An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
2answers
22 views
What's the benefit of JWT if user needs to send his credentials once anyway?
JWT tokens seem like a very good idea. You can send a request to some API without using your username/password secret pair.
Still, I don't fully understand the benefits that it gives. I have two ...
1
vote
1answer
20 views
Single quotes ' not sanitized
I'm trying to find security issues on my friend's site.
There is an input box for subscription. I can enter my email address:
Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com
After ...
2
votes
1answer
34 views
Way to properly escape user input which gets run by shell_exec() in PHP?
I have the following script:
$user_input = $_POST['user_input'];
// If there is a way, I want to escape it here.
shell_exec("php some_file.php $user_input");
Is there a way to properly escape the ...
0
votes
0answers
33 views
When developing a web application why should I enable case sensitivity for routes and strict routing mode?
Example for enabling case sensitivity will be for example "/show" route is not the same as "/Show". What are the best security best practice will be here?
I was also wondering if I should enable ...
0
votes
0answers
34 views
Securing web application AWS [on hold]
How to secure a web application hosted on Amazon Web Service AWS?
Securing web applications on the cloud is different and require more measures
0
votes
0answers
50 views
Does a separate app server with a web service do much for security? [closed]
When using a multi-tiered web application is a two tiered or three tiered design more secure?
In a two tier model the web server and application server are one box. The database is separate. The ...
-4
votes
0answers
63 views
POST method attacks! [closed]
In POST requests, values are sent in the "body" of the request. Nowadays, websites use POST methods more than GET.
Hackers can't see the parameter if a website uses POST methods. like
POST /path/...
0
votes
0answers
15 views
Protocol/standard/software for requesting PGP signing/verification of content?
I have a small web forum and would like to promote the use of PGP signing of messages. Users can sign their posts and verify the posts of other users but currently the process is manual. Depending on ...
4
votes
0answers
33 views
Security implications of download attribute
The download attribute in an a element tells the browser to force the download of a file that otherwise would be interpreted by the browser. This is very convenient, since often users wants to ...
0
votes
1answer
18 views
IDOR remidiation
We recently received out web app testing report back. The contractor was able to cycle over a incrementl IDOR and access other peoples messages within the system. I am trying to find the proper way to ...
73
votes
4answers
9k views
What is the purpose of (ab)using the redirect page of my website for dubious URLs?
My website has a redirect page with the format https://my.site/redirect?deeplink=https://foo.bar&...
The redirect is implemented in Javascript, so when you request the site, you get a 200 and ...
0
votes
0answers
64 views
CSS vulnerabilities [closed]
How to detect CSS vulnerabilities (not XSS)?
We use /' or ' to detect Sqli. Are there any methods for detecting CSS vulnerabilities?
1
vote
1answer
49 views
How to detect XSS on HTML tags? [closed]
I am a beginner who is trying to understand XSS. I want to make my own site and am very curious about how to detect if any of the HTML tags are vulnerable to XSS (like if the <src> or <a> ...
0
votes
1answer
24 views
Enforce a secured protocol over public api
I have implemented my product's HTTP(REST) API as a public API.
Although my server only allows HTTPS, I don't have any control over the clients.
I have vendors implementing clients to my API, and I am ...
1
vote
3answers
235 views
Why is it unsafe to send a user their password via SSL encrypted communication rather than always sending a reset link?
I can understand why you wouldn't want to email someone their password, but on an SSL encrypted web page, I dont understand why websites always require you to reset the password when you'd probably ...
-1
votes
1answer
95 views
If a site has no input then can it be hackable? [closed]
If I made a website without any input box can Hackers still hack my site?
0
votes
1answer
41 views
Data on VPS is safe, or can accessed on rent VPS Virtual Server?
I rent a VPS server for two months to test a webapp. I insert data into SQL on this server and want to host web app to this virtual server for test.
Can that server owner that rents a VPS to me or ...
-2
votes
0answers
96 views
Do HTTP response codes 406 and 302 while performing SQLi indicate a vulnerability?
While performing a SQLi test I've received HTTP response codes 406 and 302 from the server but don't see anything changing on the web page.
Are these responses an indication that the application is ...
0
votes
1answer
51 views
Modifying requests using Burpsuite considered to be valid security vulnerability?
I would like to know if intercepting and modifying requests using Burpsuite before reaching server is considered as vulnerability.
In our web based and mobile applications, adequate security measures ...
2
votes
3answers
157 views
If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?
For example, suppose I already typed username and password at this Facebook page:
https://m.facebook.com
But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
0
votes
0answers
31 views
Are 2-page website logins more secure than 1-page logins? [duplicate]
Over the last couple of years, some websites have switched to 2-page logins: on the first page the user enters their username, and on the second page the user enters their password.
Is this actually ...
0
votes
3answers
88 views
What are the Pros and Cons of allowing users to stay logged in to a web application?
To become a more well-rounded developer, having a better understanding of security concerns and best practices will help me endeavor to build web-apps that are both user-friendly as well as secure.
I'...
0
votes
1answer
57 views
Import Wireshark Cookies into Firefox?
I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies.
Greasemonkey and ...
3
votes
1answer
101 views
strstr and fopen, is there a bypass?
