Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
0
votes
0answers
34 views
What is double submit cookie? And how it is used in the prevention of CSRF attack?
I was looking at the CSRF prevention steps and was not able to understand how the double submit cookie works?
25
votes
3answers
5k views
What is formjacking?
I just heard a very confused news broadcast about Symantec warning the world about the dangers of formjacking. The newsreader said it involved “hacking the form, not the website” whatever that means.
...
0
votes
0answers
47 views
Loading JSON via an unvalidated URL - is this a vulnerability?
I have a webpage that is running some javascript that:
Reads in a URL from a URL query param
Without validating the URL, makes a request to it
Validates the response - ensures that the response is a ...
4
votes
1answer
61 views
How to implement CSRF protection with a cross origin request (CORS)
tl;dr the Cookie-to-header-token method can't work due to the CSRF token cookie not being readable by the client in any way. Is sending the token in a header, and having the client save it in a cookie ...
0
votes
0answers
26 views
How much VirtualBox device/ios emulator/blueStacks informatin can be logged/tracked by servers/ apps?
This question is intended to know if we can be tricked by Virtual devices emulators. How much logging information can servers/apps request to tell the difference? In the other word, Can we hide our ...
1
vote
0answers
40 views
HTTP Debug method reveals Server header on IIS
Stuck with really weird problem and can't figure out how to handle it. So, I have asp web api application hosted in IIS 10. I use IIS Rewrite module with outbound rule which removes any Server header:
...
2
votes
1answer
51 views
What's stopping attackers from using our API keys to spam our logging services?
We're logging user events using Javascript and a third-party logging service. The API key is hardcoded in JS. The logging service restricts the API key to our domain. I'm assuming it looks at the ...
1
vote
1answer
48 views
Can the attacker view the response from a CSRF attack request?
In CSRF attacks, the attacker crafts a specific request and convinces the victim to visit the page.
I have a doubt in one scenario. Suppose if the victim visits the page, and clicks on the button, ...
2
votes
1answer
47 views
Server certificate proving client identity
When we look at StackExchange's server certificate (by clicking on the Lock icon), it says:
This certificate is intended for the following purposes:
Ensures the identity of a remote computer.
...
6
votes
1answer
167 views
Username Enumeration in 2018 - How serious is this
I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the ...
0
votes
1answer
49 views
Command injection with brace expansion
Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces?
I am encountering most likely not a filtering engine, but an bad parsing ...
1
vote
2answers
117 views
Users can change their password with the same password
What are the security implications of an web application that allows users to change their passwords with the current (exactly the same) password?
0
votes
1answer
25 views
Generate DEK from password using hashing on client-side
Important to know
Will not be passing the DEK from client to the server
The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
1
vote
1answer
31 views
Storing 2-way encrypted sensitive data in web app
In my web application I need to store some (very) sensitive data for my users. This data only needs to be available to the end user for the duration of the active session. The users log into the web ...
2
votes
0answers
55 views
Is the PHP BB code extension safe against XSS?
Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job.
But lo and ...
0
votes
0answers
29 views
what security impact can be caused by injection of meta tags
when i added a header
X-Forwarded-Host: bing.com
it inject meta tags in the site containing bing.com does this have any security impact
<meta property="og:url" content="https://bing.com/argentina"/...
1
vote
0answers
33 views
Is perceptual hashing feasible to identify users [closed]
I have been shadow-banned on an app (Tinder) and I cannot get around it. I have been doing some background research into how they are able to identify me and have come across device fingerprinting (I ...
4
votes
2answers
85 views
Can a web app fingerprint your device as identical to a native app's fingeprint
I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint.
I tried the web ...
0
votes
1answer
34 views
Why object injection doesn't work but payload is stored along with session cookies on Joomla 2.5.11 unpatched? [on hold]
I have read and understand object injection from this question. Then I wanted to test the security issue behind Joomla CMS Object injection through serialization.
TEST MACHINE
xammp 1.7.3 for ...
0
votes
2answers
44 views
How to detect website active routes?
I'm building a website using Laravel and I'm just thinking about security.
I would like to know if there is a way for attacker to detect all active web routes for a website ?
For example:
http://...
0
votes
1answer
74 views
Attacking an HTTPS site from an HTTP site in the same browser
A victim has two tabs open. One tab has an HTTPS site and one tab has HTTP site. What are the ways to attack HTTPS (https://www.example.com) site from HTTP site (http://somerandomdomain.com)?
