The web tag has no usage guidance.
73
votes
4answers
9k views
What is the purpose of (ab)using the redirect page of my website for dubious URLs?
My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&...
The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
0
votes
3answers
85 views
What are the Pros and Cons of allowing users to stay logged in to a web application?
To become a more well-rounded developer, having a better understanding of security concerns and best practices will help me endeavor to build web-apps that are both user-friendly as well as secure.
I'...
0
votes
0answers
65 views
Grabbing WA Web chat partner IP with wireshark - any ideas?
Is there any way to grab the IP of the respective other counterparty ones invovlved in an P2P chat over WAWeb (on the side that can be sniffed) by putting wireshark on the line and monitor - for what ...
3
votes
1answer
74 views
Why Same origin policy is based on host-name and not on IP?
Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows.
An origin is defineed as ...
2
votes
0answers
64 views
SQL injection possible with parameter that seems to only accept integers
a similar question to this was already asked but it is not the same case. I am talking about this one Is SQL injection possible via integer?
In my case, I already have the confirmation of this ...
0
votes
1answer
40 views
What is ScriptSafe's “Client Rectangles” and what information does it leak?
Just wondering how this one affects the privacy and security because it breaks a lot of sites displaying images for example.
-3
votes
2answers
83 views
Can any one pls help me understand this code and what vulnerabilities exists? [closed]
what Vulnerabilities exists???
0
votes
1answer
81 views
Is it possible to do XSS attack in server side programming language?
As far I know, when using 3rd party library of client side programming language/Javascript, you are vulnerable to XSS attack.
Is it also vulnerable when using 3rd party library in server programming ...
2
votes
1answer
136 views
Is some kind of CSRF possible using img/script tag to read sensitive information
Let's say i have an API at https://mysite/api/getSensitiveData that:
Uses GET
Protected with cookie authentication
Returns JSON with some sensitive data
A bad guy creates a site on his server that ...
0
votes
0answers
23 views
Can I perform a basic web application security test of a web application from a pcap file
I have been trying to run zed attack proxy against a web application using some automated functional tests. ZAP keeps failing at some point due to sslsocket exceptions (I think due to making requests ...
5
votes
2answers
270 views
Avoid being hacked with brute-force attack
During the last week, our company website has been under a weird brute-force, this attack actually led to hacking an admin account.
Our website is a wordpress site. The attacker keeps performing POST ...
0
votes
0answers
61 views
can I use openssl to generate a 160-bit ECC certificate
I am doing some testing of the new security settings coming out in the next set of java patches.
One of the new restrictions is to not allow ECC keysizes less than 224 bits.
I want to generate an ECC ...
0
votes
1answer
58 views
Does Windows Authentication Use Secured Connection
I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
1
vote
0answers
320 views
Web API authentication with Kerberos
We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
1
vote
0answers
110 views
Brute Forcing a aspx form using Hydra
I am trying to brute force a Login.aspx page.
It has two text fields - txt_Username and txt_Password
The form submit however looks like this:
<input type="submit" name="btn_Login" value="Login" ...
-2
votes
1answer
125 views
DNS Request makes Google Image Unsafe to Use
I always thought the images from Google image search were under the domain of Google URLs.
As long as you don’t click the image to visit the original site that hosts that picture, you were with ...
2
votes
1answer
689 views
How does CleanBrowsing DNS servers make 'Youtube, Google and Bing forced to SafeMode'?
Quote from Activating CleanBrowsing
Activating CleanBrowsing is pretty simple and only takes 5 minutes. We
do our work via DNS, so you have to switch your DNS servers to go
through our Network ...
3
votes
1answer
182 views
What is the security impact of JavaScript minification?
In recent years the use of JavaScript minification for web applications proliferated so quickly that it can be considered as a defacto standard nowadays. I am wondering whether the use of such tools ...
4
votes
1answer
243 views
How can I see whether the e-mails I exchanged with someone have been encrypted?
In my understanding (please correct if applicable),
The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote ...
0
votes
1answer
68 views
Is it a risk running old modules on Apache?
I just saw that my hoster is running extremly old modules on Apache.
The cURL Version is 3 years old, the SQLLite is from the 24th October 2014 and the zlib version is 1.2.8 instead of 1.2.11. Also, ...
-2
votes
4answers
919 views
Where should I store user_id for authentication: in cookie or session?
I've decided to implement a simple, custom authentication system on my own for my web application: when a user logs in, I'll store their "user_id" in either a session or cookie.
If I choose cookie, ...
3
votes
0answers
754 views
can I use whatsapp like gmail with login and password? without everytime scan code? [closed]
can I use whats app like gmail with login and password? without every time scan code?
Because I need whats app some time different computer. so, it is possible to make id and password to use whats ...
1
vote
3answers
82 views
Decrypting multi-user secrets in multi-tenant web application
Currently I am developing a web application that implements a message archiving service. Required is that messages are not readable by the developer / sysadmins, and a nice-to-have would be ...
0
votes
0answers
62 views
Spoof local/internal IP address on browser [duplicate]
I found this website and I didn't knew you could get the local ip of a computer with php. I also found how to do it here. So I am wondering if anyone knows how to spoof this.
Also, if you know how to ...
5
votes
1answer
617 views
Equifax Data Breach 2017
In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced.
How did the criminals access this data? What was the exploit?
3
votes
1answer
98 views
Is it really necessary for security to have login on separate page?
