Questions tagged [web]
The web tag has no usage guidance.
220
questions
0
votes
1
answer
60
views
Advice on how to organize web folders to prevent paths from being found out
In a private area of a website, I need to create a folder tree containing documents belonging to different clients.
The contents of these directories can only be accessed if you are logged in, but I ...
- 1
9
votes
2
answers
2k
views
Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?
I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail.
Today I cleared the browser data except for the autofill stuff.
Then I went to Stack Exchange to register an ...
- 107
0
votes
1
answer
54
views
Is a HTTP Request Smuggling a concern when using load balancers?
CVE-2022-22720 (Apache HTTP Server 2.4.52 vulnerability) mentions that the risk is with HTTP Request Smuggling.
My understanding of HTTP Request Smuggling is that a front server A transmits to a back ...
- 8,923
2
votes
1
answer
92
views
HTTP and HSTS Web Server
If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list?
I ...
- 23
0
votes
3
answers
127
views
Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?
The answers to Can a PDF file contain a virus? show that clearly it can!
Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
- 1,224
0
votes
0
answers
34
views
Saving sensitive data unencrypted
Problem
I am currently working on a web project which makes certain API requests with the user's data.
I am using the Moodle API (Moodle is a platform for school related stuff) and the WebUntis API (...
- 1
0
votes
0
answers
31
views
Penetration Testing of a Web Page instead of whole site
I am interested in testing a website's new feature which is available on a single a web page (addition in original website) and have some editable fields. Other than checking input validation on those ...
- 201
0
votes
0
answers
13
views
How to detect web account vulnerability [duplicate]
I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login.
...
- 101
0
votes
2
answers
105
views
Is it possible to send X-Forward-Host headers from client side?
I found a report on hackerone which is being awarded $200 for XSS via forwarded host header.
It is a reflected xss and I was wondering how an attacker can attack the victim?
Is there any way in ...
0
votes
1
answer
58
views
Can Firefox master password dialog be used for phishing my master password?
I have used master password to protect my login information in Firefox. Whenever I first start Firefox and open a page requiring authentication information Firefox asks my master password before ...
- 101
0
votes
1
answer
50
views
Can I prevent credential leakage from csrf or xss attack if I check both cookie and token?
Suppose the server can provide one cookie and one token. Then I set them when the user login. The cookie was set to httpOnly and the token will be saved in localStorage. Both of them will be sent back ...
- 101
0
votes
1
answer
50
views
What is the difference between Cross Origin Opener Policy and SOP?
"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents."
In a situation ...
- 3
0
votes
0
answers
35
views
No UAC appearing for newly installed applications
Recently I have noticed that my system doesn't show the UAC prompt whenever I install some application from another source, I have UAC on and everything is working fine, I also have an administrator ...
- 1
0
votes
1
answer
141
views
What's the purpose of 'instagram password cracker tools/hacker tools' websites? [closed]
There are over 9000 websites on the web claiming that they can hack Instagram accounts. In reality, none of them does what they say they do.
So, What's their purpose?
These website owners do know that ...
0
votes
2
answers
196
views
Is Link Obscurity as a Security Practice Bad?
I have heard that "Security by Obscurity" is bad. And I have always agreed with it.
But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
- 101
2
votes
0
answers
29
views
Is two-stage logging in more secure? [duplicate]
I’m trying to find the correct forum for this question, so if not here, please suggest an alternative.
I notice a number of web sites now log in users in two steps: one for the username/email address, ...
- 131
0
votes
1
answer
67
views
Benefit of asymmetric encryption vs trivial alternatives in compromised software?
Background information:
I have a client application that communicates with a server through a web API.
The data being communicated is not personally sensitive (no passwords, credit card details, ...
- 143
1
vote
0
answers
68
views
Clicking from one site to a logged in site. Does it reveal your original site identity?
Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc).
Now let's say you ...
- 111
0
votes
0
answers
52
views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
- 155
0
votes
1
answer
104
views
Origin header reflected in ACAO header with ACAC set to true on an API
While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
1
answer
86
views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
0
answers
529
views
"Unknown" device signed into another location Gmail
I'm signed into my gmail account in my browser,and I've noticed that everytime I sign in, when I check the "Last account activity" section at the bottom of the page, I see another session ...
0
votes
3
answers
148
views
Can I use some modified browser for gaining upper hand on a front-end?
Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser.
