Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
2,642 questions
1
vote
0answers
15 views
Where to store encryption based tokens in Encryption based Token Pattern?
Reading OWASP encrypted tokens pattern they describe the flow as follow:
After successful authentication, the server generates a unique token
comprised of the user's ID, a timestamp value and a ...
0
votes
1answer
38 views
CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not
Following is a CSP policy, for example derived sample response headers.
The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
1
vote
2answers
37 views
How do i extract data from response and use it in url for next request in Burp Intruder?
The URL is https://www.example.com/send?session=abcabcabc.
When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
3
votes
2answers
123 views
How can a client verify that code sent from the server has not been tampered with?
While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
29
votes
1answer
2k views
Is the core idea behind CSRF protection that the hacker doesn't know the token value?
I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it.
Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
0
votes
1answer
51 views
Sql injection bypass against KONA(akmai) WAF
I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible.
Parameter: query (GET)
Type: boolean-based ...
0
votes
0answers
45 views
Why am I getting a Mal/HTMLGen-A flag [closed]
Here is the results of the Sitelock XSS scan through their Sophos scan. I installed Sophos home and the shopitus.com gets red flagged. Please see below:
Sitelock through their Sophos XSS scan
URL: ...
0
votes
1answer
40 views
How do JavaScript (and mobile) APIs keep user data clean?
Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
3answers
70 views
Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?
I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities.
...
0
votes
1answer
92 views
+50
SameSite cookie attribute and Synchronizer Token Pattern
Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite
Question if it is supported should we implement ...
0
votes
1answer
44 views
Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?
We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients.
This ...
0
votes
1answer
20 views
Best practice for config files for ec2 instances
I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script.
THere are some config files that have ...
0
votes
2answers
25 views
media uploads and social sites group privacy etc
On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.
...
1
vote
0answers
48 views
Compromise Google GSuite by buying expired domain
I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically ...
0
votes
1answer
68 views
How can I verify a company's identity?
I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a ...
1
vote
1answer
41 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
0
votes
2answers
77 views
modifying an httponly cookie before sending the request
can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how?
I know modern browsers don't allow this. But if you could,...
10
votes
5answers
390 views
Declaring “this is data, not code” to protect against injection attacks. What's the word for that?
There are a variety of ways to make sure a receiving system understands "this is data, not code" so that it doesn't try to execute or interpret the data. To name a few:
Prepared statements, to avoid ...
3
votes
3answers
70 views
Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?
Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time?
Submitting a file to VirusTotal via File upload results in numerous hits for malware.
...
1
vote
1answer
149 views
Using hashcat in order to crack the JWT signature in WebGoat
I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
1answer
40 views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
1
vote
0answers
28 views
Trust boundaries for webapps (vs desktop apps)
I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.
In some cases, our ...
0
votes
1answer
54 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
26 views
How to protect data at rest in a small web application where it’s hard to protect keys
A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL).
Often, the two are hosted on a single physical server or on a ...
0
votes
0answers
23 views
Exploit web applet uploading jar through jnlp file
I have a web application which at its start asks the users to download and execute a jnlp file. The jnlp file has the following structure:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec=...
0
votes
2answers
116 views
Website is behaving strangely - was it attacked?
Our website was behaving strangely.
Sometime it was down and nothing was accessible.
Sometime it started loading but pages browsing was too slow.
We checked apache logs and found the below ...
0
votes
0answers
49 views
What are security concerns of the predefined user in Web Application?
We use a predefined admin user in our web application.
The configured password is very long and different for each installation and we have implemented brute force mitigations.
What are the security ...
0
votes
1answer
100 views
How to bypass the following PHP function [closed]
I need to write PHP code in an application in which I have access to the code, because it is a white box.
However, I noticed that they use the following function:
function stripbadchars($str_chain){
...
2
votes
3answers
72 views
Is it risky to URL-encode characters in an already URL-encoded string?
I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
1answer
36 views
Is there any way to encrypt form data header values which can be seen in network resources? [duplicate]
I'm able to see my credentials here in this picture which is fb's form data
I don't know if that is supposed to be like that or a problem of browser
But for my website, I don't want this in ruby on ...
