Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

How can we find xxe vulnerability in a web site? [closed]

It is a bug in a web application in which external entities of xml data manipulated. I want to know how we find it, the process.
user avatar
1 vote
3 answers
74 views

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
user avatar
  • 225
0 votes
1 answer
43 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
user avatar
1 vote
1 answer
80 views

What are the security concerns of embedding Base64-encoded images into an HTML document?

We are developing an MVC web-application in Django and having concerns about image uploading. First of all, here are our business requirements: Our users can upload images (like profile pictures, etc)...
user avatar
0 votes
1 answer
31 views

Modifying request responses leading to unauthorized access?

I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
user avatar
  • 105
0 votes
2 answers
48 views

File Upload(what type of file)

While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
user avatar
0 votes
1 answer
33 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
user avatar
0 votes
0 answers
17 views

Oauth 2.0 current best practice for SPA and backends

I want to build a application which having following architecture: According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering: Do I need to implement a separate ...
user avatar
0 votes
1 answer
33 views

A few questions about fixation attack

I am writing a small app. It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp. Attacker uses the app In this App, once they log out the ...
user avatar
  • 15
0 votes
1 answer
13 views

Arachni on VPS. ERR_CONNECTION_REFUSED on connect with WebUI

After starting arachni on VPS, I'm trying to connect with web UI. But browser cannot establish connection with ERR_CONNECTION_REFUSED. Some console output: arachni Puma starting in single mode... * ...
user avatar
0 votes
0 answers
14 views

Session Fixation PoC

I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following: XSS MiTM open redirect vuln ...
user avatar
1 vote
0 answers
42 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
user avatar
0 votes
0 answers
38 views

Verify frontend source code authenticity

I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key. If implemented properly this ...
user avatar
  • 389
0 votes
0 answers
23 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
0 answers
30 views

How to protect confidential information in a web application

For example there is a simple CRUD record management application. Let for simplicity the records are some documents. I need to implement a mandatory access control to the records. For example if some ...
user avatar
  • 153
0 votes
0 answers
28 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
user avatar
0 votes
1 answer
51 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
0 votes
0 answers
30 views

Writing effective UFW & IpTable rules

I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
user avatar
  • 197
0 votes
0 answers
45 views

Alternative to AWS CloudHSM?

I am not using AWS, google cloud or similar. I have a vps on another webhosting service. I am going to encrypt my data but don’t know where the best place to save the encryption keys would be? I can ...
user avatar
6 votes
4 answers
4k views

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

I am trying to better understand and determine the impact and implications of a web app where data tamping is possible. When discussing data tampering, I am referring to when you are able to use a ...
user avatar
  • 197
0 votes
1 answer
24 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
user avatar
0 votes
1 answer
95 views

UFW vs IpTables for web application security

I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables. From my ...
user avatar
  • 197
0 votes
2 answers
56 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
user avatar
  • 1
0 votes
1 answer
39 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
user avatar
  • 412
3 votes
1 answer
122 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
3 votes
1 answer
171 views

Is there a reason not to store a JWT as hardened cookie?

When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and &...
user avatar
2 votes
3 answers
140 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
user avatar
  • 23
0 votes
1 answer
63 views

What's the point in blocking content upload by extension?

In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
user avatar
  • 121
0 votes
0 answers
53 views

Should other devices be required to login again after an email change in settings?

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again. Nobody has been able ...
user avatar
0 votes
1 answer
26 views

What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]

In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
user avatar
0 votes
1 answer
46 views

Do WSGI servers connect to devices outside of the network?

I want to set up a plotly dashboard and view it from my browser. Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
user avatar
  • 101
0 votes
0 answers
60 views

Protecting against Dirbuster [duplicate]

I am wondering how someone might look to protect their website against directory traversal attacks using tools such as Dirbuster which may reveal some sensitive directories?
user avatar
  • 197
1 vote
1 answer
32 views

What sandbox does an <object> element run in? Can this sandbox be configured?

I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed. I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
user avatar
0 votes
0 answers
44 views

Security consideration for CAPTCHA system

Hi everybody I am developing an image captcha system as a side project something like hcaptcha/Recaptcha - image classification/object localization. I have a few questions regarding the security of ...
user avatar
1 vote
1 answer
46 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
user avatar
3 votes
1 answer
162 views

Report-URI CSP Directive

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used. Content-Security-Policy: report-uri https://www.example.com Does the above ...
user avatar
0 votes
0 answers
71 views

SQL injection into LIMIT in MySQL 8

Given a query such as: SELECT * FROM users limit 1,$limit Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)? What I have tried (unsuccessfully)...
user avatar
  • 29k
0 votes
1 answer
78 views

How to MITM an http website without infiltrating any infrastructure?

There's a certain website designed so that junior QAs learn to find bugs. Trouble is: it's http:// there's no IP filtering users are very junior so they use their real names as user names and ...
user avatar
  • 1,817
0 votes
2 answers
110 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
user avatar
  • 3
0 votes
0 answers
19 views

Store login credentials securely with JavaScript [duplicate]

Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically. For this, our application saves the ...
user avatar
  • 153
1 vote
1 answer
76 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
user avatar
2 votes
1 answer
155 views

Is this server side object vulnerable to XSS?

I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this: {"id": "34245425", "field": false, &...
user avatar
0 votes
2 answers
72 views

How big must the random string be and how long should a user activation link be available?

As I see in this answer that cryptographically secure randomness is a must in user activation urls such as: https://example.com/user-activate/^random_string^ But what are considered best practice ...
user avatar
0 votes
0 answers
34 views

Local attack vector and other metrics

While calculating the CVSS score using CVSS3.1, attack vectors are classified into four. Network - Remote attack Adjacent - Should share the same Physical or Logical network of victim Physical - ...
user avatar
1 vote
1 answer
116 views

How to secure a code preview function?

Suppose there is an application which contained preview functionality, that means whatever the code (if it is PHP, HTML Python) the user writes, the user can preview the code. For ex: <?php echo &...
user avatar
0 votes
0 answers
70 views

Web Attack Chaining - Follow Up Attack from a Single Vulnerability

I am a blue team security researcher looking into preventing web-based attacks. For manual pentesting, we can tell that a certain vulnerability is likely to be present if another vuln is detected e.g. ...
user avatar
  • 101
0 votes
2 answers
203 views

Is Link Obscurity as a Security Practice Bad?

I have heard that "Security by Obscurity" is bad. And I have always agreed with it. But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
user avatar
  • 101
0 votes
0 answers
56 views

Can malicious code running in isolated Electron's renderer process send data to attacker's server?

I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
user avatar
2 votes
1 answer
161 views

Is it safe to view video files on Google Drive online?

I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
user avatar
0 votes
0 answers
68 views

How to protect a web app against supply chain attacks?

I'm looking for ways to further protect my web app against supply chain attacks. Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
user avatar
  • 1

1
2 3 4 5
66