Questions tagged [web]
The web tag has no usage guidance.
158
questions
2
votes
1answer
67 views
Can Javascript overwrite a HTTPOnly cookie?
Can Javascript overwrite or delete a HTTPOnly cookie?
In more detail: Suppose the user's browser has a cookie for example.com with the HTTPOnly flag set, say session=552..e0. Suppose the user visits ...
0
votes
1answer
59 views
Is Using SSL secure enough to post request login credentials to my backend server?
I hope everyone is doing okay.
I've built a React.js website which is hosted in a server with SSL, but I'm not sure whether it's secure or not. That's why I decided to ask you for some advice/tips or ...
0
votes
0answers
26 views
Difference between gobuster and dirbuster in performance
The only difference I am aware, is of CLI vs GUI. But I am curious to know as to what is the difference in their performance and what are the additional features in one tool compared to another?
0
votes
1answer
21 views
How to find PHP filename and ID of the URL?
.htaccess is now a very common URL rewrite to make it SEO friendly and cover the database IDs.
What are the ways to explore php file on the server given to URL via .htaccess?
Example :
The URL is ...
0
votes
0answers
25 views
Burpsuite Crawling - Display Function Location on Result
Is there is any way for me to display Burpsuite crawling result as Function Location?
What i mean by function location is like for example:
URL: x.com/functions/showdata
Function Location: User > ...
0
votes
2answers
91 views
Simple and Universal way to password-protect existing webservices that are exposed to internet
There are many tools, devices and programs that by default run a http server and expose a user interface on port 80. Even my coffee machine has a web ui that it provides on port 80.
Now, it's easy to ...
1
vote
1answer
97 views
Can a file upload function be vulnerable without it the file name getting passed?
From googling, a lot of file upload vulnerabilities rely on injecting something into the filename and also rely on the picture being stored on the server, is it safe to just do a post request of the ...
0
votes
1answer
147 views
Which web vulnerabilities should I test for when pentesting a static site?
I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service ...
0
votes
1answer
76 views
What Same Origin Policy related risks are there with static pages?
I am wondering what risks there are if you have static pages on the same host that don't trust each other.
A key concept of Javascript and web security is the Same Origin Policy (SOP), which is also ...
1
vote
2answers
89 views
VPN service - change of ip
Imagine I connect to example.com, change my IP address using my VPN service, and then remain on example.com in my browser. Meanwhile I open some other sites and eventually switch off my VPN service. ...
1
vote
0answers
63 views
Is it possible to bypass .htacess protection?
So, I was involving in one of projects where client site and admin panel/dashboard was hosted on different sites. Not like a lot of CRM`s do or 90% of common sites (just in /admin or other URL ...
1
vote
2answers
160 views
Can random subdomain naming enhance security?
I have a bunch of services which I want to group under a subdomain. Somehow 2-factor authentication is not possible to identify the users of these services. I have a thought to have randomly named ...
0
votes
2answers
315 views
Can my oppressive government trace my Twitter activity and detect me?
I want to be active on Twitter against our oppressive government. Can my government trace and detect me?
Twitter is banned here and we must use VPNs. I use Outline (Shadowsocks) mostly. Is there any ...
-3
votes
2answers
501 views
Can arch Linux be used for pentesting [closed]
I currently use very much Ubuntu and Kali from the Debian family for penetration testing (Network and Apps) and I want to know if anybody has tested arch Linux or other distros for penetration testing....
32
votes
3answers
7k views
How are short passwords not safe if you limit the number of attempts?
On all web services that require passwords, like gmail, you are asked to set a long password. Like 8 characters or more.
The reason being higher security.
But the same services limit the number of ...
0
votes
1answer
171 views
Why is the Web so complicated? [closed]
Hope it does not sound as a surprise to anyone that modern Web and its security, with the many layers and technologies, is pretty confusing and difficult to learn well. For someone with a good ...
0
votes
3answers
65 views
Is it safe to hash passwords on the users device?
I don't know much about hashing, but I noticed a (relatively reputable) site logging me into my account by sending the url parameter "hash=longStringIAssumeisTheHashOfMyPassword".
The point of ...
2
votes
2answers
106 views
Can someone perform DDoS on my VPS even if it is only accessible through SSH?
Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
1
vote
0answers
91 views
Blocking URL brute-forcing on my server
Every day my server receives many GET requests in search of security holes. In other words, they are trying a list of words in search of a hole.
for example:
http://myapp.com/phpmyadmin
http://...
1
vote
1answer
75 views
Do you really need an access token and refresh token?
When using a single page application, in what way is access token + refresh token more secure than a single token in a cookie with SameSite: strict.
Given the browser supports SameSite.
I completely ...
1
vote
2answers
621 views
Bypassing NET::ERR_CERT_DATE_INVALID
When I try to access the Openmailbox web site, Google Chrome returns a NET::ERR_CERT_DATE_INVALID error:
"openmailbox.org normally uses encryption to protect your information.
When Google Chrome ...
1
vote
0answers
86 views
Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing
Someone requested my site's (Wordpress/Apache) 'includes' directory:
122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-"
Noticing the 200 response, I hit ...
1
vote
1answer
465 views
Is it possible to gain RCE from Arbitrary file write by an unprivileged user?
I am pentesting a PHP website running on Apache in a Ubuntu server.
