Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
1
vote
1answer
46 views
Command Injection when all dangerous characters are escaped?
OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used).
I wrote a quick PHP script doing this:
$input = $_GET['x'];
$...
0
votes
0answers
27 views
Securing RESTful APIs with Private Keys
I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
0answers
17 views
How to configure web server for tls 1.3 0-RTT attack?
I want to make a project that use 0-RTT attack to tls 1.3 web server.
I want to configure a simple web site that use tls 1.3 .
What do I need for that?
What libraries to use and what js such as node....
0
votes
1answer
51 views
Can registration forms be used for an XSS attack?
In most websites that have account logins, there are at least two fields:
Email
Password
Could either of these fields be used to mount an XSS attack (assuming no character encoding)?
For example, ...
-1
votes
0answers
12 views
faraday ide doesn't import the openvas scan [closed]
I'm trying to add an xml result file from openvas in faraday but when i import it, nothing happens. Could someone help me please?
My file is located in the downloads folder and when I load the file, ...
0
votes
0answers
16 views
Why would someone practically want access to a JSP servlet source?
I've seen online now a few times ways to exploit web servers like httpd using connectors like tomcat to expose the source code for a .jsp file when it is not supposed to.
For example, appending %01 ...
1
vote
4answers
113 views
127.0.0.1 accessing internet [on hold]
We are looking at an app that requires a local DNS entry for my.site.com with IP address 127.0.0.1. Our proxy is blocking this URL whenever the app attempts to use it. The app support says it's (my....
0
votes
1answer
45 views
Is the following javascript code vulnerable to DOM XSS?
I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute.
var hash = window.location.hash;
if(...
2
votes
1answer
92 views
Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?
Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
0answers
24 views
Security implication of disclosing composer.lock?
What are the security implications in disclosing the composer.lock file for a remote, public known, web application?
0
votes
0answers
19 views
what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]
Background :
Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login.
Problem statement :
What were the possible ...
1
vote
1answer
38 views
CORS accepting arbitrary origin with GET but not with OPTIONS
I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *.
However, with OPTIONS requests and an arbitrary origin, ...
1
vote
0answers
22 views
Where to put admin portion of web application
So this is more of a theoretical question (isn't most things in information security though??), but one that I'm kind of stuck on.
When making web application admin portals (for administration of the ...
1
vote
0answers
31 views
Are there any additional security precautions I can or should take with my service?
Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
1
vote
1answer
31 views
On-site Whitelisting vs. Off-site Cisco VPN
A company I’m applying to as web software tester is requiring me to be on-site so they could put me on their whitelist. However, I had a previous job which allowed me to work anywhere, using only ...
0
votes
0answers
40 views
How can I securely allow users to run potentially dangerous code (PHP Pastebin)
I'd like to create an application that allows users to run code from the browser. Think like a PHP pastebin.
My idea to do this safely is to start by ensuring every time code is ran it creates an ...
5
votes
4answers
198 views
Are there any practical attacks on random number generators?
I'm creating an internal security course for developers. To make it more interesting, I'm trying to reinforce each chapter with some real-world attacks but stumbled upon insecure random usage section.
...
0
votes
0answers
14 views
How important is it to encrypt inter-service communications on the same server, specifically node to mongodb ones? [duplicate]
I have node and mongodb running on the same server on an internal network. The node app uses mongoose to interact with the Database. The database has username and password, authentication and iptables ...
1
vote
1answer
79 views
SQL injection with an auto-incrementing parameter
I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.
...
1
vote
1answer
37 views
Protect app from Http Proxy like Charles [duplicate]
I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
1answer
33 views
Implementing SRP without storing the salt anywhere
I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire.
Looking at the SRP procedure, when a client registers with the ...
1
vote
1answer
77 views
XSS in custom, user-supplied CSS
Users of our web app would like to use custom CSS to customize parts of UI. I've came up with some kind of blacklist for CSS "bad words" and I'm curious whether it is sufficient or if I need to ...
0
votes
0answers
23 views
Load_file() with Blind boolean based sql injection, is this possible?
As in the title, is it possible to do load_file in boolean based sql injections just like in regular "union select" injections? if so then how?
Thanks in advance.
0
votes
1answer
26 views
Displaying username in profile section of a Web Application
Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in?
My web application uses basic authentication and does not have any 2 ...
0
votes
1answer
85 views
Tomcat application arbitrary file read exploitation
In recent black-box pen-test of a webapp hosted on CentOS, I found a vulnerability that allowed me to grab contents of files (kind of file inclusion) located within the home path of Tomcat.
In ...
1
vote
1answer
49 views
hiding emails in database [closed]
I am making a webpage (similar to a social media) which will be open-source, but will probably only run off one server, with multiple levels (php, javascript(hopefully without any modules), postgresql)...
0
votes
0answers
27 views
Web application security: post-compromise testing
In the context of securing web-based application there is plenty of material discussing best practice for penetration testing (red teaming as well as blue teaming).
