Questions tagged [web]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
17 views

Can we identify secondary contexts from web application error messages? [closed]

If a web app is giving normal "not found" page for /blablablaalsdf but for certain paths, it doesn't give the normal 404 page but gives Cannot Get /<path> instead, would this be an ...
Hazem's user avatar
  • 1
0 votes
2 answers
41 views

Is There a way to exploiting / Make exploit scenario for Header based reflected XSS?

I've found a reflected XSS, but the problem is that the attack vector is the header (any header). Is there a way to develop an exploit scenario based on this?
0xdead 4f's user avatar
0 votes
0 answers
51 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
rominator007's user avatar
1 vote
0 answers
95 views

Newsletter Spam Attack - Somehow by not directly attacking?

Our website(shopify website) has been getting a bot attack on our newsletter subscription form. Not sure if emails are real or not but there is some from gmail and hotmail etc or some from weird ...
tarik's user avatar
  • 11
0 votes
0 answers
66 views

Methods to look for when checking if a javascript program is making network requests

I'm trying to quickly audit a js browser extension to see if it doesn't talk to the outside. Am I right in thinking that I can just grep the code for the following: XMLHttpRequest fetch $.ajax axios....
Scb's user avatar
  • 101
1 vote
1 answer
284 views

How safe it is to view PDF file in browser without downloading the file into PC?

When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC? I heard that FireFox has been sandbox heavily and ...
JUZ Aviewer's user avatar
0 votes
1 answer
151 views

Meaning of the custom http headers in burpsuite academy

I am going through the Burpsuite Academy Training on Serverside security and I came across a section I am not able to grasp fully: Some application frameworks support various non-standard HTTP headers ...
zero_day's user avatar
0 votes
2 answers
150 views

Why do most examples of CSRF use roundabout ways of executing an API call instead of just using pure Javascript?

When I see examples of CSRF attacks, it is almost always explained with someone entering some external API url in an <img> tag, e.g. <img src="bank.com/transfer?amount=10000?recipient=...
colioli's user avatar
0 votes
2 answers
150 views

Where is the file upload path on a webserver? [closed]

I'm currently testing file upload vulnerability. How should I identify the webserver's file upload path by analyzing or intercepting the POST traffic?
MMDF's user avatar
  • 1
0 votes
0 answers
15 views

Block specific spam ip address to my websites [duplicate]

I have a website. It receives visits from about 50000 different ip addresses a day, I know it does not provide 100% protection, but I am thinking of doing an ip block operation on harmful ip addresses ...
Kadir Çolak's user avatar
0 votes
0 answers
118 views

What type of token is this?

I started noticing this kind of token in a lot of CTF tasks from different authors: eyJlbWFpbCI6ImVtYWlsQG1haWxib3guZG9tYWluIiwiaWQiOjN9.ZLNCAQ.MxwKVKj_dramWyfT5XxT6g9U3xk The structure is as follows: ...
Andrey's user avatar
  • 3
3 votes
1 answer
338 views

Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier

This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework). This extension generates a session identifier using the user's ...
WhiteFox's user avatar
1 vote
0 answers
295 views

How can I encrypt files securely in my website?

With Django, I'm doing a file transfer website. One use will upload a file and then the recipient will download the file. I want to encrypt this file securely so that the encryption key is not stored ...
Bob The Builder's user avatar
0 votes
1 answer
233 views

Random endpoint getting pinged constantly on my server [duplicate]

I've read bits around this, but I am curious should I be worried. I constantly am getting hit with random GET and POST requests from I guess just bots crawling the web trying to find vulnerabilities. ...
randomJSEngine's user avatar
1 vote
0 answers
139 views

Banking site POST data obfuscated. Why?

I am logged in to my banking site and I see this kind of form POST data in the Developer tools of Chrome: accountNo: removed for security reason branchCode: removed for security reason fromDate: ...
K V Sharma's user avatar
3 votes
2 answers
947 views

XSS in a href with target=_blank

I have found out that in most browsers the following code won't execute: <a href="javascript:alert(1)" target=_blank>click</a> But the same code without blank will. My question ...
The Modern Gamer's user avatar
1 vote
1 answer
251 views

Malware delivered when clicking a Google Search link, but only on Windows

I stumbled across suspicious file download behaviour from a site, but I am perplexed as to how it worked. Visit Google.com Search for the company name On the list of results, click the company's link ...
rwhitman2017's user avatar
1 vote
0 answers
50 views

Woocommerce cart dwell time [closed]

I had an issue with woocommerce. A user completed a purchase having the product in his cart after one year (Yes One Year), and bought at a different price, how is that possible? I understand that ...
Emiliano Di Giacomo's user avatar
0 votes
1 answer
198 views

How to safely share data between 2 SPAs?

