Questions tagged [web]
The web tag has no usage guidance.
241
questions
1
vote
1
answer
59
views
Ways to safeguard Internet users from fraudulent websites
Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
- 2,267
1
vote
1
answer
40
views
Does a web access token need to be encoded?
Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
- 111
0
votes
2
answers
40
views
Can a WAF transform HTTP response
I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
- 1,512
1
vote
1
answer
84
views
How does DNS prefetching endanger security/privacy?
I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
- 13
0
votes
0
answers
44
views
XSS payload with html Encoding
I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation.
What i understand is :
The browser html decodes the entities before ...
2
votes
2
answers
103
views
What mechanisms can be used by apps to block websites?
I came across several "productivity" extensions (eg. Limit) that can block websites if you enter it into their list. Some desktop/phone apps can also block other apps. I am quite new to ...
- 23
1
vote
1
answer
70
views
What are risks to users if pages do not have reCAPTCHA?
I understand how reCAPTCHA mitigates risk for site owners but how does reCAPTCHA benefit users?
With hackers exploiting fake reCAPTCHA to trick users into clicking and/or entering secure information ...
- 13
0
votes
0
answers
53
views
Flask URL Vulnerabilities
I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does ...
3
votes
1
answer
174
views
Are HTTP security headers only for web browsers?
There are some HTTP security headers in the world of cyber security of web applications. These are e.g.:
X-Content-Type-Options
X-Frame-Options
Content-Security-Policy
Referrer-Policy
Strict-...
- 519
1
vote
1
answer
132
views
Why do you need to wrap bash command inside another when opening a reverse shell?
In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used:
---js
((require[&...
- 121
2
votes
1
answer
69
views
Should I call a vulnerability XSS even though it is blocked by the CSP?
Let's say the Content Security Policy looks like this:
Content-Security-Policy: default-src 'self';
It's also not possible to upload JS files on the same origin.
Now there's an exploit to write ...
- 23
1
vote
1
answer
101
views
Is redirecting back to login page bad practice/insecure
One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen ...
- 13
1
vote
1
answer
24
views
Are there HTTP/2 specific attacks different from request smuggling?
I'm researching information about HTTP/2 from a cybersecurity point of view for an article, and i wanted to include a section about attacks exclusive to HTTP/2 or were this protocol have a key role.
I ...
- 13
1
vote
1
answer
249
views
Host header is preferred by OpenSSL over SNI
As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
- 345
1
vote
1
answer
132
views
What is <title>(.*?)<\/title> and how the attacker use that?
I had a log from my web server like this
[28/Aug/2022:12:57:02] "GET / HTTP/1.0" 200 1684 "" "<title>(.*?)<\/title>"
What is this meaning and what exactly ...
- 115
1
vote
1
answer
139
views
Does using a Hyper-V Ubuntu VM add more security when web browsing?
I've always been concerned that my casual browsing of the web directly from Windows 10 could infect my PC.
How much added security (if any) could be obtained by using Hyper-V to run an Ubuntu 22.04 ...
18
votes
1
answer
15k
views
What is this potential identity leak that NoScript warns about?
Recently, while using the Tor Browser, NoScript popped up the following warning when I opened a stack overflow link in a new tab from duckduckgo:
Potential Identity Leak
You are about to load a page ...
- 11.4k
0
votes
1
answer
219
views
What is the effect of the "&x=" in a SSRF? Is it something related to encoding?
I'm learning SSRF. I learnt that typing "&x=" kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9)
Everything that comes after the ...
- 3
0
votes
0
answers
23
views
Threats for static webpage or read-only APIs
We have requirement for webpage (similar to this) that need to be available to anonymous public user. The webpage is static and contains spatial information that are updated by backend server. There ...
0
votes
2
answers
146
views
How can this website bypass by VPN/proxies and somehow figure out my actual location?
My browser (Vivaldi) does not send any accept-language or similar headers for my native language.
Its user-agent does not contain my country or preferred language.
My proxy is verified at https://...
- 1
2
votes
1
answer
319
views
WSS protocol vs HTTPS protocol as an iframe embedded source in a web page
until recently, I've been embedding a chatbot service from a different/external site with an iframe tag.
it's a paid service, not a free one.
today I saw that they changed a few urls, swithing from &...
- 160
0
votes
1
answer
50
views
Is having a seperate server to handle encryption operations a secure way to protect a private key for a web application?
Assume I have two servers which are part of a production environment for a web application which handles sensitive user data. The first server is a ruby on rails application, and the second is a ...
- 236
1
vote
1
answer
204
views
Can BeEF also work in public?
Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost.
I can only test my site for XSS on the ...
- 11
1
vote
0
answers
87
views
What is the value of no paste text boxes for bank web sites?
HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
- 121
0
votes
1
answer
90
views
Advice on how to organize web folders to prevent paths from being found out
In a private area of a website, I need to create a folder tree containing documents belonging to different clients.
The contents of these directories can only be accessed if you are logged in, but I ...
- 1
9
votes
2
answers
2k
views
Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?
I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail.