Working on a public website where the login form is located on a separate page on it's own subdomain.
One of our biggest goals at the moment is to try to promote users to log in to the site more ...
0
votes
2answers
723 views
hundreds of users creating mail.ru and projectgold.ru accounts on my application db
I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this:
...
2
votes
1answer
31 views
Load balancer haproxy [closed]
can i configure a load balancer between two nodes by using only two ip adresses. I mean one of the two server will be a load balancer and backend server in the same time
1
vote
2answers
497 views
If my VPN provider sees all my traffic, who sees their traffic?
What I understand is that when you connect to a VPN, all your Internet traffic goes through something like a tunnel, and your VPN provider can see everything you do, but your ISP only sees that you ...
2
votes
2answers
362 views
DMZ layer for web server/presentation layer
I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
2
votes
1answer
3k views
Why is firefox attempting to direct me to a Captive Portal, when I'm connected to my own router?
I am connected to my own router, and I know for a fact that I do not have a captive portal installed. Firefox displays a banner at the top of the page saying that "you must log in to this network ...
0
votes
1answer
123 views
Is this reponse vulnerable to xss?
My application is returning category parameter in json body as the following response..
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=utf-8
P3P: policyref="/w3c/p3p.xml", CP="CAO PSA OUR"
...
1
vote
1answer
142 views
Does an Embedded Content Security Policy (CSP) Enforcement ruin a “regular” CSP?
I recently read a W3C Working Draft about the Embedded Enforcement of a Content Security Policy (CSP).
This document defines a mechanism by which a web page can embed a nested browsing context if ...
0
votes
3answers
126 views
What does the message mean and is it not safe to pay online at this website?
The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/58.0.3029.81 Safari/537.36 ...
0
votes
0answers
16 views
What action should you take when noticing someone elses site is compromised [duplicate]
A couple of times in my career, I've noticed (mostly wordpress) sites that have been compromised or have signs of a backdoor in google results.
What actions should I be taking in order to notify the ...
54
votes
6answers
8k views
Why do some sites ask for username/email and password on two separate screens? [duplicate]
Well, I only have two examples, but it seems to be a slowly growing thing.
First, I noticed that hotmail.com/live.com started to do this - ask for the email address on the first screen, and then you ...
3
votes
3answers
2k views
What does the POST data of HackBar (Firefox add-on) do?
What does the POST DATA Feature of Hackbar (Addon of Firefox )do ?
If I am checking for XML XXE vulnerability i use it .But what does it do by POSTing some data ?
If I want to repeat the same thing ...
0
votes
1answer
79 views
Better protocol for Web app [duplicate]
I have many Web applications developed as Node.js based servers horizontally scaled with a Load Balancer in front of them. At the beginning all my Web applications exposed HTTP endpoints and the Load ...
14
votes
1answer
2k views
What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol? [duplicate]
What parties have access to the full requested URL of a website accessed via the HTTPS protocol?
Here are some possibilities I can think of, and there could be more:
local device accessing the ...
1
vote
2answers
138 views
How to protect web app users from server compromise?
I would like to create a web app that runs on a server I don't physically control (e.g., on Google Cloud). I want to protect my users from the possibility of the server being compromised and sending ...
1
vote
2answers
127 views
Calculating Business Impact of Technical Vulnerability Issues
Is there any predefined, globally accepted methodology, framework or standard specifically on calculating Business Impact of technical (Network, Web, Mobile..) vulnerability issues?
Scoring and ...
0
votes
0answers
140 views
REST API and Web Application DAST
Do we need API security assessment even though it's covered in the Dynamic Security assessment of web applications using tools like IBM AppScan?
1
vote
0answers
45 views
Detecting cloaking at the client side
According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
1answer
2k views
Ways to bypass browsers CORS Policy
I was pentesting a Json Rest API today; the API needs a specific header to be sent:- Content-Type: application/json which doesn't allow CSRF attacks.
The only option I was left with was sending ...
1
vote
1answer
68 views
Question about transparency [duplicate]
I would like to run a web service (based on Node.js) and I'd be happy to be as transparent as possible with my users.
Ideally I'd like to give the users the possibility to verify somehow that my ...
6
votes
1answer
1k views
Why JSON Hijacking attack doesn't work in modern browsers? How was it fixed?
I understand JSON Hijacking vulnerabilities have been fixed in all modern browsers, but how exactly?
There are many articles that talk about techniques to prevent JSON Hijacking attacks (i.e. ...
1
vote
0answers
88 views
Determining the person responsible for a bot [closed]
We have recently discovered that a third party has been using a bot to manipulate traffic on one of our websites. We have gathered enough information to determine that the traffic is indeed a bot, and ...
5
votes
1answer
517 views
SSRF Attack Exploitation Scenario
In this video (0:37) the guy starts a simple HTTP server using Python and then uses a link to fetch a file from the server he just started. But how does this pose a potential security vulnerability?
...
5
votes
1answer
232 views
Best practice regarding activation mail request to reduce information leaks
We are setting up a service on our website allowing users to ask for a new activation link. To ask for a new activation link, the user has to submit his/her email address associated with his/her ...
-4
votes
1answer
54 views
İ need some directories and files must be a hidden, for example /.htaccess/ [closed]
İ need directories and files in the web web servers. Examples; can you write dir or file must be hidden
/admin.php/
/.htaccess/
/wp-config.php/