3
votes
2answers
108 views
Possible SQLi with self-made prepared statements and real_escape_string?
My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird.
$query = db::...
-1
votes
0answers
80 views
“Content-Security-Policy” HTTP Header with “default-src 'self'; script-src 'self'” not blocking downloading of non specify domain
I am trying to only allow 'self' and 'https://cdn.jsdelivr.net' by using:
"add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net";
I encountered an ...
1
vote
0answers
45 views
Tunelling an Authenticated User Across Microservices Securely
On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
-2
votes
1answer
72 views
How to check hosted content for fraud?
I am a developer at a company that makes landing page software. Users can register and build their own page and publish it. We will provide them a subdomain on our whitelabel domain: test-link....
0
votes
1answer
64 views
Not destroying cookies at log out
As a beginner pentester, I was pentesting one of our applications and found that the cookies are not getting destroyed when a user log outs. The cookies did come with an expiration time and date.
...
0
votes
1answer
107 views
How secure is WebPack? [closed]
If NPM packages are so vulnerable as described in this article, is it acceptable to use WebPack for web-applications, in which security is a priority?
Edit: when using WebPack you should use NPM-...
13
votes
3answers
2k views
Why should someone block all methods other than GET and POST in a RESTful application?
TL;DR:
Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
1answer
75 views
Is it desirable to obtain a brand ssl certificate for a password generator?
I need an advice. I have created a password generator, which creates strong passwords on local PC (its a Progressive Web App).
But there is one problem: most site visitors are distrustful to the ...
1
vote
1answer
92 views
Command Injection when all dangerous characters are escaped?
OWASP recommends as defense against command injection to escape all special characters (if a whitelist approach cannot be used).
I wrote a quick PHP script doing this:
$input = $_GET['x'];
$...
0
votes
0answers
42 views
Securing RESTful APIs with Private Keys
I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
1answer
63 views
Can registration forms be used for an XSS attack?
In most websites that have account logins, there are at least two fields:
Email
Password
Could either of these fields be used to mount an XSS attack (assuming no character encoding)?
For example, ...
1
vote
4answers
123 views
127.0.0.1 accessing internet [closed]
We are looking at an app that requires a local DNS entry for my.site.com with IP address 127.0.0.1. Our proxy is blocking this URL whenever the app attempts to use it. The app support says it's (my....
0
votes
1answer
57 views
Is the following javascript code vulnerable to DOM XSS? [duplicate]
I have the following javaScript code in an application, which BURP flags as being possibly vulnerable. However, i have had no luck trying to get it to execute.
var hash = window.location.hash;
if(...
2
votes
1answer
121 views
Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?
Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
0
votes
1answer
51 views
Security implication of disclosing composer.lock?
What are the security implications in disclosing the composer.lock file for a remote, public known, web application?
0
votes
0answers
20 views
what were the impacts when a user affected with data breach when he signed up with third party authentication [duplicate]
Background :
Recently quora got breached and database were reported to be stolen, Myself used to have a habit of signing in through google login.
Problem statement :
What were the possible ...
0
votes
1answer
77 views
Triggering a XSS when the payload appears twice?
I have found a XXS vulnerability, but I am not able to exploit it. My input, 66038');}confirm(1);/*, appears two times. The idea was to close the function foo1() and trigger confirm(1). But foo2 is ...
1
vote
1answer
47 views
CORS accepting arbitrary origin with GET but not with OPTIONS
I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *.
However, with OPTIONS requests and an arbitrary origin, ...
1
vote
0answers
26 views
Where to put admin portion of web application
So this is more of a theoretical question (isn't most things in information security though??), but one that I'm kind of stuck on.
When making web application admin portals (for administration of the ...
1
vote
0answers
33 views
Are there any additional security precautions I can or should take with my service?
Suppose I'm building a service to store all the secure or sensitive information that my other applications use. Think passwords, or private SSH keys. Under the old programming paradigm of 'do one ...
