Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web]

The tag has no usage guidance.

25
votes
3answers
4k views

What is formjacking?

I just heard a very confused news broadcast about Symantec warning the world about the dangers of formjacking. The newsreader said it involved “hacking the form, not the website” whatever that means. ...
0
votes
0answers
31 views

Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?

For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be. Is it ...
2
votes
2answers
40 views

Is it ok to send plain text credentials in a XHR GET request?

When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
0
votes
0answers
29 views

How do I verify that a user on a remote system has root access?

Let's say an anonymous user somewhere on the internet claims that he or she is the admin/root user of the system/server behind some public IP Address. I was thinking, what can a root user do that a ...
0
votes
2answers
44 views

How to detect website active routes?

I'm building a website using Laravel and I'm just thinking about security. I would like to know if there is a way for attacker to detect all active web routes for a website ? For example: http://...
0
votes
1answer
65 views

What scenario does CORS protect against?

My understanding of the same origin policy is that it prevents scripts from making requests to resources outside of the domain from which they originated. One motivation of this is to prevent a ...
1
vote
1answer
77 views

What kind of redirect of websites is this? [closed]

Some websites can redirect you, but they're not using http 301 or 302. After that the url will be changed and you can't go back to the previous page using your web browser's back button. For example, ...
1
vote
1answer
169 views

Securing Flask admin pages

We've been developing a Flask app for a customer and a part of the agreement was that "customer admins" would be allowed to access Flask admin page to manage users, roles and business entities. The ...
-1
votes
1answer
111 views

Does an employer see if you try to access a blocked site? [duplicate]

Today while browsing on my mobile phone connected to my employer's wifi, I clicked on the link to a tumblr page. I then got an error message saying the web filter had blocked the page deeming it ...
1
vote
0answers
95 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
0
votes
0answers
21 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
0
votes
1answer
172 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
57
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
1
vote
1answer
21 views

Liquid security scenario

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, ...
0
votes
1answer
37 views

Why did a subdomain from a trusted website download a file?

I clicked on a link for the subdomain of a trusted website (the subdomain slackin.brilliant.org of the website brilliant.org), and instead of being directed to another page, a file called "download" ...
2
votes
1answer
230 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
4
votes
2answers
165 views

Telegram (or other messenger) message as second factor in 2FA

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
1
vote
1answer
53 views

Real life scenario for remote file execution

This is a commonly demonstrated attack because it is easy to explain and understand. The premise is that the victim does something like (oversimplified PHP example): include( $_GET['file']); And ...
0
votes
1answer
44 views

Remotely included script cannot set session variables

I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging ...
4
votes
3answers
597 views

Is hijacking a webcam after visiting a website a plausible threat?

(I made a throwaway to ask this question, since this situation is pretty embarrassing) Earlier today I started receiving emails threatening to send embarrassing video of me to all my contacts unless ...
74
votes
4answers
10k views

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&... The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
0
votes
3answers
109 views

What are the Pros and Cons of allowing users to stay logged in to a web application?

To become a more well-rounded developer, having a better understanding of security concerns and best practices will help me endeavor to build web-apps that are both user-friendly as well as secure. I'...
0
votes
0answers
142 views

Grabbing WA Web chat partner IP with wireshark - any ideas?

Is there any way to grab the IP of the respective other counterparty ones invovlved in an P2P chat over WAWeb (on the side that can be sniffed) by putting wireshark on the line and monitor - for what ...
3
votes
1answer
296 views

Why Same origin policy is based on host-name and not on IP?

Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows. An origin is defineed as ...
2
votes
0answers
162 views

SQL injection possible with parameter that seems to only accept integers

a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer? In my case, I already have the confirmation of this ...
0
votes
1answer
69 views

What is ScriptSafe's “Client Rectangles” and what information does it leak?

Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
-3
votes
2answers
88 views
0
votes
1answer
153 views

Is it possible to do XSS attack in server side programming language?

