Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
0answers
47 views
Best architecture for a web app with highly sensitive data
I have to design a web app that contains medical information. Only the staff of the organization need to access the data in the office and on the go. A VPN is already in place. On premise server ...
0
votes
1answer
52 views
Authentication handshake between two independent apps
I need help on a solution for below scenario from a security perspective.
Scenario:
There are two independent web applications App1 and App2.
User will log in to App1 by performing authentication ...
1
vote
2answers
55 views
Is it imporant that a cookie should have secure flag set if the website is running on HTTP?
I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
-1
votes
1answer
56 views
For what this special header is used? [on hold]
While pentesting I found this special header, header's value contains all the parameter's name which are being sent in the post body request.
for example if in post post name, email and password are ...
1
vote
1answer
37 views
Tracking script creates vulnerability
I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
0
votes
0answers
12 views
Is there any identification for common encoding/encryption? [duplicate]
While pentesting (web application) I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there ...
-2
votes
1answer
52 views
Session key is the same throughout the session, can this behavior be exploited?
This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
4
votes
1answer
65 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
2answers
50 views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
0
votes
1answer
64 views
XSS: Character showing in DOM
I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
-1
votes
1answer
96 views
How does this Session work (web)
It is difficult for me to fully understand this whole process.
I am using express.js and express-session.js with Node.
Now if someone logs in, a session is stored in the session store(server side) ...
0
votes
1answer
47 views
Published URL File APP.CSS
I am crossing an analysis on a website and while fuzzing and testing I came across the below URL:
https//www.****.**.*/content/css/app.css
Which generated the below output:
/* Minification failed. ...
0
votes
1answer
49 views
Attack Web Forms dvwa to achieve lfi
Does anyone know how to hack dvwa(http://www.dvwa.co.uk) via submitting a form input like ../../../../../etc/passwd to expose the /etc/passwd of a given server?
Is there a endpoint to hit for this?
...
1
vote
1answer
123 views
Bypass a simple XSS filter that only looks at <
Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''.
in = in.replace(/[<]/g, '');
...
1
vote
0answers
47 views
Persistent HTML form data across sessions
I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how.
UserA logs in
Fills form with custom data
Logs out before sending ...
0
votes
1answer
77 views
Is it possible to bypass this Xss Filter?
Everyone, I was creating this XSS filter for my node plugin and I want to know is it possible to bypass this?
function xSSFilter(str) {
return str
.replace(/&/g, '&')
...
0
votes
0answers
18 views
Old Jboss installation. Is it safer behind a reverse proxy? [duplicate]
I have an old Jboss 4.2 installation that is directly exposed on the internet. Programmers are updating the web application code to make it compatible with a supported version of WildFly, but at the ...
1
vote
1answer
85 views
How to hide webresource.axd and scriptresource.axd file?
I am getting an email from the security team, saying that webresource.axd and scriptresource.axd are visible. How do I hide it ?
1
vote
1answer
105 views
Benefits of placing WAF reverse proxy/transparent in front of web-based honeypots?
For my final year project, I wanted to do a comparative analysis of 2 WAF's ModSec/Shadow Daemon and web-based honeypot SNARE/TANNER.
I wanted to find out if there are any benefits of placing WAF ...
5
votes
4answers
124 views
What is the use of disabling detailed exception pages on open-sourced apps?
Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
36
votes
9answers
11k views
How dangerous is XSS?
I am a software engineer and have been watching a lot of videos about XSS.
But I fail to understand how is it dangerous if it runs on the client side and does not execute on the server side which ...
0
votes
0answers
30 views
Apache - Adding Redirect to sub-directory V/S changing DocumentRoot
I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule.
The reason I ask this, I have a website that is installed under /var/...
0
votes
2answers
50 views
Is eval() in JavaScript considered self-XSS?
I found eval() in the JavaScript code of a site in HackerOne.
I could not find the where the function is called, so to test the vulnerability I went to console in Chrome and wrote the method and a ...
0
votes
0answers
56 views
Information disclosure with AWS response headers
I'm currently testing a web application hosted on AWS. In the response headers, I've noticed various Amazon-related headers, I've never really seen before.
The headers include:
x-amzn-RequestId: <...
0
votes
0answers
44 views
Offline senstive data storage
I'm working on an web application in HTML5 using a service worker and one of the requirements is to work offline.
In order to achieve offline functionality we are storing all the application data ...
1
vote
3answers
131 views
Hash pepper in web application possible?
I have read a few articles and several question on here about hashing correctly.
While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
1
vote
2answers
50 views
Text field exploit
If a web application form contain few textbox fields. Among one should accept only 4 digit according to business logic. But it's taking more than 4 digit values. Is there any potential vulnerability ...