Let's say I have 2 SPAs (single page applications), SPA A and SPA B. I want to share data between the 2 applications for an end-to-end flow. How can I safely share data such that it would not be ...
Adam Thompson's user avatar
1 vote
1 answer
123 views

Ways to safeguard Internet users from fraudulent websites

Extended Validation SSL certificates have been effectively abandoned, as web browsers do not even show them as something special, so my question is: how would you go about safeguarding the user from ...
Artem S. Tashkinov's user avatar
1 vote
2 answers
788 views

Does a web access token need to be encoded?

Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
dabadaba's user avatar
  • 111
0 votes
2 answers
170 views

Can a WAF transform HTTP response

I have hit a conceptual roadblock here and, to be honest, do not really have a lot of experience with WAFs or firewalls in general. (I did go through this very nice explanation to get upto speed with ...
qre0ct's user avatar
  • 1,522
1 vote
1 answer
541 views

How does DNS prefetching endanger security/privacy?

I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
Liz's user avatar
  • 113
2 votes
2 answers
230 views

What mechanisms can be used by apps to block websites?

I came across several "productivity" extensions (eg. Limit) that can block websites if you enter it into their list. Some desktop/phone apps can also block other apps. I am quite new to ...
Junior Hat's user avatar
1 vote
1 answer
204 views

What are risks to users if pages do not have reCAPTCHA?

I understand how reCAPTCHA mitigates risk for site owners but how does reCAPTCHA benefit users? With hackers exploiting fake reCAPTCHA to trick users into clicking and/or entering secure information ...
Jen Dietrch's user avatar
0 votes
0 answers
355 views

Flask URL Vulnerabilities

I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does ...
justsobad's user avatar
3 votes
1 answer
546 views

Are HTTP security headers only for web browsers?

There are some HTTP security headers in the world of cyber security of web applications. These are e.g.: X-Content-Type-Options X-Frame-Options Content-Security-Policy Referrer-Policy Strict-...
Hasan's user avatar
  • 519
1 vote
1 answer
377 views

Why do you need to wrap bash command inside another when opening a reverse shell?

In the CSAW 2022 web challenge, called "my little website", a youtuber in this video used a vulnerability in md-to-pdf to run arbitrary js, and this is the payload used: ---js ((require[&...
snatchysquid's user avatar
2 votes
1 answer
133 views

Should I call a vulnerability XSS even though it is blocked by the CSP?

Let's say the Content Security Policy looks like this: Content-Security-Policy: default-src 'self'; It's also not possible to upload JS files on the same origin. Now there's an exploit to write ...
Jonas's user avatar
  • 23
1 vote
1 answer
322 views

Is redirecting back to login page bad practice/insecure

One of our company sites redirects all bad URLs back to the login page which is required to even access the site. Is this insecure? It feels like it may cause some weird issues as I have never seen ...
Kineye's user avatar
  • 13
1 vote
1 answer
74 views

Are there HTTP/2 specific attacks different from request smuggling?

I'm researching information about HTTP/2 from a cybersecurity point of view for an article, and i wanted to include a section about attacks exclusive to HTTP/2 or were this protocol have a key role. I ...
kiratross's user avatar
1 vote
1 answer
1k views

Host header is preferred by OpenSSL over SNI

As I understand a webserver shall serve SNI first and ignore HOST header from HTTP 1.1 as TLS handshakes occurs before HTTPS, to test I came up with this example: two domain names under the same IP ...
Ghost Rider's user avatar
1 vote
1 answer
190 views

What is <title>(.*?)<\/title> and how the attacker use that?

I had a log from my web server like this [28/Aug/2022:12:57:02] "GET / HTTP/1.0" 200 1684 "" "<title>(.*?)<\/title>" What is this meaning and what exactly ...
Dita Aji Pratama's user avatar
1 vote
1 answer
323 views

Does using a Hyper-V Ubuntu VM add more security when web browsing?

I've always been concerned that my casual browsing of the web directly from Windows 10 could infect my PC. How much added security (if any) could be obtained by using Hyper-V to run an Ubuntu 22.04 ...
JeanOfGrenoble's user avatar
18 votes
1 answer
20k views

What is this potential identity leak that NoScript warns about?