As far I know, when using 3rd party library of client side programming language/Javascript, you are vulnerable to XSS attack. Is it also vulnerable when using 3rd party library in server programming ...
3
votes
1answer
340 views

Is some kind of CSRF possible using img/script tag to read sensitive information

Let's say i have an API at https://mysite/api/getSensitiveData that: Uses GET Protected with cookie authentication Returns JSON with some sensitive data A bad guy creates a site on his server that ...
0
votes
0answers
23 views

Can I perform a basic web application security test of a web application from a pcap file

I have been trying to run zed attack proxy against a web application using some automated functional tests. ZAP keeps failing at some point due to sslsocket exceptions (I think due to making requests ...
5
votes
2answers
438 views

Avoid being hacked with brute-force attack

During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account. Our website is a wordpress site. The attacker keeps performing POST ...
0
votes
0answers
80 views

can I use openssl to generate a 160-bit ECC certificate

I am doing some testing of the new security settings coming out in the next set of java patches. One of the new restrictions is to not allow ECC keysizes less than 224 bits. I want to generate an ECC ...
0
votes
1answer
59 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
1
vote
0answers
488 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
1
vote
0answers
189 views

Brute Forcing a aspx form using Hydra

I am trying to brute force a Login.aspx page. It has two text fields - txt_Username and txt_Password The form submit however looks like this: <input type="submit" name="btn_Login" value="Login" ...
-2
votes
1answer
142 views

DNS Request makes Google Image Unsafe to Use

I always thought the images from Google image search were under the domain of Google URLs. As long as you don’t click the image to visit the original site that hosts that picture, you were with ...
2
votes
1answer
1k views

How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?

Quote from Activating CleanBrowsing Activating CleanBrowsing is pretty simple and only takes 5 minutes. We do our work via DNS, so you have to switch your DNS servers to go through our Network ...
4
votes
1answer
328 views

What is the security impact of JavaScript minification?

In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
4
votes
1answer
247 views

How can I see whether the e-mails I exchanged with someone have been encrypted?

In my understanding (please correct if applicable), The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote ...
0
votes
1answer
70 views

Is it a risk running old modules on Apache?

I just saw that my hoster is running extremly old modules on Apache. The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
-2
votes
4answers
3k views

Where should I store user_id for authentication: in cookie or session?

I've decided to implement a simple, custom authentication system on my own for my web application: when a user logs in, I'll store their "user_id" in either a session or cookie. If I choose cookie, ...
3
votes
0answers
980 views

can I use whatsapp like gmail with login and password? without everytime scan code? [closed]

can I use whats app like gmail with login and password? without every time scan code? Because I need whats app some time different computer. so, it is possible to make id and password to use whats ...
1
vote
3answers
120 views

Decrypting multi-user secrets in multi-tenant web application

Currently I am developing a web application that implements a message archiving service. Required is that messages are not readable by the developer / sysadmins, and a nice-to-have would be ...
-1
votes
0answers
73 views

Spoof local/internal IP address on browser [duplicate]

I found this website and I didn't knew you could get the local ip of a computer with php. I also found how to do it here. So I am wondering if anyone knows how to spoof this. Also, if you know how to ...
5
votes
1answer
639 views

Equifax Data Breach 2017

In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced. How did the criminals access this data? What was the exploit?
3
votes
1answer
104 views

Is it really necessary for security to have login on separate page?

Working on a public website where the login form is located on a separate page on it's own subdomain. One of our biggest goals at the moment is to try to promote users to log in to the site more ...
0
votes
2answers
817 views

hundreds of users creating mail.ru and projectgold.ru accounts on my application db

I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this: ...
2
votes
1answer
39 views

Load balancer haproxy [closed]

can i configure a load balancer between two nodes by using only two ip adresses. I mean one of the two server will be a load balancer and backend server in the same time
1
vote
2answers
1k views

If my VPN provider sees all my traffic, who sees their traffic?

What I understand is that when you connect to a VPN, all your Internet traffic goes through something like a tunnel, and your VPN provider can see everything you do, but your ISP only sees that you ...
2
votes
2answers
606 views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...