Questions tagged [web]
The web tag has no usage guidance.
207
questions
0
votes
0answers
14 views
Is two-stage logging in more secure?
I’m trying to find the correct forum for this question, so if not here, please suggest an alternative.
I notice a number of web sites now log in users in two steps: one for the username/email address, ...
0
votes
1answer
34 views
Benefit of asymmetric encryption vs trivial alternatives in compromised software?
Background information:
I have a client application that communicates with a server through a web API.
The data being communicated is not personally sensitive (no passwords, credit card details, ...
1
vote
0answers
38 views
Clicking from one site to a logged in site. Does it reveal your original site identity?
Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc).
Now let's say you ...
0
votes
0answers
24 views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
0
votes
1answer
50 views
Origin header reflected in ACAO header with ACAC set to true on an API
While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
1answer
47 views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
0answers
58 views
"Unknown" device signed into another location Gmail
I'm signed into my gmail account in my browser,and I've noticed that everytime I sign in, when I check the "Last account activity" section at the bottom of the page, I see another session ...
0
votes
3answers
120 views
Can I use some modified browser for gaining upper hand on a front-end?
Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser.
An example is that I can't access stuff inside a JS module from the browser console.
What if ...
0
votes
1answer
79 views
Logout functionality with JWT Session tokens
As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless.
Suppose I ...
0
votes
0answers
57 views
How is web cache poisoning possible?
There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com:
Reflected unkeyed headers:
If the ...
0
votes
1answer
91 views
HTML Object Tag
In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
1
vote
2answers
205 views
Why do site operators block legal VPNs?
I use OpenWrt and by default all outgoing traffic is tunneled through Wireguard VPN endpoint (provider from the list of privacytools.io recommendations).
Often I get an "Access Denied" or ...
-1
votes
1answer
66 views
XSS Inside the text part of an <a> tag [closed]
How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
0
votes
2answers
121 views
Is this potential XSS exploitable?
I am pentesting a website and I found that I can inject code at value=""
<input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
1
vote
1answer
64 views
Is this HSTS HTTP Response Header Misconfigured?
I recently discovered during a penetration test that the HSTS was returned by the application but in this format:
"Strict-TransportSecurity"
Instead of:
"Strict-Transport-Security"
...
0
votes
0answers
86 views
Web authentication, replay, nonce and KEK
I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server.
After a lot of reading it seems that a reasonable ...
0
votes
3answers
76 views
Unclear security impact of a Reflected XSS vulnerability
What is the security impact of a Reflected XSS vulnerability on a state website involved in financial relations? There are no user profiles on this page and it serves as an information board and a ...
0
votes
1answer
105 views
Spam mail leading to gibberish site
One of our users regularly receives spam mails containing a shortened link. I got curious, so I decided to investigate one of those links and it took me to a plain text website with gibberish, as if ...
1
vote
0answers
38 views
Webpack chunk loading mechanism and safety
I am trying to understand the mechanics of webpack's chunk loading. From what I understand, chunks are appended to DOM via javascript
document.createElement("script") with script's src ...
0
votes
1answer
96 views
Google Chrome, the best bet for online privacy? [closed]
You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers.
From his reporting, and my own logic, that the government ...
1
vote
0answers
106 views
API keys or Client Credentials flow? Good practice to control application access to a deployed web component
Company A developed a widget (Web Component) deployed on several clients/partners.
Only clients/partners must be authorized to use the widget.
No need to distinguish between each end users (clients' ...
2
votes
1answer
65 views
web app 3rd party JS dependency vulnerability management
As a security engineer, I wonder about the common approach for web app 3rd party JS dependency vulnerability management. We have a lot of apps depend on Jquery etc. In a regular vulnerability scan, ...
0
votes
1answer
59 views
Storing Client Data for next page?
I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it.
Is ...
0
votes
0answers
67 views
Can I skip "if" statement with chrome debugger or another javascript debugger?
I see this code in a bug bounty program
The code:
<!DOCTYPE html>
<html>
...
</html>
<script>
if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...
0
votes
0answers
20 views
Will Internet provider know what sub-page I visited on a site? [duplicate]
Let's say in my address bar I see such link:
Privatebin URL/key interception?
Can somebody besides server and me know that I'm visiting not just security.stackexchangec.com but excactly ../questions/...
2
votes
2answers
183 views
How is a DNS wildcard a security issue for GitHub Pages?
GitHub Pages allows to set up a public page under <user>.github.io that can optionally be customized with a personal domain. In order to do so:
GitHub must be set up to recognize that an ...
2
votes
1answer
130 views
Wayback machine downloading a file called default.exe?
When I look up a site on wayback machine, I click through a couple of links on the site, and then instead of loading the page, it downloads a file called "default.exe".
Since I was expecting ...