I found a vulnerability that allows me to write files to the target system.
I know it's possible to write a php shell to the HTTP ...
1
vote
1answer
287 views
PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?
Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info.
This used to fall under the SAQ A ...
0
votes
1answer
82 views
How effective is Expect-CT against content inspection in an enterprise context?
HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection ...
1
vote
1answer
193 views
Difficulty understanding SOP and CSRF
As said here, a CSRF attack has little to do with SOP. However, on the OWASP CSRF page it is said that
Fortunately, this request will not be executed by modern web browsers thanks to same-origin ...
-1
votes
1answer
566 views
How is this allowing me to bypass recaptcha [closed]
I was testing rate limit on the login page of a site. It was captcha protected. I could not even intercept the POST request on burp, so from Google Chrome I looked at the logs and in its POST request, ...
0
votes
0answers
113 views
What tools in SecurityOnion can be used for web application intrusion logfiles in csv format?
I have some web server logs from a breach. Is there a tool in SecurityOnion where I can upload the log files in csv format and have some sort of behavior-driven, static IDS/IPS identify when a breach ...
0
votes
0answers
206 views
How to make wfuzz perform a request to retrieve CSRF token to include in the main request?
How to make wfuzz perform a request to retrieve CSRF token to include in the main request?
I've previously used patator, which includes the options before_url and before_fgrep for performing a ...
5
votes
0answers
73 views
XXE OOB Large File Extraction
Most of examples for extracting files through XXE OOB (Out of Band) sets up a listening HTTP server and listens to incoming request on the URL requested. However, since the URL length is limited to ...
2
votes
1answer
3k views
Why does the file “shell.php.jpg” can execute as a php file but “shell.jpg” cannot?
I am learning about file upload vulnerabilities using DVWA.
After cranking the website's security level to High,
the website checks both the post request's content type & file extension, so in ...
1
vote
1answer
69 views
How to secure embedded code containing REST api call
I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
1
vote
0answers
34 views
How to know what version of extensions are used in joomla-web-site from user's point of view?
The problem is: I'm a user and I'm to find out what version of extensions(modules, plugins and components) are used on Joomla-site.
In simple cases the version is already written,like here:
...
1
vote
2answers
107 views
Non SSL website with external SSL secured service
I'm working with site that is served via HTTP. Authentication service is external and served via HTTPS. I'm not sure that this isn't security concern that is website is not using SSL.
0
votes
1answer
166 views
When should you give up on attempting a xss on part of a website? [closed]
I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
0
votes
0answers
62 views
Web Site Access - Port Whitelisting
I am able to access a certain website https://buzzlightyear.acme.com:68080 from within a corporate network (Obviously the default https port 443 has been allowed in the windows firewall of the machine ...
0
votes
2answers
126 views
Identifying a script used for vulnerability scan
The logs of a server are showing a great number of 404 responses in a short time. Apparently somebody used a tool/script to look for known vulnerabilities by combining the server and part of the path ...
0
votes
0answers
166 views
'=' 'OR' SQL Injection Login Bypass Question [duplicate]
I was testing SQLI Cheatsheets on a vulnerable test site.
This particular injection '=' 'OR' seems to work on the login page.
Why does that injection work? What's the back-end SQL code, if I could ...
0
votes
2answers
148 views
Cross Site Scripting href=/\evil
I've seen
<base href=/\evil>
and
<base href=//0>
as a vector to use XSS. Could someone make an example using these vectors and explain me if "/\" is the same as http:// or has some ...
2
votes
1answer
501 views
Websocket Authentication at Opening Handshake Sufficient?
Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header.
Suppose the websocket ...
0
votes
1answer
88 views
Published URL File APP.CSS
I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. ...
0
votes
1answer
669 views
How is Instagram detecting me and blocking me each and every time I try to create a new account through different medium?
I have two Instagram accounts, one is mine (Account A) and the other (Account B) is for random images with my pets and a lot of other stuff.
Account B is private and has been from start, recently I ...
50
votes
5answers
12k views
What exploit are these user agents trying to use?
I just looked at my user agent tracking page on my site (archived on Yandex) and I noticed these user agents. I believe they are an attempt to exploit my server (Nginx with PHP). The 1 in front of it ...
1
vote
3answers
184 views
Best practices to prevent logging of LDAP credentials by intermediate apps
I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use.
We also have some internal web-based tools that interface ...
1
vote
0answers
324 views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
0
votes
1answer
44 views
CSRF protection for an email subscription website - are there any risks of having it turned off?
I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
1
vote
0answers
74 views
How to determine if a website has been hijacked?
I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL.
I was surprised by this change, ...
-1
votes
1answer
77 views
what are steps to do in order to secure my appli web [closed]
I'm asked to secure an appli web and I don't know really which steps I can follow to secure my appli web.
0
votes
0answers
41 views
Is it possible to contract a virus on Ubuntu/Debian from an Apache Nutch web crawl?
For the fourth time now I have contracted a virus while doing a large web crawl on webmd.com. I'm not certain that this is where the virus is coming from but I don't see what else it could be.
Is it ...
2
votes
2answers
277 views
Is it ok to send plain text credentials in a XHR GET request?
When testing my api server, I often requested the website http://domain.tld/api/?username=john&password=123456 to test things and after a while of course, my browser would autocomplete the url, ...
