Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Audit tracking for web users [closed]

For a web app that will get heavily attacked, I figure one very useful tool will be audit tracking of what occurred for both getting a better picture of attacks and , if the worst happens, learning ...
0 votes
0 answers
24 views

A Hybrid Authentication method. (JWT, MFA, Cookies, Sessions) [closed]

I am currently creating an app to help with retail management. As you may be able to imagine, user authentication is of great importance as the app will store all kinds of sensitive information such ...
0 votes
1 answer
34 views

Exploiting a referer open redirect

I wanted to know if it is possible to exploit the fact that in my webapp the Referer header of a request is being reflected in the response. For example: GET /endpoint1 HTTP/2 Host: mysite.com Cookie: ...
2 votes
1 answer
117 views

Is there any secure way to make sure that a request comes from a browser and via a specific domain (by just using frontend)?

Let us assume that we have a public API, for example, company.com/publicEndpoint, that can accept requests from any source. Various websites, like foo.com and bar.com, use JavaScripts that call this ...
  • 21
0 votes
0 answers
37 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
  • 1
0 votes
1 answer
37 views

How to handle private keys in a messenger app with asymmetric encryption?

I am trying to write a web application with chat system which stores chat messages in a mongoDB database on server side. I generate a private and public key on server side and encrypt the messages ...
1 vote
1 answer
87 views

How does DNS prefetching endanger security/privacy?

I would like a comprehensive explanation of the security and privacy risks that come with DNS prefetching. There are already other posts about this topic, but I want current information and feedback ...
  • 13
0 votes
1 answer
99 views

How Secure Is It to Use SQLite for Identity Storage in a Web App

I'm developing an ASP.NET Core 7 MVC Web App. I'm using ASP.NET Core Identity library to manage user and role data. I am considering using SQLite for keeping Identity information, separate from my ...
  • 101
1 vote
2 answers
115 views

What exactly are Hidden HTTP Parameters?

I read a lot of reports where 'hackers' potentially exploited a 'Hidden HTTP Parameter'. There are also tons of tools which are developed for this exact purpose. Example : https://blog.yeswehack.com/...
0 votes
0 answers
27 views

Enumerate Golang net/rpc Port?

I'm playing with a web app CTF for fun/learning. The backend is using Golang's net/rpc library to provide frontend access to what I think are database operations. The problem is I don't know what the ...
  • 1
0 votes
0 answers
68 views

CSP for Single Page App: Use client-side nonce for securing iframe content

Goal I'd like to tighten my Content Security Policy. Situation I have a single page react application (= All code and styles are bundled together into a bundle.js file). The file is simply placed on a ...
  • 101
0 votes
2 answers
34 views

Can Meta / Facebook Pixel be loaded by a script loaded from a third party CDN for my web site?

Scenario: I don't want to serve the Facebook/Meta Pixel to my users but let's say I load dozens of scripts and CDN content from third parties. Can one of those third parties insert the Meta / ...
  • 6,844
0 votes
0 answers
55 views

Trying to understand HTTP request containing base64 encoded part and email address

I have public webserver serving static html pages and when analyzing error logs I found type of attempted GET that I don't understand. They are formed like this and fail because request is too long: /...
1 vote
0 answers
75 views

How do I protect API keys used to authorize an iframe-based client?

I'm building a service composed of a backend API and an embed-able, iframe-based, front-end client. Only authorized customers should be able to access the backend API via the iframe embed. My plan is ...
1 vote
1 answer
41 views

How secure is it to implement most of the applications functionality using WASM on the client side/ in the browser?

I understand that nothing is perfectly secured. If we have a web app where most of the functionality is done inside the browser using WASM, can someone get the binary of that WASM and use most of its ...
  • 113
3 votes
2 answers
89 views

Any obvious pitfalls of modeling access control policies using subject, scope, object?

