Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
1
vote
3answers
127 views
Is there a way around HTTPS being redirected to HTTP?
I have come across something of a curious situation that a website (Palestinian News Network) has a valid TLS certificate (see here) but that the website always forces loading of the site via http://. ...
1
vote
1answer
107 views
Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization
I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
0answers
29 views
Is it still not advisable to use recent versions of EncFS >1.7 to encrypt Dropbox?
I'd like to use EncFS to encrypt files synced with Dropbox. Unfortunately, its Wikipedia page https://en.wikipedia.org/wiki/EncFS mentions security concerns from an audit of version 1.7:
EncFS is ...
0
votes
1answer
30 views
Local File Inclusion [ Post-Exploitation ] Question
Hello I am just curious what kind sensitive files I can read on a windows server which is vulnerable to LFI compared to Linux?
I mean the first file or common files which a pentester or a ...
1
vote
0answers
34 views
Report security vulnerability [duplicate]
I need to understand how to report a security vulnerability on a web application, given the website owners have no such bug bounty programs.
Brief information on target:
The website is built to ...
3
votes
1answer
135 views
What are the security risks to displaying an image loaded over http in a page loaded over https?
I'm developing a PWA in which part of the app displays the content of emails to the user. However, many of the image URL's that are in the emails come from http domains, and therefore do not load in a ...
-1
votes
1answer
84 views
SQLI Login Bypass Cheat-sheets Question [duplicate]
Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection.
Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'.
Your ...
0
votes
2answers
77 views
How client-side OAuth is secure?
I want to make a static webpage, but secure it with a login.
In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage.
But I ...
1
vote
0answers
34 views
An unknown domain serving contents of my sites [migrated]
I found that an unknown domain like www.aaa.com serving exactly the same contents (html, js ,css, any asset) of my site: myname.me.
And the API as well, for example, www.aaa.com/api/user get the ...
-2
votes
1answer
65 views
Inspect Element Prevention?
I was just actually wondering if there is a permanent way of preventing or disabling inspect element on client-side?
Assuming with inspect element you could change values in hidden forms as well as ...
57
votes
5answers
14k views
Is open-sourcing the code of a webapp not recommended?
How to find out what programming language a website is built in?
How much of a Django application could be reverse-engineered if the owner forgot to turn debug mode off?
And other Qs like these ^ .
...
0
votes
1answer
55 views
Semantic URL Attack Mitigation
I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks
Example
updateprofile.php?uid=1
I can change to
updateprofile.php?uid=2
I can update the second user'...
0
votes
0answers
31 views
Is it safe to use Giphy API keys in public Github repo?
I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
0
votes
0answers
50 views
Read-only Access to Forbidden directorys with no “sensitive” information
I was doing some discover content on a website of a bug bounty program and realized that i got some 200 codes on directory that are Forbidden when trying to access to them throw the browser. i am able ...
2
votes
1answer
110 views
How could ASP.NET forms authentication session leak into a different site?
We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
Steps:
Login to ...
63
votes
3answers
8k views
Website returning plaintext password [duplicate]
I have recently logged into a website. When I clicked on the "Update Profile" page, you are displayed with a list of text boxes for all the user fields, e.g. name, email, phone number etc.
There is ...
2
votes
3answers
183 views
Why are ASP.NET form authentication cookies deleted only on client side if client side can't be trusted?
ASP.NET documentation says:
FormsAuthentication.SignOut()
Removes the forms-authentication ticket from the browser
Why is the cookie not invalidated at the server as well? It would be easy ...
-1
votes
3answers
167 views
Is this a secure way to protect passwords when they must be in plaintext?
I am building a web app which will use my school's online grade reporting system. Students will sign in to my app using their credentials for the grade website. However, it does not provide an API, ...
0
votes
1answer
105 views
How do I escape webapp root directory in a php website?
This is part of a old CTF question which I've had trouble solving. I'm not sure what approach to take.
I'm given a single site:
http://user:token@host:port/public/index.php
the flag is in /tmp/flag....
1
vote
2answers
156 views
Is it possbile to conduct http header injection attack with a web site or web app uses https?
If a web site or web application is running with https, is it possible to conduct http header attacks like http header injections and so on?
2
votes
0answers
49 views
Does not using CAS when it's availible encourage phishing?
My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services.
However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
2
votes
1answer
284 views
' OR 1=1/* SQL Injection Login Bypass Question
Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/*
Assuming I am testing it on this server-side code below.
SELECT * FROM ...
0
votes
1answer
46 views
Whats should be TRACE response of an API (if it is not allowed on server)?
I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine.
The problem is, lots of ...
1
vote
2answers
88 views
Is LocalStorage in web browsers safe enough to store passwords?
I currently have a system I'm building where users can enter an email address and password into my login page, and if they click the signup button after doing that, it stores that data in LocalStorage,...
0
votes
1answer
36 views
Safe to consider webapp user's email as implicitly confirmed after a password reset?
In my system, a new user must confirm his email.
