Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
0 votes
1 answer
26 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
user avatar
0 votes
2 answers
98 views

Storing Anti-CSRF token in cookie with samesite=strict

The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker. In the application that I want to secure I can't use an ...
user avatar
  • 1
0 votes
0 answers
46 views

How to find a potential JSON Java deserialization code vulnerability with a whitebox approach in web server source code?

I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following ...
user avatar
0 votes
0 answers
20 views

How do you call REST API resource unintentional field modifying?

Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users. Let's say, for example; I got an account profile ...
user avatar
0 votes
1 answer
18 views

WSS protocol vs HTTPS protocol as an iframe embedded source in a web page

until recently, I've been embedding a chatbot service from a different/external site with an iframe tag. it's a paid service, not a free one. today I saw that they changed a few urls, swithing from &...
user avatar
  • 140
0 votes
0 answers
192 views

I am trying to exploit port 7000/tcp afs3-fileserver

I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
user avatar
  • 1
0 votes
2 answers
34 views

Altering requests after authenticating

In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
user avatar
  • 2,101
0 votes
2 answers
31 views

Windows IP Helper service listening on port 1000

On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
user avatar
0 votes
1 answer
29 views

Path traversal in REST style URLs?

Can path traversal vulnerabilities occur in REST style URLs? For example: https://x.com/filename/img.jpeg https://x.com/filename/../../../../../etc/passwd Does this make sense ?
user avatar
0 votes
0 answers
16 views

cmd.jsp - Tomcat - Understanding HTTP Status Code (302)

I'm currently playing with cmd.jsp webshells on a Java webapp in tomcat. This is the request (sending via burpsuite) PUT /path/cmd.jsp HTTP/1.1 Host: 69.69.69.69 Content-Length: 579 <%@ page ...
user avatar
0 votes
0 answers
7 views

Standards for UI being used at Critical infrastructure facility [migrated]

I'm developing a web application for a critical infrastructure facility. They want the web application as per some standards, these include Maximum number of rows that a table could have at once ...
user avatar
  • 1
0 votes
2 answers
110 views

How can you exploit a website that resolves to localhost?

Let's say you're on a pentest (or bug bounty hunting) and you meet a domain that resolves to 127.0.0.1, How can you exploit that? is that even considered a misconfiguration ? sometimes i see domains ...
user avatar
1 vote
3 answers
106 views

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
user avatar
  • 225
0 votes
1 answer
56 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
user avatar
1 vote
1 answer
119 views

What are the security concerns of embedding Base64-encoded images into an HTML document?

We are developing an MVC web-application in Django and having concerns about image uploading. First of all, here are our business requirements: Our users can upload images (like profile pictures, etc)...
user avatar
0 votes
1 answer
33 views

Modifying request responses leading to unauthorized access?

I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
user avatar
  • 105
0 votes
2 answers
65 views

File Upload(what type of file)

While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
user avatar
0 votes
1 answer
41 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
user avatar
0 votes
0 answers
39 views

Oauth 2.0 current best practice for SPA and backends

I want to build a application which having following architecture: According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering: Do I need to implement a separate ...
user avatar
0 votes
1 answer
33 views

A few questions about fixation attack

I am writing a small app. It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp. Attacker uses the app In this App, once they log out the ...
user avatar
0 votes
1 answer
16 views

Arachni on VPS. ERR_CONNECTION_REFUSED on connect with WebUI

After starting arachni on VPS, I'm trying to connect with web UI. But browser cannot establish connection with ERR_CONNECTION_REFUSED. Some console output: arachni Puma starting in single mode... * ...
user avatar
0 votes
0 answers
16 views

Session Fixation PoC

I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following: XSS MiTM open redirect vuln ...
user avatar
1 vote
0 answers
49 views

Re-populate form with JSON data

I re-populate form with JSON data via javascript (all data has the same origin server) 1 Wen the page load, make a request post ajax 2 The response Ajax is a: Object { primary_ns: {…}, secondary_ns: {…...
user avatar
0 votes
0 answers
41 views