Here is ...
1
vote
1answer
43 views
Shareable encrypted data in a web application
This is a follow up on my previous question about Storing sensitive, sharable data for a company where several of the employees have access to the server.
This solution has worked well for our ...
57
votes
7answers
11k views
Does it make sense to consider a triggerable server software crash a DOS attack?
I've found a little vulnerability in a web application running on Node.js server.
It works by sending some crafted payload to the application server, which makes the application server code to throw ...
2
votes
0answers
17 views
Burp Suite - Mark Issues as “Validated”
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
0
votes
0answers
24 views
Clickjacking when essential JavaScript code accesses attribute of 'top'?
Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg:
// http://...
2
votes
1answer
63 views
Security Log Analyze [closed]
is there any tools that I give it web server log (like Apache web server) and analyze it if there was any attack or not?
I don't want to use SIEM.
1
vote
0answers
19 views
Where to store encryption based tokens in Encryption based Token Pattern?
Reading OWASP encrypted tokens pattern they describe the flow as follow:
After successful authentication, the server generates a unique token
comprised of the user's ID, a timestamp value and a ...
0
votes
1answer
60 views
CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not
Following is a CSP policy, for example derived sample response headers.
The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
1
vote
2answers
48 views
How do i extract data from response and use it in url for next request in Burp Intruder?
The URL is https://www.example.com/send?session=abcabcabc.
When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
3
votes
2answers
130 views
How can a client verify that code sent from the server has not been tampered with?
While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
29
votes
1answer
2k views
Is the core idea behind CSRF protection that the hacker doesn't know the token value?
I'm trying to fully understand the concept behind CSRF, and more importantly, how to protect against it.
Can I assume, using only CSRF, so no XSS or other techniques, a hacker cannot know the value ...
0
votes
1answer
87 views
Sql injection bypass against KONA(akmai) WAF
I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible.
Parameter: query (GET)
Type: boolean-based ...
0
votes
1answer
42 views
How do JavaScript (and mobile) APIs keep user data clean?
Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
3
votes
3answers
100 views
Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?
I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities.
...
0
votes
1answer
126 views
SameSite cookie attribute and Synchronizer Token Pattern
Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite
Question if it is supported should we implement ...
0
votes
1answer
62 views
Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?
We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients.
This ...
0
votes
1answer
22 views
Best practice for config files for ec2 instances
I am building a lamp server ec2 image for a project we are doing. These images will be in an autoscaling group and on startup will be running startup script.
THere are some config files that have ...
0
votes
2answers
26 views
media uploads and social sites group privacy etc
On sites like Facebook etc. you have the ability to create "private" photo albums that are only shared with selected friends, similarly in Messenger you can upload an image just to a specific chat.
...
1
vote
0answers
50 views
Compromise Google GSuite by buying expired domain
I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically ...
0
votes
1answer
70 views
How can I verify a company's identity?
I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a ...
1
vote
1answer
42 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
0
votes
2answers
86 views
modifying an httponly cookie before sending the request
can an http request be altered on the client side ( with a browser, preferably ) to modify the value of an httponly cookie. If yes, then how?
I know modern browsers don't allow this. But if you could,...
10
votes
5answers
410 views
Declaring “this is data, not code” to protect against injection attacks. What's the word for that?
There are a variety of ways to make sure a receiving system understands "this is data, not code" so that it doesn't try to execute or interpret the data. To name a few:
Prepared statements, to avoid ...
3
votes
3answers
71 views
Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?
Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time?
Submitting a file to VirusTotal via File upload results in numerous hits for malware.
...
1
vote
1answer
334 views
Using hashcat in order to crack the JWT signature in WebGoat
I've recently started to practice my penetration testing skills and I got started with WebGoat.
I got to the "Authentication Bypass" chapter, to the JWT Token cracking. WebGoat presents this JWT ...
1
vote
1answer
46 views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
1
vote
0answers
31 views
Trust boundaries for webapps (vs desktop apps)
I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.
In some cases, our ...
0
votes
1answer
57 views
How can I detect an infection in a database?
Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
1
vote
0answers
29 views
How to protect data at rest in a small web application where it’s hard to protect keys
A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL).
Often, the two are hosted on a single physical server or on a ...
0
votes
0answers
30 views
Exploit web applet uploading jar through jnlp file
I have a web application which at its start asks the users to download and execute a jnlp file. The jnlp file has the following structure:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp spec=...
