Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,366
questions
0
votes
1
answer
45
views
How to isolate VMs with internet exposed websites on my home network?
I want to host some websites served from an isolated VM which is on my home network through port forwarding.
Although I believe this is reasonably safe, I want to physically segment internet-exposed ...
0
votes
0
answers
18
views
Is it possible to disallow external IPs from accessing a page of a React site? [migrated]
I'm currently learning React to host a personal website (on an Ubuntu server) and am port forwarding it to allow access from the internet.
However, for security reasons, I'd like one or more pages to ...
- 101
0
votes
0
answers
25
views
Will these actions better secure my web app
I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
- 493
0
votes
0
answers
40
views
Web application rate limiting, IP blocking using different cellular networks [closed]
While testing a web application for rate limiting and IP blocking I noticed the following:
while using 4g through a GSM service provider, the server is blocking me after 300 requests
while using lte ...
0
votes
1
answer
90
views
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
0
votes
0
answers
22
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
0
votes
1
answer
37
views
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
- 9
0
votes
1
answer
106
views
Does Firebase App Check provide CSRF protection?
Quoting the OWASP Cheat Sheet on CSRF Prevention:
Using the Synchronizer Token Pattern:
CSRF tokens should be:
Unique per user session.
Secret
Unpredictable (large random value generated by a secure ...
- 53
0
votes
0
answers
61
views
How to implement secure E2EE for a managing App
TL;DR Is it possible to create an end-to-end encrypted web application where newly created users are able to access data encrypted before their creation?
My plan is to develop a (let's call it a ...
- 1
0
votes
1
answer
48
views
Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?
It's considered a best practice in security for login form to provide a vague error message
your username or password is wrong
rather than the more precise:
username does not exists
wrong password
...
- 103
7
votes
2
answers
2k
views
What happens if a DNS record points to non-controlled IP address?
If a domain, for example foo.com is pointed to a IP address (A record) outside of my control, for example the Twitter IP address. And the domain is visited using a browser:
What will be displayed in ...
- 423
1
vote
1
answer
120
views
How safe it is to view PDF file in browser without downloading the file into PC?
When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC?
I heard that FireFox has been sandbox heavily and ...
- 11
0
votes
0
answers
34
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 133
0
votes
0
answers
76
views
How to escalate or make a Self-XSS vulnerability more impactful when injecting a payload into the X-Forwarded-For header of a web request?
I'm a beginner bug bounty hunter, and I recently came across a Self-XSS vulnerability during my security testing on a target website. The vulnerability occurs when I inject a payload into the X-...
-1
votes
2
answers
120
views
How to learn to secure Web Applications? [closed]
The server is based on Linux and applications are based on Android and iOS.
I was looking through "Linux Hardening Guide" as someone recommended it to me in order to harden Linux servers. I ...
- 101
0
votes
0
answers
72
views
Proper HIPAA security
I am a sysadmin, though not security-specific. I was recently stunned to receive an automated email from my physician's office (in USA) containing an HTTP link to their website for the completion of ...
0
votes
0
answers
55
views
Advice on more in depth web app info gathering phase
I am a junior pentester currently working for a secure messaging app that includes a webclient. Only the subdomain is in scope and other subdomains are off-limits. Social engineering is also off ...
- 1
0
votes
1
answer
50
views
Does using Apache/nginx actually improve security of a webapp?
Let's say there is a webapp where users can upload files with sensitive data and view analytics generated by the backend. Does using a reverse proxy like nginx or Apache actually help with the ...
- 113
0
votes
0
answers
97
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
1
answer
51
views
How to exploit a CORS that only checks the end of the Origin header?
I noticed that in my website I only check that the Origin string ends with "mysite.org". Meaning that for this request:
GET / HTTP/1.1
Host: mysite.com
Origin: https://evil.com#mysite.org
...
- 73
0
votes
1
answer
34
views
How to properly migrate authentication cookies to using a new encryption scheme on a website while being backwards compatible?
When a user logs in with their email/password combo and gets authenticated to our website, the backend sends the web browser an encrypted cookie based off of their memberId with us. While this ...
- 295
0
votes
0
answers
54
views
Trying to generate TLS 1.3 Alert
I am trying to run tests on the TLS 1.3 protocol and I would like to generate alerts (as seen in TLS 1.2) that have a structure of the type ALERT:FATAL UNEXPECTED MESSAGE.
So far, I have tried to use ...
1
vote
1
answer
56
views
Is Web session required for app security?
I understand that the idea of a session was conceived originally to improve user experience with Web applications. I also understand that session implementation can introduce attack vectors if not ...
- 436
1
vote
1
answer
90
views
Which response headers for HTML snippets?
I have a web application that retrieves HTML snippets from the server and places them on the page, using JavaScript. The server responds with a small part of a HTML document. What Content-Type header ...
- 29.6k
0
votes
0
answers
45
views
What is risks model for a keys container implementation for web page in browser
I consider myself a newbie into security.
Standard questions for Kagi search was not helpful this time, so I come here in hope for answers.
I thinking about implementing a web app,like end-to-end-...
- 101
0
votes
1
answer
50
views
Implications of SHA256 implementation producing false / unexpected hashes
I found that one of our programs uses an sha256 implementation, that produces different hashes for same inputs, compared to standard libraries (in this case compared to node:crypto and Web Crypto API.
...
- 135
2
votes
2
answers
415
views
CVSS3 score for XSS leading to account takeover
Let's say there is a XSS vulnerability in a web application. The XSS allows an attacker to hijack the user's session. Within the session, the attacker can view/modify the user's credit card and ...