I have a binary that does this:
if (strstr(USERCONTROLLERSTRING, "..")) exit;
fopen(CurrentPath+"\\Data\\"+USERCONTROLLEDSTRING, "r");
then spits out all the content of the file. Is there any ...
-1
votes
4answers
114 views
Security concerns surrounding HTTP GET in Web Development
I'm currently a developer making my first foray into web development, mostly using C# ASP.NET services such as MVC and Web API. Getting into the HTTP side of things, I'm currently deciding whether or ...
1
vote
0answers
25 views
Java Sandbox Model: ist the ClassLoader sufficient?
I am creating a web application that runs untrusted code written by the user in Java. Of course the code is not supposed to have access to anything I don't want it to, so I wanted to implement the ...
3
votes
1answer
91 views
Exploit user input being directly inserted into PDF
I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded.
The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
89 views
XSS payload without html tags [duplicate]
Which payload can be used to exploit XSS without using html tags <>. These tags are filtered(sanitized) and encoded in output.
1
vote
0answers
31 views
Single-Page Application authentication and ISO 27001
I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, ...
0
votes
1answer
20 views
Does the presence of XSRF token and per-request session cookie mitigates the security risk of brute-forcing login credentials? [duplicate]
I am having no success on brute-forcing HTTPS form (username and password), that has XSRF token and per-request session cookie, using Hydra.
I want to know if the presence of XSRF token and per-...
0
votes
1answer
54 views
Good Vulnerable Wordpress VM or Lab?
I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play ...
1
vote
1answer
80 views
Authenticating With OWASP ZAP Script
I am currently working on a python script that will automate zap for me so I do not have to go in and manually fuzz the fields or crawl pages. The part I am stuck on is that my script currently can ...
3
votes
1answer
105 views
Is it plausible to enforce authorisation on SQL generated from “Client-side”?
Background
We know that SQL Injection (OWASP Top 10) is the most prevalent security vulnerability on websites today. The strategies for mitigating the risk are well known. But are these only ...
4
votes
3answers
133 views
Are there security concerns when using popular (js) frameworks?
To what extent should one trust web/js frameworks?
Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be ...
3
votes
1answer
74 views
Why Same origin policy is based on host-name and not on IP?
Same origin policy is to restrict one page to access another document from accessing data. Because they have different origin where SOP define an origin as follows.
An origin is defineed as ...
2
votes
0answers
59 views
User has been authenticated. Now what?
I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net.
Not wanting to ...
0
votes
1answer
43 views
PIV/CAC for FedRAMP Manatory requirements
My company is applying for a P-ATO for FedRAMP certification. There's a mandatory requirement I'm not understanding well.
"Can the system fully support user authentication via Agency Common Access ...
0
votes
1answer
34 views
Applying regexp for user input validation using JavaScript
As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
0
votes
0answers
46 views
Is authorizating add-ons in this way secure?
I have a website, for which I made accompanying add-on to Firefox and Chrome. Both of those are distributed privately. In Firefox they can be installed only from my website, and for Chrome the link to ...
1
vote
1answer
54 views
How to hide folders inside webroot from being identified?
I have a library inside my webroot:
https://my-website.com/wp-content/my-library-i-want-to-hide
Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
107
votes
2answers
15k views
Is a redirect showing the password in plain text a security vulnerability?
A couple of days ago, I attempted to log into the website of a well-known SaaS provider. I used a password manager on my browser (so user/pass were correct) and the NoScript plugin which had limited ...
0
votes
0answers
64 views
XXE injection in root node of XML document
So I'm on an engagement and discovered an XXE injection point in a peculiar place on a ASP.NET app that I can't seem to get my head around. One of the post parameters controls what "form" the rest of ...
-2
votes
1answer
146 views
Can just adding an apostrophe to input lead to SQLi that makes changes in the database?
If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify ...
0
votes
1answer
44 views
Running Directory Traversal Against POST Request Headers [closed]
I'm trying to run a directory traversal against the EdgeOS web server. I started the OWASP ZAP proxy with Firefox and tried to login with an incorrect username and password to look at the POST request....
2
votes
1answer
72 views
Why some applications host the API in a different domain?
I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com).
Two examples: 3.basecampapi.com and api.dropboxapi.com
Is there a ...
2
votes
1answer
106 views
owasp top 10 2017 automation
I am working on security automation - checking web application for the OWASP top 10 vulnerabilities. I'd like to check for the respective description, CWE-IDs etc and make decisions automatically. I ...
2
votes
3answers
75 views
When a user tries to register with an unactivated email again, should I tell user that the emails has not been activated?
Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the ...
3
votes
0answers
72 views
String Serialization in .NET [closed]
I am currently performing a secure code review of Fortify reported issues and segments of code flagged relates to current session state being stored in memory.
By default, the framework .NET ...
3
votes
3answers
71 views
How do I use a smart phone as an authenticator in the new Web Authentication specification?
I have been learning about the new Web Authentication specification. I am a little confused as to how the following use case would work:
A user wants to login to an enterprise web application on ...
1
vote
0answers
131 views
How to bust frame busting code without sandbox
Posted this on stackoverflow, but people are apparently scared of exploit code over there. I have the following index.html page that contains an iframe.
<body>
<iframe id="other" src="...