Context A small web application with REST API and postgres as db, that has users, documents and teams. A user can do basic CRUD operations on document. A user is always a part of a team. A team is ...
  • 33
0 votes
0 answers
49 views

ruby on rails constantize exploitation

I was trying to exploit the constantize method in ruby for remote code execution. for example I have this line code: @mygroups = params[:group][:type].constantize.new(params[:group]) and in the ...
  • 131
0 votes
1 answer
67 views

XSS in location.hash.match() function

I was solving a CTF. Just reading the source code of the web page, I found a vulnerable piece of code: var r4c='(.*?)'; var results = location.hash.match('token\\('+r4c+'\\);'); I am unable to ...
1 vote
1 answer
30 views

take advantage of XST attack to steal other user's cookie

I've read about the XST attack, but the demonstration is just using a CURL or change the HTTP method to "TRACE" in the request. Could anyone show me the POC/demo of how the attacker could ...
0 votes
0 answers
55 views

Adding a script tag after the html closing tag

I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in ...
0 votes
2 answers
339 views

Storing sensitive data in Local Storage with encryption?

I have a notes app that's offline-first and syncs with remote database when online. Currently, when a user creates a note, I'm encrypting it with AES. I ask the user to enter their decryption ...
0 votes
0 answers
52 views

How to interpret a GET request by a vulnerability scanner application with seemingly no parameters?

In the weekend one of the servers got targeted by automated scanning attempts, reviewing the logs I noticed a new strategy, but I can't make head or tails of the intent of this attempt. These attempts ...
2 votes
3 answers
198 views

Reason to create fake accounts using real email addresses

I've been dealing with a problem that I can't solve until I find the cause. We get regularly accounts made with scraped/leaked emails and random names. They are useless because you need to verify the ...
0 votes
0 answers
54 views

Flask URL Vulnerabilities

I am doing a CTF-style assignment and I am confronted with a web site created in Flask. This web site appears fairly unremarkable - it has 4 pages and no log-in/authentication functionality, nor does ...
0 votes
2 answers
74 views

Security vulnerabilities from storing anti CSRF token in global JS variable?

What are the security vulnerabilities arising from storing anti CSRF token as a global JS variable and use it for every requests made which need CSRF protection? If there are any vulnerabilities what ...
1 vote
2 answers
49 views

Are there any attack vectors against the Smarty-PHP template engine when using a trusted template?

This is actually a general question about template engines. If I use Smarty-PHP to generate a website, and the templates and content are both created by me (assumed non-malicious), does this create ...
  • 125
0 votes
1 answer
30 views

Does embedded onedrive media pose a risk to the owner of the onedrive account?

I have a personal website that acts as a portfolio for my engineering projects. There are images of my projects that i'd like to have on the site. Would it be a bad idea to embed these from a onedrive ...
  • 101
0 votes
0 answers
12 views

SQL injection testing [duplicate]

What methods are used by penetration testers to understand if an input field is prone to SQL injection? If the application is filtering special characters like ' in the input field, what other methods ...
1 vote
0 answers
110 views

How to reproduce following POC of dom based open redirection Vulnerability Flagged by burp suite scan

During scan, the burp suite flagged DOM open redirection vulnerability with the following POC. How can I reproduce it? Data is read from document.referrer and passed to xhr.send. The following value ...
0 votes
0 answers
37 views

Would fake GET request parameters be considered good opsec?

Let's say I was building a UI and wanted to provide my users with a tad bit more security in cases when their browser history or other personal data on their computer was compromised. If I was to add ...
1 vote
1 answer
43 views

Web app architecture- set a new password for a on-premises AD setup

I need to implement a web app for a self-service change password use case for on-premise Active Directory users, which is accessible over the internet. The service must allow the users to set a new ...
  • 111
-1 votes
1 answer
48 views

Why on earth would you call SSRF and XXE a type of injection attack?

