Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,323
questions
0
votes
0
answers
10
views
Audit tracking for web users [closed]
For a web app that will get heavily attacked, I figure one very useful tool will be audit tracking of what occurred for both getting a better picture of attacks and , if the worst happens, learning ...
- 393
0
votes
0
answers
24
views
A Hybrid Authentication method. (JWT, MFA, Cookies, Sessions) [closed]
I am currently creating an app to help with retail management. As you may be able to imagine, user authentication is of great importance as the app will store all kinds of sensitive information such ...
0
votes
1
answer
34
views
Exploiting a referer open redirect
I wanted to know if it is possible to exploit the fact that in my webapp the Referer header of a request is being reflected in the response.
For example:
GET /endpoint1 HTTP/2
Host: mysite.com
Cookie: ...
- 61
2
votes
1
answer
117
views
Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?
Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
- 21
0
votes
0
answers
37
views
In a web application, what would you consider the best way to store secret keys obtained via an SDK?
Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user.
Currently when ...
- 1
0
votes
1
answer
37
views
How to handle private keys in a messenger app with asymmetric encryption?
I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side.
I generate a private and public key on server side and encrypt the messages ...
1
vote
1
answer
87
views
How does DNS prefetching endanger security/privacy?
I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
- 13
0
votes
1
answer
99
views
How Secure Is It to Use SQLite for Identity Storage in a Web App
I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
- 101
1
vote
2
answers
115
views
What exactly are Hidden HTTP Parameters?
I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose.
Example : https://blog.yeswehack.com/...
- 41
0
votes
0
answers
27
views
Enumerate Golang net/rpc Port?
I'm playing with a web app CTF for fun/learning. The backend is using Golang's net/rpc library to provide frontend access to what I think are database operations. The problem is I don't know what the ...
- 1
0
votes
0
answers
68
views
CSP for Single Page App: Use client-side nonce for securing iframe content
Goal I'd like to tighten my Content Security Policy.
Situation
I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
- 101
0
votes
2
answers
34
views
Can Meta / Facebook Pixel be loaded by a script loaded from a third party CDN for my web site?
Scenario: I don't want to serve the Facebook/Meta Pixel to my users but let's say I load dozens of scripts and CDN content from third parties. Can one of those third parties insert the Meta / ...
- 6,844
0
votes
0
answers
55
views
Trying to understand HTTP request containing base64 encoded part and email address
I have public webserver serving static html pages and when analyzing error logs I found type of attempted GET that I don't understand.
They are formed like this and fail because request is too long:
/...
- 101
1
vote
0
answers
75
views
How do I protect API keys used to authorize an iframe-based client?
I'm building a service composed of a backend API and an embed-able, iframe-based, front-end client. Only authorized customers should be able to access the backend API via the iframe embed. My plan is ...
1
vote
1
answer
41
views
How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?
I understand that nothing is perfectly secured.
If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
- 113
3
votes
2
answers
89
views
Any obvious pitfalls of modeling access control policies using subject, scope, object?
Context
A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document.
A user is always a part of a team. A team is ...
- 33
0
votes
0
answers
49
views
ruby on rails constantize exploitation
I was trying to exploit the constantize method in ruby for remote code execution. for example I have this line code:
@mygroups = params[:group][:type].constantize.new(params[:group])
and in the ...
- 131
0
votes
1
answer
67
views
XSS in location.hash.match() function
I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code:
var r4c='(.*?)';
var results = location.hash.match('token\\('+r4c+'\\);');
I am unable to ...
1
vote
1
answer
30
views
take advantage of XST attack to steal other user's cookie
I've read about the XST attack, but the demonstration is just using a CURL or change the HTTP method to "TRACE" in the request.
Could anyone show me the POC/demo of how the attacker could ...
0
votes
0
answers
55
views
Adding a script tag after the html closing tag
I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
0
votes
2
answers
339
views
Storing sensitive data in Local Storage with encryption?
I have a notes app that's offline-first and syncs with remote database when online.
Currently, when a user creates a note, I'm encrypting it with AES. I ask the user to enter their decryption ...
- 1
0
votes
0
answers
52
views
How to interpret a GET request by a vulnerability scanner application with seemingly no parameters?
In the weekend one of the servers got targeted by automated scanning attempts, reviewing the logs I noticed a new strategy, but I can't make head or tails of the intent of this attempt.
These attempts ...
- 121
2
votes
3
answers
198
views
Reason to create fake accounts using real email addresses
I've been dealing with a problem that I can't solve until I find the cause.
We get regularly accounts made with scraped/leaked emails and random names. They are useless because you need to verify the ...
- 121
0
votes
0
answers
54
views
Flask URL Vulnerabilities
I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does ...
0
votes
2
answers
74
views
Security vulnerabilities from storing anti CSRF token in global JS variable?
