Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,277
questions
0
votes
1
answer
26
views
Is it possible to get xss in json body request?
I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid
So there any possibility to get XSS in json body?
0
votes
2
answers
98
views
Storing Anti-CSRF token in cookie with samesite=strict
The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker.
In the application that I want to secure I can't use an ...
- 1
0
votes
0
answers
46
views
How to find a potential JSON Java deserialization code vulnerability with a whitebox approach in web server source code?
I would like to know a somewhat general approach for white box vulnerability scanning, mainly focused around Java deserialization code bugs that could lead to RCEs (Remote Code Execution following ...
- 1
0
votes
0
answers
20
views
How do you call REST API resource unintentional field modifying?
Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users.
Let's say, for example; I got an account profile ...
- 1
0
votes
1
answer
18
views
WSS protocol vs HTTPS protocol as an iframe embedded source in a web page
until recently, I've been embedding a chatbot service from a different/external site with an iframe tag.
it's a paid service, not a free one.
today I saw that they changed a few urls, swithing from &...
- 140
0
votes
0
answers
192
views
I am trying to exploit port 7000/tcp afs3-fileserver
I have been trying to exploit a cheap smart tv box that I have bought a while ago and after my nmap scan I found that port 7000/tcp was open but researching about the port gave back not much ...
- 1
0
votes
2
answers
34
views
Altering requests after authenticating
In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
- 2,101
0
votes
2
answers
31
views
Windows IP Helper service listening on port 1000
On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
0
votes
1
answer
29
views
Path traversal in REST style URLs?
Can path traversal vulnerabilities occur in REST style URLs?
For example: https://x.com/filename/img.jpeg
https://x.com/filename/../../../../../etc/passwd
Does this make sense ?
- 1
0
votes
0
answers
16
views
cmd.jsp - Tomcat - Understanding HTTP Status Code (302)
I'm currently playing with cmd.jsp webshells on a Java webapp in tomcat.
This is the request (sending via burpsuite)
PUT /path/cmd.jsp HTTP/1.1
Host: 69.69.69.69
Content-Length: 579
<%@ page ...
0
votes
0
answers
7
views
Standards for UI being used at Critical infrastructure facility [migrated]
I'm developing a web application for a critical infrastructure facility. They want the web application as per some standards, these include
Maximum number of rows that a table could have at once
...
- 1
0
votes
2
answers
110
views
How can you exploit a website that resolves to localhost?
Let's say you're on a pentest (or bug bounty hunting) and you meet a domain that resolves to 127.0.0.1, How can you exploit that? is that even considered a misconfiguration ? sometimes i see domains ...
1
vote
3
answers
106
views
Should deprecated versions of TLS not be used
I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...
- 225
0
votes
1
answer
56
views
Does user uploaded image file to HTML input form pose a risk?
I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...
1
vote
1
answer
119
views
What are the security concerns of embedding Base64-encoded images into an HTML document?
We are developing an MVC web-application in Django and having concerns about image uploading.
First of all, here are our business requirements:
Our users can upload images (like profile pictures, etc)...
- 33
0
votes
1
answer
33
views
Modifying request responses leading to unauthorized access?
I have been developing some applications lately where the content on the web app is rendered based on the request's response. For example, a user with a "free" plan has limited access, ...
- 105
0
votes
2
answers
65
views
File Upload(what type of file)
While I was learning about file upload vulnerability one question come to my mind. What type of file do I use while hunting file upload vulnerability ? Do I need to detect which programming language ...
- 1
0
votes
1
answer
41
views
How to mitigate risk of exploiting open POST endpoints?
I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.).
I'm owning a web application that exposes some HTTP endpoints to the world. ...
- 1
0
votes
0
answers
39
views
Oauth 2.0 current best practice for SPA and backends
I want to build a application which having following architecture:
According to the BCP, I am going to implement Authorization Code Flow with PKCE. I am wondering:
Do I need to implement a separate ...
- 101
0
votes
1
answer
33
views
A few questions about fixation attack
I am writing a small app.
It creates a session once the user authenticates. I am aware of this definition of fixation attack from owasp.
Attacker uses the app
In this App, once they log out the ...
- 5
0
votes
1
answer
16
views
Arachni on VPS. ERR_CONNECTION_REFUSED on connect with WebUI
After starting arachni on VPS, I'm trying to connect with web UI. But browser cannot establish connection with ERR_CONNECTION_REFUSED.
Some console output:
arachni
Puma starting in single mode...
* ...
0
votes
0
answers
16
views
Session Fixation PoC
I wonder what Session Fixation exploit possibilities still exist today in case the website does not change the Session-ID in a cookie after login other than the following:
XSS
MiTM
open redirect vuln
...
- 1
1
vote
0
answers
49
views
Re-populate form with JSON data
I re-populate form with JSON data via javascript (all data has the same origin server)
1 Wen the page load, make a request post ajax
2 The response Ajax is a:
Object { primary_ns: {…}, secondary_ns: {…...
- 21
0
votes
0
answers
41
views
Verify frontend source code authenticity
I am developing a zero-knowledge web application. It stores user's data in an encrypted form, the encryption is done on the users browser, and I do not have the key.
If implemented properly this ...