An example is that I can't access stuff inside a JS module from the browser console.
What if ...
- 23
0
votes
1
answer
188
views
Logout functionality with JWT Session tokens
As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless.
Suppose I ...
0
votes
0
answers
94
views
How is web cache poisoning possible?
There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com:
Reflected unkeyed headers:
If the ...
- 101
0
votes
1
answer
194
views
HTML Object Tag
In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
1
vote
2
answers
256
views
Why do site operators block legal VPNs?
I use OpenWrt and by default all outgoing traffic is tunneled through Wireguard VPN endpoint (provider from the list of privacytools.io recommendations).
Often I get an "Access Denied" or ...
- 1,413
-1
votes
1
answer
110
views
XSS Inside the text part of an <a> tag [closed]
How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
- 21
0
votes
2
answers
167
views
Is this potential XSS exploitable?
I am pentesting a website and I found that I can inject code at value=""
<input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
- 21
1
vote
1
answer
102
views
Is this HSTS HTTP Response Header Misconfigured?
I recently discovered during a penetration test that the HSTS was returned by the application but in this format:
"Strict-TransportSecurity"
Instead of:
"Strict-Transport-Security"
...
0
votes
0
answers
120
views
Web authentication, replay, nonce and KEK
I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server.
After a lot of reading it seems that a reasonable ...
0
votes
3
answers
110
views
Unclear security impact of a Reflected XSS vulnerability
What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
- 3
0
votes
1
answer
144
views
Spam mail leading to gibberish site
One of our users regularly receives spam mails containing a shortened link. I got curious, so I decided to investigate one of those links and it took me to a plain text website with gibberish, as if ...
- 173
1
vote
0
answers
71
views
Webpack chunk loading mechanism and safety
I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript
document.createElement("script") with script's src ...
- 111
0
votes
1
answer
130
views
Google Chrome, the best bet for online privacy? [closed]
You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers.
From his reporting, and my own logic, that the government ...
- 103
1
vote
0
answers
163
views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
- 421
2
votes
1
answer
102
views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
- 21
0
votes
1
answer
88
views
Storing Client Data for next page?
I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it.
Is ...
- 695
0
votes
0
answers
96
views
Can I skip "if" statement with chrome debugger or another javascript debugger?
I see this code in a bug bounty program
The code:
<!DOCTYPE html>
<html>
...
</html>
<script>
if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
- 73
0
votes
0
answers
22
views
Will Internet provider know what sub-page I visited on a site? [duplicate]
Let's say in my address bar I see such link:
Privatebin URL/key interception?
Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
- 245
2
votes
2
answers
244
views
How is a DNS wildcard a security issue for GitHub Pages?
GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so:
GitHub must be set up to recognize that an ...
- 8,923
1
vote
1
answer
182
views
Wayback machine downloading a file called default.exe?
When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe".
Since I was expecting ...
- 1,224
5
votes
1
answer
300
views
Web Assembly Security
I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets.
What are some of the reasons why web assembly is ...
- 153
1
vote
0
answers
68
views
Security implications of not verifying domain ownership on embeddable website tools like disqus [closed]
Context: Disqus and similar tools allow content creators to have an embedded "chat box" so that site visitors can comment on your content.
I noticed recently that when I sign up I can claim ...
- 111
2
votes
1
answer
97
views
CSRF payload delivery
If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
- 23
0
votes
0
answers
103
views
Reaching directly the origin server (through http) should be considered a vulnerability if the webapp use cloudfront?
SCENARIO:
webapp X use clodufront distributions to serve its content.
It's possible to contact directly the origin server and get the content with the following steps:
modify /etc/hosts to add <...
- 477
1
vote
0
answers
95
views
How to determine if a webshop is scam? [closed]
Nowadays people prefer to do their shopping online rather than using the real shop, especially because of the COVID-19 restrictions. But in the same context, attackers (scammers) are trying to gain ...
- 9,963
1
vote
1
answer
105
views
Evaluate this approach: set production DNS to point to 127.0.0.1
I am evaluating a vendor whose technology takes the following approach:
My website asks user to install vendor's executable (EXE) on their machine. This EXE does operations that cannot be done in-...
- 129
1
vote
0
answers
83
views
Best practices for handling links in discussion posts
Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
- 389
0
votes
1
answer
293
views
How can you find the PHP version a website is using using LFI?
If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
- 1