Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,267
questions
0
votes
0
answers
23
views
How can we find xxe vulnerability in a web site? [closed]
It is a bug in a web application in which external entities of xml data manipulated. I want to know how we find it, the process.
1
vote
3
answers
74
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 225
0
votes
1
answer
43
views
Does user uploaded image file to HTML input form pose a risk?
I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
1
vote
1
answer
80
views
What are the security concerns of embedding Base64-encoded images into an HTML document?
We are developing an MVC web-application in Django and having concerns about image uploading.
First of all, here are our business requirements:
Our users can upload images (like profile pictures, etc)...
- 33
0
votes
1
answer
31
views
Modifying request responses leading to unauthorized access?
I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
- 105
0
votes
2
answers
48
views
File Upload(what type of file)
While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
- 1
0
votes
1
answer
33
views
How to mitigate risk of exploiting open POST endpoints?
I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.).
I'm owning a web application that exposes some HTTP endpoints to the world. ...
- 1
0
votes
0
answers
17
views
Oauth 2.0 current best practice for SPA and backends
I want to build a application which having following architecture:
According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering:
Do I need to implement a separate ...
- 101
0
votes
1
answer
33
views
A few questions about fixation attack
I am writing a small app.
It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp.
Attacker uses the app
In this App, once they log out the ...
- 15
0
votes
1
answer
13
views
Arachni on VPS. ERR_CONNECTION_REFUSED on connect with WebUI
After starting arachni on VPS, I'm trying to connect with web UI. But browser cannot establish connection with ERR_CONNECTION_REFUSED.
Some console output:
arachni
Puma starting in single mode...
* ...
0
votes
0
answers
14
views
Session Fixation PoC
I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following:
XSS
MiTM
open redirect vuln
...
- 1
1
vote
0
answers
42
views
Re-populate form with JSON data
I re-populate form with JSON data via javascript (all data has the same origin server)
1 Wen the page load, make a request post ajax
2 The response Ajax is a:
Object { primary_ns: {…}, secondary_ns: {…...
- 31
0
votes
0
answers
38
views
Verify frontend source code authenticity
I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key.
If implemented properly this ...
- 389
0
votes
0
answers
23
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
0
votes
0
answers
30
views
How to protect confidential information in a web application
For example there is a simple CRUD record management application. Let for simplicity the records are some documents.
I need to implement a mandatory access control to the records. For example if some ...
- 153
0
votes
0
answers
28
views
Cookie-based sessions
During an engagement, i have been asked by a client to explain (with the use of one
or more examples) whether having an authenticated cookie-session web upload
functionality can be dangerous for the ...
0
votes
1
answer
51
views
Encryption options when one-way secure channel is available
I would like to ask what encryption options are available for the following real scenario:
There is an unsecure, full-duplex communication channel between a server and client
There is also a secure ...
0
votes
0
answers
30
views
Writing effective UFW & IpTable rules
I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
- 197
0
votes
0
answers
45
views
Alternative to AWS CloudHSM?
I am not using AWS, google cloud or similar. I have a vps on another webhosting service.
I am going to encrypt my data but don’t know where the best place to save the encryption keys would be?
I can ...
- 131
6
votes
4
answers
4k
views
Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?
I am trying to better understand and determine the impact and implications of a web app where data tamping is possible.
When discussing data tampering, I am referring to when you are able to use a ...
- 197
0
votes
1
answer
24
views
Prevent client access being the same as admin access in web application
My colleagues and I are developing a public web application with client and admin access.
I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0
votes
1
answer
95
views
UFW vs IpTables for web application security
I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables.
From my ...
- 197
0
votes
2
answers
56
views
How to secure an enpoint to prevent programatic calls from the client?
We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
- 1
0
votes
1
answer
39
views
Why is Content Security Policy necessary given Same Origin Policy?
Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary?
Is it that CORS selectively removes some ...
- 412
3
votes
1
answer
122
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
3
votes
1
answer
171
views
Is there a reason not to store a JWT as hardened cookie?
When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and &...
- 1
2
votes
3
answers
140
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 23
0
votes
1
answer
63
views
What's the point in blocking content upload by extension?