What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection?
If there are any vulnerabilities what ...
1
vote
2
answers
49
views
Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?
This is actually a general question about template engines.
If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
- 125
0
votes
1
answer
30
views
Does embedded onedrive media pose a risk to the owner of the onedrive account?
I have a personal website that acts as a portfolio for my engineering projects. There are images of my projects that i'd like to have on the site. Would it be a bad idea to embed these from a onedrive ...
- 101
0
votes
0
answers
12
views
SQL injection testing [duplicate]
What methods are used by penetration testers to understand if an input field is prone to SQL injection?
If the application is filtering special characters like ' in the input field, what other methods ...
- 1
1
vote
0
answers
110
views
How to reproduce following POC of dom based open redirection Vulnerability Flagged by burp suite scan
During scan, the burp suite flagged DOM open redirection vulnerability with the following POC. How can I reproduce it?
Data is read from document.referrer and passed to xhr.send.
The following value ...
- 11
0
votes
0
answers
37
views
Would fake GET request parameters be considered good opsec?
Let's say I was building a UI and wanted to provide my users with a tad bit more security in cases when their browser history or other personal data on their computer was compromised. If I was to add ...
- 101
1
vote
1
answer
43
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
-1
votes
1
answer
48
views
Why on earth would you call SSRF and XXE a type of injection attack?
I've just received a pen test report and these idiots have included vulnerabilities like SSRF and XXE under the injection heading! This is nonsense they have some, but not all, characteristics of ...
- 32.9k
1
vote
1
answer
86
views
Validating web app source code integrity
I am interested if it could be possible to validate source code integrity for web apps somehow.
For example:
Developer builds app and sign source code with his private key. Both signature and public ...
- 11
1
vote
0
answers
34
views
Authentication using an intermediate web app as an openid client
There are 3 different web apps:
X: A resource provider that provides details about a user (implements authorization part of openid protocol).
Y: Web service (implements openid client) that gets the ...
- 11
1
vote
1
answer
72
views
Vulnerabilities in Build-time Libraries Could be a Security Threat
If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
- 111
1
vote
0
answers
563
views
Why "application/x-www-form-urlencoded" is normally used for login but not for registration?
I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
- 11
1
vote
1
answer
81
views
How to collect malicious URLs
I would like to obtain a list of malicious URLs for testing purposes and, if possible, would like to collect URLs of sites that exploit zero-day vulnerabilities.
I want to collect malicious URLs to ...
- 13
1
vote
0
answers
241
views
SQL injection into IN('[injection]') without parentheses or comma
I have the following injection:
DELETE FROM table WHERE id IN('[injection]');
And I can use these characters: !#$%&'*+/=?^_`{|}~.- . So I can exit the single-quoted string via ', but I can't exit ...
- 29.1k
0
votes
1
answer
65
views
When to use application layer encryption
When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users?
And e.g. when we create state in OpenID Connect's client and redirect the ...
- 307
1
vote
0
answers
96
views
Presenting users their API Keys on frontend
I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that
This is the only time you will see it. Make sure to save this to a safe ...
- 11
1
vote
1
answer
50
views
What are the security risks of only using an id in the url to protect the content?
I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the ...
- 123
0
votes
1
answer
55
views
Parse a File on Client and Send to Server Without Client Manipulating Data
I have a desktop app that takes a file format and parses it to get some JSON data that is then send to a server.
My problem is figuring out if it is possible to somehow parse the data on the client ...
- 1
0
votes
2
answers
62
views
unencrypted user credentials accessible from the web app
I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
- 117
2
votes
1
answer
86
views
Basically only 2 ways of npm supply chain attacks?
Almost every week you can read about attacks performed through compromised npm libraries. The npm ecosystem is vast and unmanageable and for it-sec people it is frustrating to deal with all the ...
- 33
0
votes
1
answer
275
views
XSS in href attribute
I'm currently pentesting a website where I can set a URL on my profile.
I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case:
Imagine this is your ...
- 50
1
vote
1
answer
169
views
Reflected DOM XSS Portswigger Lab
I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere.
Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
- 13
0
votes
0
answers
119
views
Confirming File upload directory traversal without knowing upload path or being able to retrieve the uploaded file?
I am faced with a file upload functionality. We can upload docs and png's but cannot view them.
I have tested for several things so far and now would like to test for directory traversal via file name....
0
votes
1
answer
320
views
Is the .AspNet.Application cookie vulnerable to CSRF attacks?
I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability.
The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict:
protected void ...
1
vote
1
answer
54
views
Interpreting OWASP prohibition: no sensitive-account login to any frontend interface
OWASP’s Authentication Cheat Sheet states unequivocally:
Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
- 123
1
vote
0
answers
53
views
Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?
I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
- 11