But there is an edge case:
he registers
does not confirm
forgets password, performs password reset (which involves a mail loop)
At that point I know ...
0
votes
1answer
176 views
SQL injection authentication bypass
I am testing a SQLi login bypass on the PHP code below:
if(isset($_POST["login"]) && isset($_POST["password"])) {
$sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
1answer
50 views
PHP code execution attempts on an ASP website
I found multiple PHP code execution attempts on my web server, which is running on asp. What happens when one attempts to execute php code on an asp web server? Will this create an impact on the ...
1
vote
1answer
64 views
Can I use a JWT for both Authentication & Data Transmission
I think I have a high level understanding of what a JWT is and how it works.
I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
0
votes
1answer
70 views
Is session id in url itself for all the requests an issue? [closed]
Is session id in url itself for all the requests an issue?
0
votes
0answers
67 views
SQLMAP injection with dynamic token?
I've a web app that has an injection point in POST data.
POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
2answers
103 views
Exploiting SQL Injection Vulnerability Using Logical Errors [closed]
<?php
/*
CREATE TABLE `message` (
`remote_addr` TEXT NOT NULL ,
`user_agent` TEXT NOT NULL ,
`name` TEXT NOT NULL ,
`text` TEXT NOT NULL
) ENGINE = MYISAM ;
INSERT INTO `message` (`remote_addr`, `...
1
vote
2answers
58 views
Is problem with string length in token (read password) randomization a security flaw? Is there any impact for the same?
this application sends a password to user's email when user click on forgot password on login page. However, the password is not the same in length always something it will be a 25+ string and ...
0
votes
1answer
38 views
Can access tokens be given to a third party app's end users for a secure read/write process flow?
I have a B2B web app (and API) called XYZ. I have business customer ABC (and DEF, GHK, etc.), each of which have their own web app with their own distinct users. When a new user of ABC (or DEF, etc.) ...
0
votes
0answers
38 views
Problem Exploiting Plugin WPML 2.0.4.1 for Wordpress Vulnerability
First some context. I am Working for a company learning about Security Web Services. They have a main application and a blog. I've been looking vuln. in the main webapp for a while, but then I start ...
0
votes
3answers
152 views
Is it possible to truly hide content behind a paywall in a single page app?
I would like to hide certain content behind a paywall in my VueJS app. In googling around...
Some tutorials recommend storing the currently logged in user in local storage. And then before showing ...
2
votes
2answers
85 views
Security Benefits of Reverse Proxying Java / Tomcat WebApps Locally
Conventional wisdom seems to dictate that java applications should always be reverse proxied. It's what I have always done and so has everywhere I have worked at.
I have read multiple times that ...
1
vote
1answer
68 views
Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses
I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI).
RCE is usually obtained by uploading the reverse shell script on the target, ...
1
vote
1answer
73 views
Is using a web service in a browser safer than running it natively installed? [closed]
let's take a theoretical app that has both an installable version and a web version. I use it via my web browser or I can install the app.
What are the safety considerations for the host operating ...
0
votes
0answers
57 views
Server Side Template Injection for EJS template in NodeJS
I'd like to create a Web-App with Server-Side Template Injection vulnerability in NodeJS. The template used in the Application is EJS with Express-Framework.
Below are the code bits:
index.js (...
1
vote
1answer
51 views
CORS mis-configuration
I need to crate a PoC in order to exploit a CORS mis-configuration. I'have discovered that the vulnerable server implements a poor whitelist policy that checks if substrings are in the whitelist. So ...
0
votes
1answer
74 views
How to check if all PC programs are using the VPN's IP?
With browsers you can go to websites that specifically check your IP to see if your VPN's IP is there. But how do you check if all the other programs or applications on your computer are going through ...
0
votes
1answer
75 views
Authentication handshake between two independent apps
I need help on a solution for below scenario from a security perspective.
Scenario:
There are two independent web applications App1 and App2.
User will log in to App1 by performing authentication ...
1
vote
2answers
65 views
Is it imporant that a cookie should have secure flag set if the website is running on HTTP?
I am working on a website and I want to know if a cookie needs to have a secure flag set or not if the website is running on HTTP. Also, httponly flag is set on cookie but there is no secure flag.
1
vote
1answer
43 views
Tracking script creates vulnerability
I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
0
votes
0answers
13 views
Is there any identification for common encoding/encryption? [duplicate]
While pentesting (web application) I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there ...
-2
votes
1answer
61 views
Session key is the same throughout the session, can this behavior be exploited?
This application uses session key instead of CSRF token but this session key is the same throughout the session, it's not changing. It only changes if I logout and then login again to the application. ...
4
votes
1answer
83 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
2answers
66 views
Can a password change via CSRF lead to account takeover?
If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
0
votes
1answer
71 views
XSS: Character showing in DOM [closed]
I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
-1
votes
1answer
102 views
How does this Session work (web)
It is difficult for me to fully understand this whole process.
I am using express.js and express-session.js with Node.
Now if someone logs in, a session is stored in the session store(server side) ...