In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
- 121
0
votes
0
answers
53
views
Should other devices be required to login again after an email change in settings?
I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again.
Nobody has been able ...
- 368
0
votes
1
answer
26
views
What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]
In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
0
votes
1
answer
46
views
Do WSGI servers connect to devices outside of the network?
I want to set up a plotly dashboard and view it from my browser.
Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
- 101
0
votes
0
answers
60
views
Protecting against Dirbuster [duplicate]
I am wondering how someone might look to protect their website against directory traversal attacks using tools such as Dirbuster which may reveal some sensitive directories?
- 197
1
vote
1
answer
32
views
What sandbox does an <object> element run in? Can this sandbox be configured?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
- 113
0
votes
0
answers
44
views
Security consideration for CAPTCHA system
Hi everybody I am developing an image captcha system as a side project something like hcaptcha/Recaptcha - image classification/object localization.
I have a few questions regarding the security of ...
- 101
1
vote
1
answer
46
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
3
votes
1
answer
162
views
Report-URI CSP Directive
Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used.
Content-Security-Policy: report-uri https://www.example.com
Does the above ...
- 189
0
votes
0
answers
71
views
SQL injection into LIMIT in MySQL 8
Given a query such as:
SELECT * FROM users limit 1,$limit
Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)?
What I have tried (unsuccessfully)...
- 29k
0
votes
1
answer
78
views
How to MITM an http website without infiltrating any infrastructure?
There's a certain website designed so that junior QAs learn to find bugs. Trouble is:
it's http://
there's no IP filtering
users are very junior so they use their real names as user names and ...
- 1,817
0
votes
2
answers
110
views
HTTP with encrypted message vs HTTPS
A bit of background:
I am a web developer and sometimes i integrate some form of external API in my web applications.
It's the second time already that i find something strange: some APIs instead of ...
- 3
0
votes
0
answers
19
views
Store login credentials securely with JavaScript [duplicate]
Today I have a web application that needs to store the user's email and password, so that when he opens the login screen, the authentication is done automatically.
For this, our application saves the ...
- 153
1
vote
1
answer
76
views
Which CSP implementation is more secure?
While implementing CSP, there are two options.
Implement CSP in the HTTP response header
Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
- 189
2
votes
1
answer
155
views
Is this server side object vulnerable to XSS?
I have an object that is stored in the server side of the application. It is never inserted into the DOM. The object looks like this:
{"id": "34245425", "field": false, &...
- 31
0
votes
2
answers
72
views
How big must the random string be and how long should a user activation link be available?
As I see in this answer that cryptographically secure randomness is a must in user activation urls such as:
https://example.com/user-activate/^random_string^
But what are considered best practice ...
0
votes
0
answers
34
views
Local attack vector and other metrics
While calculating the CVSS score using CVSS3.1, attack vectors are classified into four.
Network - Remote attack
Adjacent - Should share the same Physical or Logical network of victim
Physical - ...
- 189
1
vote
1
answer
116
views
How to secure a code preview function?
Suppose there is an application which contained preview functionality, that means whatever the code (if it is PHP, HTML Python) the user writes, the user can preview the code.
For ex:
<?php echo &...
- 195
0
votes
0
answers
70
views
Web Attack Chaining - Follow Up Attack from a Single Vulnerability
I am a blue team security researcher looking into preventing web-based attacks.
For manual pentesting, we can tell that a certain vulnerability is likely to be present if another vuln is detected e.g. ...
- 101
0
votes
2
answers
203
views
Is Link Obscurity as a Security Practice Bad?
I have heard that "Security by Obscurity" is bad. And I have always agreed with it.
But today I had a coworker disagree when in consideration of links. He was arguing that a link with ...
- 101
0
votes
0
answers
56
views
Can malicious code running in isolated Electron's renderer process send data to attacker's server?
I'm trying to evaluate if a malicious npm dependency running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick ...
- 201
2
votes
1
answer
161
views
Is it safe to view video files on Google Drive online?
I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
- 21
0
votes
0
answers
68
views
How to protect a web app against supply chain attacks?
I'm looking for ways to further protect my web app against supply chain attacks.
Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
- 1