5
votes
1answer
251 views
Web Assembly Security
I'm excited about the prospects of web-assembly for the future, but I'm curious if this will have the same security ramifications of Java Applets.
What are some of the reasons why web assembly is ...
0
votes
0answers
56 views
Is it possible to know the keep-alive time supported by a web server?
I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
1
vote
0answers
42 views
Security implications of not verifying domain ownership on embeddable website tools like disqus [closed]
Context: Disqus and similar tools allow content creators to have an embedded "chat box" so that site visitors can comment on your content.
I noticed recently that when I sign up I can claim ...
2
votes
1answer
70 views
CSRF payload delivery
If an attacker successfully delivers a CSRF payload by any means, what response can he can see once a victim clicks the link?
0
votes
0answers
70 views
Reaching directly the origin server (through http) should be considered a vulnerability if the webapp use cloudfront?
SCENARIO:
webapp X use clodufront distributions to serve its content.
It's possible to contact directly the origin server and get the content with the following steps:
modify /etc/hosts to add <...
1
vote
0answers
66 views
How to determine if a webshop is scam? [closed]
Nowadays people prefer to do their shopping online rather than using the real shop, especially because of the COVID-19 restrictions. But in the same context, attackers (scammers) are trying to gain ...
1
vote
1answer
73 views
Evaluate this approach: set production DNS to point to 127.0.0.1
I am evaluating a vendor whose technology takes the following approach:
My website asks user to install vendor's executable (EXE) on their machine. This EXE does operations that cannot be done in-...
1
vote
0answers
53 views
Best practices for handling links in discussion posts
Let's say I have a site like stack overflow. People post comments with - possibly - links to external sites. Is there some "standard" set of rules to make it reasonably safe for users and ...
0
votes
1answer
169 views
How can you find the PHP version a website is using using LFI?
If a website is vulnerable to Local File Inclusion (LFI), how can you use it to find out the PHP version? Is there any file which says the version of PHP being used. I'm trying to do a PHP sessions ...
3
votes
2answers
247 views
Is it necessary to force a newly registered user to login?
In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the ...
1
vote
0answers
55 views
How do hackers gain access using malicious websites? [duplicate]
I read somewhere that entering a malicious website can infect your machine without you noticing it at all. When someone wants to infect other's computers he has to pass two challenges (as I see this).
...
1
vote
0answers
74 views
What are 7-character giberrish words regularly submitted to website forms? [closed]
I administer multiple websites operating in very different areas and they all consistently and regularly get submitted spam entries like below:
Bkihvpv
Ykuufwk
some@email_address.com
:
or
Aqmkylu
...
2
votes
1answer
118 views
Content-Secure-Policy headers
I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
0
votes
0answers
70 views
Remotely crashing a PC by only visiting a website? Is this an at least 6 year old WebGL bug?
http://hunger.hu/webgl.html
WARNING: only visit this website, it you don't mind crashing your PC!
so how is this possible? the website dates back to 2014! It is 2020 and by only visiting a website ...
0
votes
1answer
139 views
How to securely transfer cookies between two domains?
Let's say you have a website https://example.org which is being decommissioned and redirected to https://example.net.
Your users have a cookie on https://example.org which contains some authentication ...
1
vote
0answers
34 views
Security Concerns with HTTP/3 / QUIC-based protocols [duplicate]
I've been seeing a large number of companies, including Cloudflare who just sent out a notice to their customers about enabling HTTP/3 via QUIC recently, touting HTTP/3 based on QUIC as 'much better' ...
0
votes
1answer
138 views
Redirection - Different Website from Different Computer
There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
0
votes
1answer
246 views
Making S3 objects viewable only for logged in users
As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
1
vote
0answers
154 views
What is meaning of setting port number to NULL in document.domain call?
Here (https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy) it is mentioned
The port number is checked separately by the browser. Any call to document.domain, including document....
0
votes
1answer
64 views
Is it good idea to re-authenticate a user to access sensitive actions and data?
In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
3
votes
3answers
413 views
How to make sure that no one is watching you through webcam?
I have heard that intelligence agencies and hackers can illicitly gain access to a computer's webcam and microphone and keep a close eye on people using suspicious programs or malware.
Is there any ...
9
votes
1answer
833 views
Does HTTP/2 prevent security vulnerabilites like CRLF injection?
Which vulnerabilites does HTTP/2 prevent?
More specifically:
Does it prevent HTTP request smuggling?
Does it prevent HTTP response splitting / CRLF injection?
0
votes
2answers
144 views
Can a Slow Post HTTP attack be done from a single client?
Can a Slow Post HTTP attack be done from a single client?
The following source cites this line:
https://medium.com/fantageek/understanding-socket-and-port-in-tcp-2213dc2e9b0c
Ports are 16-bit numbers,...
