testing of a Web Page instead of whole site

I am interested in testing a website's new feature which is available on a single a web page (addition in original website) and have some editable fields. Other than checking input validation on those ...
user avatar
  • 201
0 votes
0 answers
13 views

How to detect web account vulnerability [duplicate]

I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login. ...
user avatar
0 votes
2 answers
105 views

Is it possible to send X-Forward-Host headers from client side?

I found a report on hackerone which is being awarded $200 for XSS via forwarded host header. It is a reflected xss and I was wondering how an attacker can attack the victim? Is there any way in ...
user avatar
0 votes
1 answer
58 views

Can Firefox master password dialog be used for phishing my master password?

I have used master password to protect my login information in Firefox. Whenever I first start Firefox and open a page requiring authentication information Firefox asks my master password before ...
user avatar
  • 101
0 votes
1 answer
50 views

Can I prevent credential leakage from csrf or xss attack if I check both cookie and token?

Suppose the server can provide one cookie and one token. Then I set them when the user login. The cookie was set to httpOnly and the token will be saved in localStorage. Both of them will be sent back ...
user avatar
  • 101
0 votes
1 answer
50 views

What is the difference between Cross Origin Opener Policy and SOP?

"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents." In a situation ...
user avatar
  • 3
0 votes
0 answers
35 views

No UAC appearing for newly installed applications

Recently I have noticed that my system doesn't show the UAC prompt whenever I install some application from another source, I have UAC on and everything is working fine, I also have an administrator ...
user avatar
  • 1
0 votes
1 answer
141 views

What's the purpose of 'instagram password cracker tools/hacker tools' websites? [closed]

There are over 9000 websites on the web claiming that they can hack Instagram accounts. In reality, none of them does what they say they do. So, What's their purpose? These website owners do know that ...
user avatar
0 votes
2 answers
196 views

Is Link Obscurity as a Security Practice Bad?

I have heard that "Security by Obscurity" is bad. And I have always agreed with it. But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
user avatar
  • 101
2 votes
0 answers
29 views

Is two-stage logging in more secure? [duplicate]

I’m trying to find the correct forum for this question, so if not here, please suggest an alternative. I notice a number of web sites now log in users in two steps: one for the username/email address, ...
user avatar
  • 131
0 votes
1 answer
67 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
user avatar
  • 143
1 vote
0 answers
68 views

Clicking from one site to a logged in site. Does it reveal your original site identity?

Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc). Now let's say you ...
user avatar
  • 111
0 votes
0 answers
52 views

Possibility of arbitrary file upload where upload converted to png

Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
user avatar
  • 155
0 votes
1 answer
104 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
user avatar
0 votes
1 answer
86 views

Benefits of same origin policy

I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
user avatar
0 votes
0 answers
529 views

"Unknown" device signed into another location Gmail

I'm signed into my gmail account in my browser,and I've noticed that everytime I sign in, when I check the "Last account activity" section at the bottom of the page, I see another session ...
user avatar
0 votes
3 answers
148 views

Can I use some modified browser for gaining upper hand on a front-end?

Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser. An example is that I can't access stuff inside a JS module from the browser console. What if ...
user avatar
0 votes
1 answer
188 views

Logout functionality with JWT Session tokens

As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless. Suppose I ...
user avatar
0 votes
0 answers
94 views

How is web cache poisoning possible?

There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com: Reflected unkeyed headers: If the ...
user avatar
  • 101
0 votes
1 answer
194 views

HTML Object Tag

In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
user avatar
1 vote
2 answers
256 views

Why do site operators block legal VPNs?

I use OpenWrt and by default all outgoing traffic is tunneled through Wireguard VPN endpoint (provider from the list of privacytools.io recommendations). Often I get an "Access Denied" or ...
user avatar
  • 1,413
-1 votes
1 answer
110 views

XSS Inside the text part of an <a> tag [closed]

How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
user avatar
0 votes
2 answers
167 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
user avatar
  • 21
1 vote
1 answer
102 views

Is this HSTS HTTP Response Header Misconfigured?

I recently discovered during a penetration test that the HSTS was returned by the application but in this format: "Strict-TransportSecurity" Instead of: "Strict-Transport-Security" ...
user avatar
0 votes
0 answers
120 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
user avatar
0 votes
3 answers
110 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
user avatar
0 votes
1 answer
144 views

Spam mail leading to gibberish site

One of our users regularly receives spam mails containing a shortened link. I got curious, so I decided to investigate one of those links and it took me to a plain text website with gibberish, as if ...
user avatar
  • 173
1 vote
0 answers
71 views

Webpack chunk loading mechanism and safety

I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript document.createElement("script") with script's src ...
user avatar
  • 111
0 votes
1 answer
130 views

Google Chrome, the best bet for online privacy? [closed]

You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers. From his reporting, and my own logic, that the government ...
user avatar
  • 103
1 vote
0 answers
163 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
user avatar
  • 421
2 votes
1 answer
102 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
user avatar
0 votes
1 answer
88 views

Storing Client Data for next page?

I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it. Is ...
user avatar
  • 695
0 votes
0 answers
96 views

Can I skip "if" statement with chrome debugger or another javascript debugger?

I see this code in a bug bounty program The code: <!DOCTYPE html> <html> ... </html> <script> if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
user avatar
  • 73
0 votes
0 answers
22 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
user avatar
  • 245
2 votes
2 answers
244 views

How is a DNS wildcard a security issue for GitHub Pages?

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so: GitHub must be set up to recognize that an ...
user avatar
  • 8,923
1 vote
1 answer
182 views

Wayback machine downloading a file called default.exe?

When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe". Since I was expecting ...
user avatar
  • 1,224
5 votes
1 answer
300 views

Web Assembly Security

I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets. What are some of the reasons why web assembly is ...
user avatar
  • 153
1 vote
0 answers
68 views

Security implications of not verifying domain ownership on embeddable website tools like disqus [closed]

Context: Disqus and similar tools allow content creators to have an embedded "chat box" so that site visitors can comment on your content. I noticed recently that when I sign up I can claim ...
user avatar
  • 111
2 votes
1 answer
97 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
user avatar
0 votes
0 answers
103 views

Reaching directly the origin server (through http) should be considered a vulnerability if the webapp use cloudfront?

SCENARIO: webapp X use clodufront distributions to serve its content. It's possible to contact directly the origin server and get the content with the following steps: modify /etc/hosts to add <...
user avatar
  • 477
1 vote
0 answers
95 views

How to determine if a webshop is scam? [closed]

Nowadays people prefer to do their shopping online rather than using the real shop, especially because of the COVID-19 restrictions. But in the same context, attackers (scammers) are trying to gain ...
user avatar
  • 9,963
1 vote
1 answer
105 views

Evaluate this approach: set production DNS to point to 127.0.0.1

I am evaluating a vendor whose technology takes the following approach: My website asks user to install vendor's executable (EXE) on their machine. This EXE does operations that cannot be done in-...
user avatar
1 vote
0 answers
83 views

Best practices for handling links in discussion posts

Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
user avatar
  • 389
0 votes
1 answer
293 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
user avatar
  • 1

1
2 3 4 5