I've just received a pen test report and these idiots have included vulnerabilities like SSRF and XXE under the injection heading! This is nonsense they have some, but not all, characteristics of ...
  • 32.9k
1 vote
1 answer
86 views

Validating web app source code integrity

I am interested if it could be possible to validate source code integrity for web apps somehow. For example: Developer builds app and sign source code with his private key. Both signature and public ...
  • 11
1 vote
0 answers
34 views

Authentication using an intermediate web app as an openid client

There are 3 different web apps: X: A resource provider that provides details about a user (implements authorization part of openid protocol). Y: Web service (implements openid client) that gets the ...
  • 11
1 vote
1 answer
72 views

Vulnerabilities in Build-time Libraries Could be a Security Threat

If a dependency that is used in development environment or at build time has a security vulnerability, could it cause a security threat for the application? I'm looking for an example to understand ...
  • 111
1 vote
0 answers
563 views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
1 vote
1 answer
81 views

How to collect malicious URLs

I would like to obtain a list of malicious URLs for testing purposes and, if possible, would like to collect URLs of sites that exploit zero-day vulnerabilities. I want to collect malicious URLs to ...
  • 13
1 vote
0 answers
241 views

SQL injection into IN('[injection]') without parentheses or comma

I have the following injection: DELETE FROM table WHERE id IN('[injection]'); And I can use these characters: !#$%&'*+/=?^_`{|}~.- . So I can exit the single-quoted string via ', but I can't exit ...
  • 29.1k
0 votes
1 answer
65 views

When to use application layer encryption

When to use application layer encryption? Is it important in backchannel communication (machine-to-machine) without users? And e.g. when we create state in OpenID Connect's client and redirect the ...
1 vote
0 answers
96 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
  • 11
1 vote
1 answer
50 views

What are the security risks of only using an id in the url to protect the content?

I'm building a note-taking app, when a user writes a note an id is generated and I redirect them to a page where they can see its content with a URL like /note/DXSt832pS5iLuos6uxBn. What are the ...
  • 123
0 votes
1 answer
55 views

Parse a File on Client and Send to Server Without Client Manipulating Data

I have a desktop app that takes a file format and parses it to get some JSON data that is then send to a server. My problem is figuring out if it is possible to somehow parse the data on the client ...
  • 1
0 votes
2 answers
62 views

unencrypted user credentials accessible from the web app

I am testing a web app in which there is a section where it is possible to view all the users who can access it with their passwords in clear text. Is it normal this thing?
  • 117
2 votes
1 answer
86 views

Basically only 2 ways of npm supply chain attacks?

Almost every week you can read about attacks performed through compromised npm libraries. The npm ecosystem is vast and unmanageable and for it-sec people it is frustrating to deal with all the ...
0 votes
1 answer
275 views

XSS in href attribute

I'm currently pentesting a website where I can set a URL on my profile. I'm trying to get an XSS to fire, but my javascript knowledge is a bit limited for this use case: Imagine this is your ...
  • 50
1 vote
1 answer
169 views

Reflected DOM XSS Portswigger Lab

I'm a total beginner and im trying to solve Portswigger Academy labs. I'm studying on XSS right now and im stuck in somewhere. Lab Details:This lab demonstrates a reflected DOM vulnerability. ...
0 votes
0 answers
119 views

Confirming File upload directory traversal without knowing upload path or being able to retrieve the uploaded file?

I am faced with a file upload functionality. We can upload docs and png's but cannot view them. I have tested for several things so far and now would like to test for directory traversal via file name....
0 votes
1 answer
320 views

Is the .AspNet.Application cookie vulnerable to CSRF attacks?

I have an MVC application that has undergone SAST. The scan detects a potential XSRF/CSRF vulnerability. The application rewrites the .AspNet.ApplicationCookie setting SameSite=Strict: protected void ...
1 vote
1 answer
54 views

Interpreting OWASP prohibition: no sensitive-account login to any frontend interface

OWASP’s Authentication Cheat Sheet states unequivocally: Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
1 vote
0 answers
53 views

Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?

I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
  • 11

1
2 3 4 5
67