-1
votes
0answers
14 views
What type of encoding is this?? Please elaborate with type and method to decode [duplicate]
Please tell me the encoding of this text below
15Rg5MWo279sNRNj1kW181ce9Ac2ZlKaXrKB133yuB8=
M+fU3K2SJebmQVKo32OE83HAAisNioal2SlS0RM8vLg=
1
vote
0answers
28 views
How x-permitted-cross-domain-policies is different from CORS(cross origin resource sharing)? [duplicate]
OWASP is recommending x-permitted-cross-domain header. I gone through many websites and blogs and didn't get to know the difference between x-permitted-cross-domain and CORS. Since I have implemented ...
0
votes
0answers
41 views
Web app: using two hashing schemes for CPU-friendly password validation & secure storage [duplicate]
Consider a web application that:
uses HTTP Basic Auth over HTTPS, and therefore needs to validate a password (an API Key) on every request
and needs to handle a substantial load
has very few distinct ...
1
vote
0answers
73 views
Is there a way to exploit file_get_contents that has a prepended website?
suppose I have the following code that will display an image. The name of the image is supplied by the user as follows:
https://example.com/image.php?image=cat.jpg
My image.php file contains
$...
2
votes
1answer
205 views
How to verify Diffie Hellman uses a “Safe” prime
I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
1
vote
1answer
49 views
Remote detection of spring framework
I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security.
Is there any kind of analysis on HTTP headers that can provide ...
1
vote
1answer
90 views
What attack vector is prevented by using the 'coupling code'?
In The Netherlands, one can access government services using a login platform called DigID. Some services require a two factor authentication, for which one can use a mobile app.
This requires the ...
0
votes
1answer
32 views
CSRF protection for an email subscription website - are there any risks of having it turned off?
I have a main website with an email subscription form. And my other websites where I have an email capture form. A user enters their email on those website and via POST he's redirected to the main ...
6
votes
1answer
174 views
How can I find a web application's document root using a path traversal vulnerability?
I am performing a penetration testing on an application hosted on an Ubuntu environment.
So using a path traversal vulnerability, I can download any file.
The API web application runs as root (...
3
votes
2answers
225 views
Is this hybrid (cookie, jwt) authentication method for web applications known and practical?
I have been working with web applications for a while, some months ago I found a possible approach to get the security advantages from Browsers while using cookies for authenticating requests, with ...
0
votes
1answer
36 views
What are the different security concerns associated with open ports on mobile vs open ports on servers?
I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks. However, I haven't found out why exactly that is the case.
Do ...
1
vote
2answers
97 views
What is the difference between “missing function level access control” and “privilege escalation”?
I was going through a web application from my account and I was able to view some confidential information about my other account. I want to know if this is a case of missing function level access ...
2
votes
0answers
38 views
'Fake SSO & self registration' access to a web api
I was asked to design and implement a solution that I have some security concerns about.
The customer has a web application into which users log in using their credentials.
The customer wants to add ...
1
vote
1answer
98 views
Can an XSS exploit on a subdomain steal the cookies of the parent domain?
As per my understanding, if a cookie doesn't have a domain attribute (explicitly telling where this cookie can be used), by default that cookie will be used by the domain which issued it and all its ...
0
votes
1answer
48 views
Is it worth using a client-side XSS-focused library like DOMPurify?
That may not be the best way to phrase the question, but gives the basic idea.
If everything client-side is malleable, is it even worth it to use a JS library for sanitization?
I've seen DOMPurify ...
0
votes
0answers
28 views
Sqlmap - Getting Strange Table Names
I am running sqlmap on folllowing target and getting some weird table names as output. I am not sure why i am getting this as output. The backend dbms is SQLite.Can someone help in that why i am ...
1
vote
0answers
38 views
Is it secure to start a NTLM handshake not knowing if the server supports it?
I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests:
import requests
from requests_ntlm import HttpNtlmAuth
requests.get("http://...
-1
votes
2answers
46 views
ZAP: Evaluate / Show response in browser
Let's say I've edited a request and successfully found a XSS vulnerability. Now, I want to validate that in the browser.
However, since the payload was sent with POST, I can't just use "Open URL in ...
1
vote
0answers
38 views
How can this Authentication/Authorization flow be improved?
I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
1
vote
0answers
51 views
How to correctly store the users credentials [closed]
I am writing an application that requires a username/password for the first time.
I was wondering if the concept code below is a valid and secure way to store user passwords in the database. I hope ...
0
votes
2answers
157 views
XSS possible inside the value field of input tag when double quote is filtered?
Is it possible to get XSS in the value field of Input tag when the application filters out double quote?
<input type="hidden" name="something" id="somenthing" value="my_input_goes_here">
input ...
1
vote
0answers
45 views
How to treat SSN passing through web server
I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
0
votes
2answers
71 views
Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?
Im building a REST api for an ios application!
Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
