Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
1answer
33 views
Multiple contributor security for blog
I currently develop a big blog website with Firebase as my backend just for information. Right now (not released/published the page yet), I give my authors accounts special rights to access pages ...
1
vote
1answer
18 views
POST Method Anti-CSRF Help With Burp Suite
I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
0
votes
2answers
48 views
Determine All Possible Fields in HTML Form
Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form?
For example:
Assume a ...
6
votes
2answers
163 views
I don't understand what's wrong with just using cookies for authentication?
I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work:
You define a 32-byte secret key on the server
When the user logs in, you ...
0
votes
2answers
55 views
How can I secure a REST service intended to be used by my customers' customers via their public website?
I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
2
votes
1answer
46 views
Allowing unauthenticated user access web page information
Our web application should allow unregistered users to browse certain
information.
This information is returned by apis
Currently we are using hardcoded guest login to achieve this
The mere ...
1
vote
1answer
38 views
Dangers of Sending Onetime Pin numbers over http
Are there any dangers of sending a one time pin number from customer to my server over HTTP?
Somebody is arguing that its okay since it will only be used once. So there's no chance of an attacker ...
0
votes
0answers
40 views
Xss experimenting question
This is the .html document after submitting this:
<form action="/mysite.com" novalidate> E-mail: <input type="email" Id="user_email">"<script>alert(1)</script> <input type="...
0
votes
2answers
64 views
JWT or session cookie for API for both web and mobile app?
I've been reading all I could about this subject for the last couple of days and I can't decide what would be the best approach.
The only two requirement are:
I need to know the users that are ...
0
votes
0answers
28 views
GetSimple CMS file upload vulnerability
I am still learning Metasploit Framework and I have came across a problem while pentesting a vulnerable GetSimple CMS lab, version 3.3.10. I have set options and selected payload.
Logged in as an ...
2
votes
1answer
50 views
Relative paths in web applications
I'm currently reading a security audit of a web application where they rank relative paths in a web application as a security risk.
e.g.:
<a href=../contact.html>Contact</a>
I found ...
0
votes
0answers
49 views
Are native apps more secure than web apps? [on hold]
From the user perspective which is more secure, a native app or a web app.
Consider for example a bank online services. Many banks offer both ways of accessing your personal account. Through a ...
1
vote
1answer
42 views
How can I make sure that my Python code cannot be accessed by the user of my web app?
I have a Python Program whose code I would like to protect. For sake of example, let's say I coded a novel function called "add" which does the following:
def add(n1, n2):
return n1 + n2
I'd ...
0
votes
0answers
16 views
How useful is the default configuration of ModSecurity for a generic web application?
Scenario:
ModSecurity with a "default" or "generic" configuration (like the one that might be provided by shared hosting providers, for example).
Generic web application (custom, uncommon, or unknown)...
0
votes
1answer
48 views
Is any plaintext stored as a password hash an effective way to lock out an account?
I'm building a web app with Flask and I have user accounts that store their passwords in a MySQL String column using werkzeug.security's generate_password_hash() method. I wanted to create a Community ...
4
votes
3answers
566 views
Is CSRF still a relevant attack vector?
CSRF was part of older OWASP TOP 10 lists but has been retired "as many frameworks include CSRF defenses, it was found in only 5% of applications".
But even without frameworks doing CSRF defense, I've ...
1
vote
0answers
40 views
Data image with CSP
I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that.
Because it is called from within ...
-2
votes
0answers
43 views
Unvalidated open redirect in path of URL
Is the following redirect mechanism exploitable? Meaning redirecting to another domain.
This: https://www.example.com/?return=/info.php
Redirects to: https://www.example.com/info.php
...
-1
votes
0answers
17 views
How to assess security risk of using open-source serverless implementation of BitWarden API
I'd like to get some well-informed opinions about how to assess risk for using an open-source implementation (https://github.com/vvondra/bitwarden-serverless/) of the BitWarden API. What I like about ...
3
votes
1answer
49 views
Security consequences of a publicly accessible database?
I've been asked to expose the database of a web app publicly so that an external service can connect directly to the database (via username/password) to read information. This database is currently ...
0
votes
2answers
78 views
What are the places one should look for CSRF flaw? [closed]
While finding vulnerabilities in a web app what are the potential areas where one should look for CSRF flaw?
2
votes
3answers
86 views
How are “security questions” not a major security hole for any application that uses them?
So the original security model was to ask the user for an email address, at time of account creation, and if they forgot their password the system would email a new password to this email address.
...
1
vote
2answers
50 views
Why most of the web applications use CRSF token as a prevention method instead validating through origin header?
Why was crsf token discovered at the first place? One can always check from the the request generated by origin header
0
votes
0answers
54 views
Technical Repercussions of SSN briefly touching a server
I need to safely pass a SSN to Stripe from a web page. (We are doing taxes for our contractors)
I am well aware that storing a SSN is not a good idea. We don't need to. Stripe can handle it, but I am ...
0
votes
0answers
25 views
Secure WebUI with JWT
I wrote a Golang API which is secured by JWT Tokens. The API itself is JSON Based and returns a time-limited and signed cookie.
