Questions tagged [web]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Is two-stage logging in more secure?

I’m trying to find the correct forum for this question, so if not here, please suggest an alternative. I notice a number of web sites now log in users in two steps: one for the username/email address, ...
0
votes
1answer
34 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
1
vote
0answers
38 views

Clicking from one site to a logged in site. Does it reveal your original site identity?

Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc). Now let's say you ...
0
votes
0answers
24 views

Possibility of arbitrary file upload where upload converted to png

Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
0
votes
1answer
50 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
1answer
47 views

Benefits of same origin policy

I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
0answers
58 views

"Unknown" device signed into another location Gmail

I'm signed into my gmail account in my browser,and I've noticed that everytime I sign in, when I check the "Last account activity" section at the bottom of the page, I see another session ...
0
votes
3answers
120 views

Can I use some modified browser for gaining upper hand on a front-end?

Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser. An example is that I can't access stuff inside a JS module from the browser console. What if ...
0
votes
1answer
79 views

Logout functionality with JWT Session tokens

As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless. Suppose I ...
0
votes
0answers
57 views

How is web cache poisoning possible?

There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com: Reflected unkeyed headers: If the ...
0
votes
1answer
91 views

HTML Object Tag

In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
1
vote
2answers
205 views

Why do site operators block legal VPNs?

I use OpenWrt and by default all outgoing traffic is tunneled through Wireguard VPN endpoint (provider from the list of privacytools.io recommendations). Often I get an "Access Denied" or ...
-1
votes
1answer
66 views

XSS Inside the text part of an <a> tag [closed]

How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
0
votes
2answers
121 views

Is this potential XSS exploitable?

I am pentesting a website and I found that I can inject code at value="" <input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
1
vote
1answer
64 views

Is this HSTS HTTP Response Header Misconfigured?

I recently discovered during a penetration test that the HSTS was returned by the application but in this format: "Strict-TransportSecurity" Instead of: "Strict-Transport-Security" ...
0
votes
0answers
86 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
0
votes
3answers
76 views

Unclear security impact of a Reflected XSS vulnerability

What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
1answer
105 views

Spam mail leading to gibberish site

One of our users regularly receives spam mails containing a shortened link. I got curious, so I decided to investigate one of those links and it took me to a plain text website with gibberish, as if ...
1
vote
0answers
38 views

Webpack chunk loading mechanism and safety

I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript document.createElement("script") with script's src ...
0
votes
1answer
96 views

Google Chrome, the best bet for online privacy? [closed]

You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers. From his reporting, and my own logic, that the government ...
1
vote
0answers
106 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
2
votes
1answer
65 views

web app 3rd party JS dependency vulnerability management

As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
59 views

Storing Client Data for next page?

I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it. Is ...
0
votes
0answers
67 views

Can I skip "if" statement with chrome debugger or another javascript debugger?

I see this code in a bug bounty program The code: <!DOCTYPE html> <html> ... </html> <script> if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
0
votes
0answers
20 views

Will Internet provider know what sub-page I visited on a site? [duplicate]

Let's say in my address bar I see such link: Privatebin URL/key interception? Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
2
votes
2answers
183 views

How is a DNS wildcard a security issue for GitHub Pages?

GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so: GitHub must be set up to recognize that an ...
2
votes
1answer
130 views

Wayback machine downloading a file called default.exe?

When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe". Since I was expecting ...
5
votes
1answer
251 views

Web Assembly Security

I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets. What are some of the reasons why web assembly is ...
0
votes
0answers
56 views

Is it possible to know the keep-alive time supported by a web server?

I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
1
vote
0answers
42 views

Security implications of not verifying domain ownership on embeddable website tools like disqus [closed]

Context: Disqus and similar tools allow content creators to have an embedded "chat box" so that site visitors can comment on your content. I noticed recently that when I sign up I can claim ...
2
votes
1answer
70 views

CSRF payload delivery

If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
0answers
70 views

Reaching directly the origin server (through http) should be considered a vulnerability if the webapp use cloudfront?

SCENARIO: webapp X use clodufront distributions to serve its content. It's possible to contact directly the origin server and get the content with the following steps: modify /etc/hosts to add <...
1
vote
0answers
66 views

How to determine if a webshop is scam? [closed]

Nowadays people prefer to do their shopping online rather than using the real shop, especially because of the COVID-19 restrictions. But in the same context, attackers (scammers) are trying to gain ...
1
vote
1answer
73 views

Evaluate this approach: set production DNS to point to 127.0.0.1

I am evaluating a vendor whose technology takes the following approach: My website asks user to install vendor's executable (EXE) on their machine. This EXE does operations that cannot be done in-...
1
vote
0answers
53 views

Best practices for handling links in discussion posts

Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
0
votes
1answer
169 views

How can you find the PHP version a website is using using LFI?

If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
3
votes
2answers
247 views

Is it necessary to force a newly registered user to login?

In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the ...
1
vote
0answers
55 views

How do hackers gain access using malicious websites? [duplicate]

I read somewhere that entering a malicious website can infect your machine without you noticing it at all. When someone wants to infect other's computers he has to pass two challenges (as I see this). ...
1
vote
0answers
74 views

What are 7-character giberrish words regularly submitted to website forms? [closed]

I administer multiple websites operating in very different areas and they all consistently and regularly get submitted spam entries like below: Bkihvpv Ykuufwk some@email_address.com : or Aqmkylu ...
2
votes
1answer
118 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
0
votes
0answers
70 views

Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?

http://hunger.hu/webgl.html WARNING: only visit this website, it you don't mind crashing your PC! so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
0
votes
1answer
139 views

How to securely transfer cookies between two domains?

Let's say you have a website https://example.org which is being decommissioned and redirected to https://example.net. Your users have a cookie on https://example.org which contains some authentication ...
1
vote
0answers
34 views

Security Concerns with HTTP/3 / QUIC-based protocols [duplicate]

I've been seeing a large number of companies, including Cloudflare who just sent out a notice to their customers about enabling HTTP/3 via QUIC recently, touting HTTP/3 based on QUIC as 'much better' ...
0
votes
1answer
138 views

Redirection - Different Website from Different Computer

There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
0
votes
1answer
246 views

Making S3 objects viewable only for logged in users

As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
1
vote
0answers
154 views

What is meaning of setting port number to NULL in document.domain call?

Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
1answer
64 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
3
votes
3answers
413 views

How to make sure that no one is watching you through webcam?

I have heard that intelligence agencies and hackers can illicitly gain access to a computer's webcam and microphone and keep a close eye on people using suspicious programs or malware. Is there any ...
9
votes
1answer
833 views

Does HTTP/2 prevent security vulnerabilites like CRLF injection?

Which vulnerabilites does HTTP/2 prevent? More specifically: Does it prevent HTTP request smuggling? Does it prevent HTTP response splitting / CRLF injection?
0
votes
2answers
144 views

Can a Slow Post HTTP attack be done from a single client?

Can a Slow Post HTTP attack be done from a single client? The following source cites this line: https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c Ports are 16-bit numbers,...

1
2 3 4 5