- 85
0
votes
2
answers
128
views
How does mime-sniffing enable a drive by download attack?
A frequent recommendation for hardening Web App response headers is "X-Content-Type-Options: nosniff" with the reasoning that preventing mime-sniffing reduces exposure to drive-by download ...
- 3
1
vote
1
answer
113
views
Do CSRF Tokens need to be tied to user IDs?
I am implementing a web system using Golang and have incorporated gorilla/csrf for CSRF protection. However, I've encountered an issue. When I have tab1 open in my browser, logged in as user1, and ...
- 11
0
votes
0
answers
58
views
Passkeys versus passwords for intranet websites
Do passkeys offer more security for intranet websites compared to passwords?
I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
- 53
0
votes
1
answer
59
views
Encrypted Note Password Confirmation
I'm creating a pastebin-style application which stores notes and has the following options:
Ephemeral, where it is deleted as soon as it is read
Encrypted, where the content is encrypted before being ...
- 135
0
votes
0
answers
38
views
How are these scammers operating from valid IPs? [duplicate]
Lately, my website has had a lot of fraudsters signing up and getting past my security checks.
I use vpnapi.io and stopforumspam.com to vet new registrations but all of the IPs this scammer is using ...
- 1
0
votes
0
answers
101
views
What security feature is this exactly?
I noticed that web apps like Gmail, Microsoft, Roundcube etc. when logging in, times out.
To be more specific - if I i.e. open up Gmail and enter the username or NOTHING AT ALL(!) and after two hours ...
- 1,554
0
votes
1
answer
95
views
Web app vulnerability scanning: how many URLs to check?
Scanning all of spidered URLs with a tool such as OWASP Zap can be computationally expensive on large apps. Have there been any studies on the adequate number of URLs (just the unique resources) to ...
- 436
1
vote
0
answers
58
views
Trying to access my HP printer via a device name failed today; would this be a new printer feature? [closed]
I have an HP printer which uses DHCP to connect to the local network (LAN). My DHCP forces a specific IP address to make it easier on me.
I also added the IP address in my /etc/hosts:
10.3.3.3 ...
- 987
0
votes
0
answers
60
views
Is there a way to prevent/detect DOM Clobbering in the browser?
It is possible to clobber document attributes, e.g.:
<img name="cookie">
...
typeof(document.cookie)
//=> 'object'
Is there any way to prevent this from happening, access the ...
- 1
1
vote
1
answer
323
views
CVSS3 Scope change question
Let's say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to ...
- 85
1
vote
0
answers
74
views
What is the proper procedure to allow users to reset their passkey
What is the best practice for allowing users to reset a passkey (WebAuthn)?
Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In ...
- 21
0
votes
2
answers
53
views
My logged in status is being maintained 36 hours after initial login on an online account
Log in time outs can be a pain we all know. However maintaining "logged in" status whereby even if I refresh a previously open tab the next day (I hibernate my laptop each night so Chrome ...
1
vote
0
answers
84
views
How can I encrypt files in a file transfer website? [closed]
I am a complete beginner and have almost no knowledge of encryption.
I have a file transfer website that encrypt the files before saving them in the server then it decrypts the files to be ready to ...
1
vote
1
answer
449
views
XSS in document.write(location.href)
Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here.
<script type="text/javascript">
document.write(location.href)
</...
- 113
1
vote
1
answer
91
views
How to use parameters from response in new request in Nuclei?
I need to use Nuclei to create some templates for a site. But to locate the bug, I have to use some information that the site returns after the first request. Is it possible to take it from the ...
- 11
0
votes
1
answer
73
views
Query on best practice - using 2FA to self-authorise IP addresses in an allow-list
I want to know whether a solution I'm considering for a web app is particularly secure / in line with best practices etc.
Scenario - a web application, it's a stock management app for small retailers. ...
2
votes
2
answers
279
views
Where or how to persist a decryption key in a React app?
I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text.
The encryption method I am using is that when a user registers, a random key is ...
- 21
0
votes
0
answers
50
views
Authenticated application scans across thousands of webapps with different credentials
Assuming a SOC in a Big Cap company which has >3000 web applications. Web App scans are performed at the moment, but they scratch the surface as scans are unauthenticated.
As
there is no way SSO ...
- 101
21
votes
2
answers
4k
views
Which IP address would be most safe and suitable to use as a placeholder in a live system?
Is there a best practice IP address that is safe to use as a placeholder in a live public system on the Internet?
e.g. In a similar capacity, the domain name example.com is reserved and can be safely ...
- 385
1
vote
1
answer
89
views
How do applications like Instagram and Discord secure users' resources? [duplicate]
Today I found out that the URL of Instagram private accounts' images and the URL of files I sent to my cousin in Discord are accessable even if I am not logged in or even on my phone using a VPN. For ...
- 111
0
votes
0
answers
94
views
Is this web cache poisoning attempt correct?
So i've been trying to learn cache poisoning for a while and today i thought i finally found a vulnerable instance. Everything seems to be working even tho it doesn't. Like, 416 response is cached, ...
- 1
1
vote
1
answer
90
views
Do web-hosting sites like Heroku or Railway expose your database?
I was watching this video https://www.youtube.com/watch?v=Qm7k1CPFkIc about how to steal passwords and the guy mentioned that you can use shodan.io (a site that lists various devices connected to the ...
- 115
1
vote
1
answer
387
views
Implications of accessing a web app via a VPN
I have a cloud-hosted server that I can Remote Desktop into. I have a web application that is hosted on this server via IIS. I also have a backend server on this same server that runs to get backend ...