Recently, while using the Tor Browser, NoScript popped up the following warning when I opened a stack overflow link in a new tab from duckduckgo: Potential Identity Leak You are about to load a page ...
nobody's user avatar
  • 11.6k
1 vote
2 answers
726 views

What is the effect of the "&x=" in a SSRF? Is it something related to encoding?

I'm learning SSRF. I learnt that typing &x= kinda turn off the rest of an URL (like https://some.website.com/user?id=9&x=.website.com/api/item?id=9) Everything that comes after the &x= ...
Ezau's user avatar
  • 13
0 votes
2 answers
299 views

How can this website bypass by VPN/proxies and somehow figure out my actual location?

My browser (Vivaldi) does not send any accept-language or similar headers for my native language. Its user-agent does not contain my country or preferred language. My proxy is verified at https://...
Baque's user avatar
  • 1
2 votes
1 answer
2k views

WSS protocol vs HTTPS protocol as an iframe embedded source in a web page

until recently, I've been embedding a chatbot service from a different/external site with an iframe tag. it's a paid service, not a free one. today I saw that they changed a few urls, swithing from &...
rami300's user avatar
  • 160
0 votes
1 answer
120 views

Is having a seperate server to handle encryption operations a secure way to protect a private key for a web application?

Assume I have two servers which are part of a production environment for a web application which handles sensitive user data. The first server is a ruby on rails application, and the second is a ...
Chev_603's user avatar
  • 256
1 vote
1 answer
313 views

Can BeEF also work in public?

Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost. I can only test my site for XSS on the ...
Kristijan's user avatar
1 vote
0 answers
127 views

What is the value of no paste text boxes for bank web sites?

HSBC Bank plc (UK) has a OTP system to confirm online payments via SMS. The 6 figure number is sent to the user who enters it into the website. Sometimes the cards registered email address is ...
User65535's user avatar
  • 151
0 votes
1 answer
152 views

Advice on how to organize web folders to prevent paths from being found out

In a private area of a website, I need to create a folder tree containing documents belonging to different clients. The contents of these directories can only be accessed if you are logged in, but I ...
xaifu's user avatar
  • 1
9 votes
2 answers
2k views

Does the "auto formfill" feature in Chromium-based browsers actually send this to the webpage?

I use Vivaldi. I have previously filled in forms where I used a certain name and e-mail. Today I cleared the browser data except for the autofill stuff. Then I went to Stack Exchange to register an ...
Javiair's user avatar
  • 107
2 votes
3 answers
567 views

Is a HTTP Request Smuggling a concern when using load balancers?

CVE-2022-22720 (Apache HTTP Server 2.4.52 vulnerability) mentions that the risk is with HTTP Request Smuggling. My understanding of HTTP Request Smuggling is that a front server A transmits to a back ...
WoJ's user avatar
  • 9,038
2 votes
1 answer
398 views

HTTP and HSTS Web Server

If I have HSTS enforced on a web server with HTTPS 443, but HTTP port 80 is still open, does this make HTTP still accessible, or only for the first time before it's added to the browser HSTS list? I ...
Sjim49's user avatar
  • 23
1 vote
3 answers
16k views

Is there a way to scan a pdf to ensure it doesn't contain anything that could be a virus?

The answers to Can a PDF file contain a virus? show that clearly it can! Sometimes we can be quite sure a certain pdf should not need to do anything sophisticated - for example a book in pdf form - so ...
stevec's user avatar
  • 1,280
0 votes
0 answers
14 views

How to detect web account vulnerability [duplicate]

I know I might take a lot of flack for asking this basic question, but I hope you'll be patient with me. I was looking at a few websites and analyzing the payload when sending a POST request to login. ...
Robin Sage's user avatar
1 vote
2 answers
2k views

Is it possible to send X-Forward-Host headers from client side?

I found a report on hackerone which is being awarded $200 for XSS via forwarded host header. It is a reflected xss and I was wondering how an attacker can attack the victim? Is there any way in ...
ladecruze's user avatar
0 votes
1 answer
115 views

Can Firefox master password dialog be used for phishing my master password?

I have used master password to protect my login information in Firefox. Whenever I first start Firefox and open a page requiring authentication information Firefox asks my master password before ...
pirho's user avatar
  • 101
0 votes
1 answer
148 views

Can I prevent credential leakage from csrf or xss attack if I check both cookie and token?

Suppose the server can provide one cookie and one token. Then I set them when the user login. The cookie was set to httpOnly and the token will be saved in localStorage. Both of them will be sent back ...
Tac's user avatar
  • 101

1
2 3 4 5 6