Verify frontend source code authenticity

I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key. If implemented properly this ...
user avatar
  • 389
0 votes
0 answers
24 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
user avatar
0 votes
0 answers
30 views

How to protect confidential information in a web application

For example there is a simple CRUD record management application. Let for simplicity the records are some documents. I need to implement a mandatory access control to the records. For example if some ...
user avatar
  • 153
0 votes
0 answers
29 views

Cookie-based sessions

During an engagement, i have been asked by a client to explain (with the use of one or more examples) whether having an authenticated cookie-session web upload functionality can be dangerous for the ...
user avatar
0 votes
1 answer
53 views

Encryption options when one-way secure channel is available

I would like to ask what encryption options are available for the following real scenario: There is an unsecure, full-duplex communication channel between a server and client There is also a secure ...
user avatar
0 votes
0 answers
31 views

Writing effective UFW & IpTable rules

I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
user avatar
  • 197
0 votes
0 answers
58 views

Alternative to AWS CloudHSM?

I am not using AWS, google cloud or similar. I have a vps on another webhosting service. I am going to encrypt my data but don’t know where the best place to save the encryption keys would be? I can ...
user avatar
6 votes
4 answers
4k views

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

I am trying to better understand and determine the impact and implications of a web app where data tamping is possible. When discussing data tampering, I am referring to when you are able to use a ...
user avatar
  • 197
0 votes
1 answer
24 views

Prevent client access being the same as admin access in web application

My colleagues and I are developing a public web application with client and admin access. I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
user avatar
0 votes
1 answer
185 views

UFW vs IpTables for web application security

I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables. From my ...
user avatar
  • 197
0 votes
2 answers
57 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
user avatar
  • 1
0 votes
1 answer
48 views

Why is Content Security Policy necessary given Same Origin Policy?

Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary? Is it that CORS selectively removes some ...
user avatar
  • 402
3 votes
1 answer
132 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
5 votes
1 answer
225 views

Is there a reason not to store a JWT as hardened cookie?

When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and &...
user avatar
2 votes
3 answers
141 views

Manage passwords from my personal website

So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
user avatar
  • 23
0 votes
1 answer
67 views

What's the point in blocking content upload by extension?

In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
user avatar
  • 121
0 votes
0 answers
59 views

Should other devices be required to login again after an email change in settings?

I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again. Nobody has been able ...
user avatar
0 votes
1 answer
27 views

What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]

In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
user avatar
0 votes
1 answer
60 views

Do WSGI servers connect to devices outside of the network?

I want to set up a plotly dashboard and view it from my browser. Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
user avatar
  • 101
0 votes
0 answers
68 views

Protecting against Dirbuster [duplicate]

I am wondering how someone might look to protect their website against directory traversal attacks using tools such as Dirbuster which may reveal some sensitive directories?
user avatar
  • 197
1 vote
1 answer
36 views

What sandbox does an <object> element run in? Can this sandbox be configured?

I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed. I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
user avatar
0 votes
0 answers
45 views

Security consideration for CAPTCHA system

Hi everybody I am developing an image captcha system as a side project something like hcaptcha/Recaptcha - image classification/object localization. I have a few questions regarding the security of ...
user avatar
1 vote
1 answer
48 views

owasp crs 3.0 rule functuonalityconsult

I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
user avatar
2 votes
1 answer
168 views

Report-URI CSP Directive

Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used. Content-Security-Policy: report-uri https://www.example.com Does the above ...
user avatar
0 votes
0 answers
79 views

SQL injection into LIMIT in MySQL 8

Given a query such as: SELECT * FROM users limit 1,$limit Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)? What I have tried (unsuccessfully)...
user avatar
  • 29k
0 votes
1 answer
82 views

How to MITM an http website without infiltrating any infrastructure?

There's a certain website designed so that junior QAs learn to find bugs. Trouble is: it's http:// there's no IP filtering users are very junior so they use their real names as user names and ...
user avatar
  • 1,817
0 votes
2 answers
116 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
user avatar
  • 3

1
2 3 4 5
66