- 389
0
votes
0
answers
24
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
0
votes
0
answers
30
views
How to protect confidential information in a web application
For example there is a simple CRUD record management application. Let for simplicity the records are some documents.
I need to implement a mandatory access control to the records. For example if some ...
- 153
0
votes
0
answers
29
views
Cookie-based sessions
During an engagement, i have been asked by a client to explain (with the use of one
or more examples) whether having an authenticated cookie-session web upload
functionality can be dangerous for the ...
0
votes
1
answer
53
views
Encryption options when one-way secure channel is available
I would like to ask what encryption options are available for the following real scenario:
There is an unsecure, full-duplex communication channel between a server and client
There is also a secure ...
0
votes
0
answers
31
views
Writing effective UFW & IpTable rules
I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
- 197
0
votes
0
answers
58
views
Alternative to AWS CloudHSM?
I am not using AWS, google cloud or similar. I have a vps on another webhosting service.
I am going to encrypt my data but don’t know where the best place to save the encryption keys would be?
I can ...
- 121
6
votes
4
answers
4k
views
Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?
I am trying to better understand and determine the impact and implications of a web app where data tamping is possible.
When discussing data tampering, I am referring to when you are able to use a ...
- 197
0
votes
1
answer
24
views
Prevent client access being the same as admin access in web application
My colleagues and I are developing a public web application with client and admin access.
I'm concerned about security, being the application public. I would like to add every layer, as long as it's ...
0
votes
1
answer
185
views
UFW vs IpTables for web application security
I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables.
From my ...
- 197
0
votes
2
answers
57
views
How to secure an enpoint to prevent programatic calls from the client?
We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
- 1
0
votes
1
answer
48
views
Why is Content Security Policy necessary given Same Origin Policy?
Given that Same Origin Policy prevents JavaScript from one origin from running in another origin and accessing another origin's cookies, why is CSP necessary?
Is it that CORS selectively removes some ...
- 402
3
votes
1
answer
132
views
Adding SSO to an existing website - should SSO login link to matching email address?
I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
- 131
5
votes
1
answer
225
views
Is there a reason not to store a JWT as hardened cookie?
When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and &...
user163495
2
votes
3
answers
141
views
Manage passwords from my personal website
So I'm a complete novice in security practices, and an amateur web developer. I have a personal website connected to a personal DB. Currently there is nothing in this DB that would be useful to anyone ...
- 23
0
votes
1
answer
67
views
What's the point in blocking content upload by extension?
In a web application I manage, we have installed an option to let the users to upload files. The files are stored directly in the database. The security department of the company have requested us to ...
- 121
0
votes
0
answers
59
views
Should other devices be required to login again after an email change in settings?
I have had multiple security researchers tell me that the best practice when a user changes their email in settings is to logout all other devices and force them to login again.
Nobody has been able ...
- 368
0
votes
1
answer
27
views
What possible vulnerabilities exist for dual submitted CSRF tokens (cookie and form field)? [duplicate]
In this question (CSRF cookie vs session based tokens), folks recommend against storing the CSRF token in a cookie, saying that storing it in the session server-side is more secure. What vulnerability ...
0
votes
1
answer
60
views
Do WSGI servers connect to devices outside of the network?
I want to set up a plotly dashboard and view it from my browser.
Plotly gets set up as a flask application. I'm of the understanding that I should use a WSGI server to host it. I'm looking at waitress ...
- 101
0
votes
0
answers
68
views
Protecting against Dirbuster [duplicate]
I am wondering how someone might look to protect their website against directory traversal attacks using tools such as Dirbuster which may reveal some sensitive directories?
- 197
1
vote
1
answer
36
views
What sandbox does an <object> element run in? Can this sandbox be configured?
I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed.
I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
- 113
0
votes
0
answers
45
views
Security consideration for CAPTCHA system
Hi everybody I am developing an image captcha system as a side project something like hcaptcha/Recaptcha - image classification/object localization.
I have a few questions regarding the security of ...
- 101
1
vote
1
answer
48
views
owasp crs 3.0 rule functuonalityconsult
I have built a waf and using CRS 3.0, this waf can inspect the request body to limit the file size that upload to the server, I am wondering ,if I just disable this feature manually, it will cause any ...
- 11
2
votes
1
answer
168
views
Report-URI CSP Directive
Consider a scenario where CSP is configured in response headers rather than using meta tag. And only one directive is used.
Content-Security-Policy: report-uri https://www.example.com
Does the above ...
- 189
0
votes
0
answers
79
views
SQL injection into LIMIT in MySQL 8
Given a query such as:
SELECT * FROM users limit 1,$limit
Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)?
What I have tried (unsuccessfully)...
- 29k
0
votes
1
answer
82
views
How to MITM an http website without infiltrating any infrastructure?
There's a certain website designed so that junior QAs learn to find bugs. Trouble is:
it's http://
there's no IP filtering
users are very junior so they use their real names as user names and ...
- 1,817
0
votes
2
answers
116
views
HTTP with encrypted message vs HTTPS
A bit of background:
I am a web developer and sometimes i integrate some form of external API in my web applications.
It's the second time already that i find something strange: some APIs instead of ...
- 3