I want to start building the webui for the API now, and I am thinking ...
0
votes
0answers
34 views
Is it fine to display the bam.nr-data.net licenseKey in the source code of a page?
I pentesting an application. While reviewing the page source of the applications home page, I found the following code snippet:
window.NREUM||(NREUM={});NREUM.info={"beacon":"bam.nr-data.net","...
-1
votes
1answer
36 views
Confusion related to broken authentication vulnerability
I was able to login by using the cookie of my previous session but when I try to change the setting I was logged out. Will this be eligible for authentication bypass vulnerability?
1
vote
1answer
41 views
Web-Application with CORS Origin: * using authorization header
As stated here, https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS at "Credentialed requests and wildcards". Quote:
When responding to a credentialed request, the server must specify an
...
1
vote
2answers
40 views
XMLHttpRequest CSRF fails with allowed CORS
I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack.
Now the following code should send a OPTIONS request, ...
3
votes
3answers
173 views
Should I encrypt sensitive form data with JavaScript on the client?
This is by no means a replacement for HTTPS, so please do not assume that is why I am asking this question. I am exploring, and I am curious. I am looking for some expert input on this, and I am not ...
-1
votes
1answer
35 views
Local File Download(LFD) vulnerability exploit
I have found a arbitrary file download vulnerability in an asp.net application.
I've downloaded the web.config and some other files. So what can i do with that "web.config" information ?(for example: ...
1
vote
1answer
44 views
How to protect a login page redirect
I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token.
...
10
votes
3answers
361 views
How to calculate our application security debt?
Application security debt has some similarities to technical debt but there are few differences that we need to think about when deciding if our security debt load has gotten too high and needs to be ...
0
votes
0answers
18 views
Security risks to embedding payment web page in Android app
I am very new to Android app development and I started out with the idea of fixing a small defect in an app. However, I got sucked further in and found that a payment processing company that we use ...
3
votes
1answer
151 views
Is this “forgotten-password” procedure safe/legal?
Recently, I had lost my password on a web app that is supposed to be really secure (think bank or government type web app). This web app contains a lot of personnal critical infos (like SSN and salary,...
0
votes
2answers
31 views
How to deliver an application to several clients with a single trusted SSL certificate? [duplicate]
I am working for a software editor and we deliver to our clients a turnkey solution that the client has just to install on his server to use it. This solution is a web service who uses HTTPS to ...
0
votes
0answers
20 views
How can a JWT token have multiple secrets?
I'm using the jwtcrack utility to attempt and crack an issued JWT token. I think just the following output should explain what's going on pretty well:
[0] % ./jwtcrack [token]
Secret is "P"
joseph@...
0
votes
2answers
35 views
/cron path found when testing site
I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
3
votes
1answer
69 views
Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?
I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
0
votes
1answer
85 views
How to store an user access token on a third party site in the front end
I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different).
In order to login (to post comments) the workflow is like this :
User clicks on log-in ...
0
votes
0answers
69 views
How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?
Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example:
a browser game in which the player's level and progress are to be saved locally.
a game,...
1
vote
2answers
95 views
Hide from Webcrawlers
If I had legitimate reasons to do so, would it be possible to hide a service from webcrawlers and with that, hide it from any search engines like Google?
Can I prevent an average joe from stumbling ...
0
votes
2answers
65 views
XSS vulnerability through burp suite
I am getting a XSS vulnerability through burp suite but when I inject script manually I don't get the XSS vulnerability.
Is this a reportable vulnerability?
1
vote
1answer
43 views
Does the Web Cryptography API prevent a bad server from slurping cleartext?
Consider a cryptographic web application that relies on hosted JavaScript. This JavaScript could be manipulated server-side by a bad actor, defeating any cryptographic tasks. Namely:
private keys ...
0
votes
1answer
28 views
Benefit of Parameter Map size validation in web application controller
I have a web application (Spring MVC) and have input data validation for every parameter in the controller. What is NOT present is checking for accepted Parameter Map Size. i.e When the controller ...
0
votes
0answers
24 views
Are REST Authentication schemes that expose shared key protected against reverse proxies acting as bad user agents?
Recently a situation arose where a client wants a public API that doesn't require registration or login by the user (no password). The security team has identified that the server-side API needs to ...
2
votes
1answer
53 views
Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?
Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
1
vote
3answers
132 views
Why keep track of user password changes in web application?
For some reason, it has become a common security* practice for websites to keep track of password changes. Sites like Google can even tell you how long ago you changed your password. Aside from just ...
1
vote
1answer
23 views
Should untrusted strings be sanitized server-side if they're inserted into the document body through document.createTextNode?
Chat webapp. Clients (that is, web browsers) send messages to the server, which the server broadcasts to all connected clients. Client-side code looks like this:
let p = document.createElement('p')
p....
0
votes
0answers
24 views
?, / or ; in input query string are causing errors. What does that mean?
I am currently testing a website and realized that if I put ; and/or % into the input for a search query it causes a 505 Internal Error.
Putting a ? in causes a 404 Page not found.
The URL for the ...