Recently, I became more interested ...
0
votes
2answers
58 views
Does HTML Purifier (which converts & to &) prevent HTTP parameter pollution?
If a REST endpoint (http://example.com) reads the p query parameter and pass it along to another endpoint:
http_get("http://example.com/api2?p=".$_GET['p']);
I will be able to exploit it by ...
2
votes
2answers
41 views
Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]
AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
0
votes
0answers
28 views
Vulnerabilities associated with admin-ajax.php
I company I am working for has created a form that relies upon admin-ajax.php. This form is currently hidden with the wp-admin directory (is is blocked for external users).
In order for the form to ...
0
votes
3answers
55 views
Transfer encrypted objects and decrypt in browser
Im building a webclient where a tensorflow model needs to run in the browser. I would want the Model to be protected so that it cant be just downloaded off "Developer tools". The model has to be ...
0
votes
1answer
43 views
Reflected XSS in multiline script block
I am trying to exploit a reflected cross site scripting in a GET request where the reflection is in the first multi line script block.
It seems I can use every character but <, > and " and the ...
0
votes
2answers
72 views
Web App or Web Services testing?
I am trying to clear up a doubt on security testing.
If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
1
vote
0answers
128 views
Capturing HTTP Traffic Through Proxy Sever
While performing the security assessment on an Android application(UAT Environment), I'm unable to capture the HTTP traffic through proxy server(Burp Suite/OWASP Zap). There is no point of ...
1
vote
1answer
80 views
Bypassing XSS filter replacing characters?
Is it possible to bypass an XSS filter that replaces the malicious characters?
I've prepared this filter:
searchTextField.replace(/</g, " ")
.replace(/>/g, " ")
.replace(/"/g, " ")
...
0
votes
1answer
47 views
SEToolkit Not Cloning Login Page
I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
0
votes
0answers
57 views
XSS : How to bypass htmlentities when < > " & is escaped and no input is inside a tag attribute with single quote? (the page is UTF8)
So lets say we have a website where they use htmlentities and everything like < > " & is escaped but not ' (single quote), but the problem is the only input available inside a tag is inside a ...
26
votes
10answers
10k views
How to secure passwords over HTTP?
Say my password is abc. I want to send it to the server over HTTP.
I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
2
votes
1answer
44 views
Custom SSL protection Message to Users in Web Applications
In some websites, especially on their payment section, I see a text something like: You are on a secure page. Your personal data is encrypted and protected by SSL technology. However it looks like a ...
-1
votes
2answers
81 views
High Level CSRF
I have been doing a bit of dvwa (damn vulnerable web application) and I have a question on CSRF.
There is an additional parameter, a csrf token, which is submitted in the get request.
All the answers ...
1
vote
1answer
40 views
Exfiltration through FTP using XXE on a Tomcat server
I'm trying to extract binary data from a Tomcat server that is using SAXParser. For my FTP server, I am using this source. I'm hosting two DTD's on Github Gist. These are their contents:
Base XML (...
1
vote
0answers
37 views
Password Reset URL strategy
Designing a new flow for a "forgot your password" feature we are developing, i came across a challenging question regarding the URL and the commitment that has to be made between frontend and backend ...
3
votes
1answer
92 views
How to safely allow scripts but preventing XSS?
We are trying to find the best way to allow JavaScript in a web application while being safe against XSS.
Site admins have the privilege to insert JavaScript to control the site templates, and ...
27
votes
5answers
8k views
I detected someone probing my site for weaknesses, what can I do about it? [duplicate]
My site has been getting probed by a bunch of IPs from Morroco (trying to submit forms, trying out potential URLs, trying to execute scripts etc..), I have a strong suspicion it's the same person ...
2
votes
0answers
113 views
PHP Upload-show images securely [closed]
I've read various posts about how letting users to upload files can create vulnerabilities to your website such as a user injecting php code in an image.
So i've created a small test project where ...
2
votes
0answers
69 views
Testing a padding oracle vulnerability with PadBuster
I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability
+ OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
0
votes
3answers
79 views
Which is the main purpose of having two domains pointing to the same IP, one of them without SSL/TLS?
During the information gathering phase I found that there is another domain pointing to the same IP that I'm auditing. The first one, "www.domain.com", is using TLS whereas the second one, "www-org....
2
votes
2answers
84 views
Do browsers XSS filters protect against DOM based XSS?
Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header:
X-XSS-Protection: 1; mode=block
As I understand it, it prevents reflected XSS attacks by ...
0
votes
2answers
76 views
Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?
Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them:
Use a prediction service to load pages more quickly: Browsers use an
...
0
votes
0answers
43 views
Pentesting web application with WebRTC video chat feature
I'm pentesting a web-application that uses peer-to-peer WebRTC for video chatting. I haven't come across this yet, so I'm a tad lost as of how to tackle this.
How can I verify the WebRTC ...