Today I cleared the browser data except for the autofill stuff.
Then I went to Stack Exchange to register an ...
- 107
1
vote
3
answers
188
views
Is a HTTP Request Smuggling a concern when using load balancers?
CVE-2022-22720 (Apache HTTP Server 2.4.52 vulnerability) mentions that the risk is with HTTP Request Smuggling.
My understanding of HTTP Request Smuggling is that a front server A transmits to a back ...
- 8,968
2
votes
1
answer
191
views
HTTP and HSTS Web Server
If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list?
I ...
- 23
0
votes
3
answers
2k
views
Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?
The answers to Can a PDF file contain a virus? show that clearly it can!
Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
- 1,240
0
votes
0
answers
13
views
How to detect web account vulnerability [duplicate]
I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login.
...
- 101
0
votes
2
answers
701
views
Is it possible to send X-Forward-Host headers from client side?
I found a report on hackerone which is being awarded $200 for XSS via forwarded host header.
It is a reflected xss and I was wondering how an attacker can attack the victim?
Is there any way in ...
0
votes
1
answer
68
views
Can Firefox master password dialog be used for phishing my master password?
I have used master password to protect my login information in Firefox. Whenever I first start Firefox and open a page requiring authentication information Firefox asks my master password before ...
- 101
0
votes
1
answer
77
views
Can I prevent credential leakage from csrf or xss attack if I check both cookie and token?
Suppose the server can provide one cookie and one token. Then I set them when the user login. The cookie was set to httpOnly and the token will be saved in localStorage. Both of them will be sent back ...
- 101
0
votes
1
answer
211
views
What is the difference between Cross Origin Opener Policy and SOP?
"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents."
In a situation ...
- 3
0
votes
0
answers
38
views
No UAC appearing for newly installed applications
Recently I have noticed that my system doesn't show the UAC prompt whenever I install some application from another source, I have UAC on and everything is working fine, I also have an administrator ...
- 1
0
votes
1
answer
205
views
What's the purpose of 'instagram password cracker tools/hacker tools' websites? [closed]
There are over 9000 websites on the web claiming that they can hack Instagram accounts. In reality, none of them does what they say they do.
So, What's their purpose?
These website owners do know that ...
0
votes
2
answers
257
views
Is Link Obscurity as a Security Practice Bad?
I have heard that "Security by Obscurity" is bad. And I have always agreed with it.
But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
- 101
2
votes
0
answers
29
views
Is two-stage logging in more secure? [duplicate]
I’m trying to find the correct forum for this question, so if not here, please suggest an alternative.
I notice a number of web sites now log in users in two steps: one for the username/email address, ...
- 141
0
votes
1
answer
76
views
Benefit of asymmetric encryption vs trivial alternatives in compromised software?
Background information:
I have a client application that communicates with a server through a web API.
The data being communicated is not personally sensitive (no passwords, credit card details, ...
- 143
1
vote
0
answers
72
views
Clicking from one site to a logged in site. Does it reveal your original site identity?
Let's say you have an account on a social media site (e.g. Twitter). You set up a fake identity on that site (used a separate email address to sign up, not using your real name etc).
Now let's say you ...
- 111
0
votes
0
answers
64
views
Possibility of arbitrary file upload where upload converted to png
Would a file upload function be vulnerable to code execution where the uploaded file is always converted to a PNG file by the application? For example, if one uploads shell.php and this file is ...
- 155
0
votes
1
answer
243
views
Origin header reflected in ACAO header with ACAC set to true on an API
While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
1
answer
117
views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
0
votes
3
answers
150
views
Can I use some modified browser for gaining upper hand on a front-end?
Browsers follow certain standards to securely render webpages and execute scripts. But it's all in browser.
An example is that I can't access stuff inside a JS module from the browser console.
What if ...
- 23
0
votes
1
answer
1k
views
Logout functionality with JWT Session tokens
As per my understanding, JWTs are signed tokens which can be used to identify users, if used as session tokens, they can eliminate need to store session on server ie. they are stateless.
Suppose I ...
0
votes
0
answers
108
views
How is web cache poisoning possible?
There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com:
Reflected unkeyed headers:
If the ...
- 101
1
vote
1
answer
349
views
HTML Object Tag
In a recent PT assignment, I overcame that a CSP policy where the object-src be set to self. When validated against Google CSP Evaluator, it reported that it the object-src can be set to none instead ...
1
vote
2
answers
331
views
Why do site operators block legal VPNs?
I use OpenWrt and by default all outgoing traffic is tunneled through Wireguard VPN endpoint (provider from the list of privacytools.io recommendations).
Often I get an "Access Denied" or ...
- 1,445
-1
votes
1
answer
170
views
XSS Inside the text part of an <a> tag [closed]
How do I xss inside <a href="https://gooogle.com">here</a> ? I have tried normally using alert() but it didn't work
- 21
0
votes
2
answers
194
views
Is this potential XSS exploitable?
I am pentesting a website and I found that I can inject code at value=""
<input type="text" id="search_1" name="keyword" placeholder="Search by keyword&...
- 21