Questions tagged [web-application]
An application that is accessed over a network such as the Internet or an intranet using a browser.
3,228
questions
0
votes
0answers
2 views
Can malicious code running in isolated Electron's renderer process send data to attacker's server?
I'm trying to evaluate if a malicious npm script running in Electron's app renderer process (which has sensitive information) could send data from the webpage out to an attacker's server (or trick the ...
-1
votes
1answer
34 views
How to take advantage of a new security tool (SCA) added to company?
We recently added a new Software Component Analysis tool (dependencytrack) to our infrastructure, which allows us to gain visibility on which dependencies are pulled by the code of our web apps.
How ...
1
vote
1answer
45 views
Is it safe to view video files on Google Drive online?
I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
0
votes
0answers
34 views
How to protect a web app against supply chain attacks?
I'm looking for ways to further protect my web app against supply chain attacks.
Attacks focusing on supply chain have been increased a lot recently. NIST is working on a recommendation, following the ...
0
votes
0answers
19 views
Sometimes all my accounts are logged out on Google Chrome, why is it? [closed]
Sometimes all my remembered accounts on Google Chrome are logged out. Including Gmail, Twitter, Facebook, Reddit. Why is it? should I concern about it?
0
votes
0answers
23 views
cookie forging: How to replace session cookies
I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can't disclose the url due to agreement).
I have been ...
0
votes
1answer
36 views
How to control authorized access to specific data for specific users
First of all, this might be the incorrect place to post this question. Sorry in advance if that is the case.
I am building a web application which involves a login system. Now once a user has logged ...
0
votes
0answers
45 views
Step-by-step file encryption/decryption using user-supplied password
Let's say I want to build a dropbox clone. When users upload files they need to be encrypted. Later on, when the user needs to access their files, the application should be able to decrypt them using ...
1
vote
1answer
58 views
Web Application Sends Newly Registered Users Plaintext Password. Could you assume that passwords are not hashed in DB storage?
I was recently assessing a web application where during user registration the application would send a password reset link via email where the token portion of the URL was the following in base64:
<...
0
votes
1answer
101 views
XSS in <span> where only < and > are encoded
When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
0
votes
1answer
41 views
How should user supplied links be validated?
I want to create an internet forum where users can copy and paste links to external URLs within a thread. What measures should be taken to lessen the likelihood that links posted do not have malicious ...
1
vote
3answers
171 views
Does SOP prevent a class of CSRF attacks?
Just want to settle a debate I'm having with someone.
Suppose there is no SOP. Via an XSS exploit, code can run on website A.com and submit an XHR request to B.com. Suppose B.com stores an auth token ...
0
votes
1answer
39 views
Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?
One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
1
vote
2answers
77 views
Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
For context; I have a web application that allows users to upload a PDF file from which the web app extracts certain information by parsing it. The app then sends this information to another server ...
0
votes
1answer
131 views
How to secure Laravel website against the ongoing massive exploitation
My website built upon Laravel is currently under attack.
Only the index.php file was changed, and by that I mean that every line of code is inserted above the original Laravel code. So this code ...
1
vote
1answer
63 views
How can I improve the application administrator's encryption keys security inside database
I am interested in the issue of establishing the security of data of users of a web application in the event of a database leak.
It was decided to use the following encryption chain:
User data is ...
0
votes
1answer
67 views
Contact form encryption
Currently we have an email address and in certain cases we receive sensitive data via email. The goal is protecting this sensitive data. We have a website with SSL too so we thought that the website ...
1
vote
1answer
96 views
OWASP Pentest - "Sensitive data sent in clear text" [closed]
We have our web app / REST API getting tested by potential customer. In the report they came up with this issue:
Sensitive data like user credentials on login page, password reset,
change password ...
0
votes
0answers
66 views
What is the possible impact of inserting user input into image src?
A website takes user input and pass into img src. What is the possible impact that I can do with it?
<img src="https://website.com/static/{user-input}">
I did think of some options:
...
0
votes
0answers
14 views
GRZXW5EDY - Does anyone recognize what kind of hash/id is this? [duplicate]
I am black-box testing a video streaming website. They have 2 kind of IDs for videos. internal_id and external_id.
I need to find a way to enumerate internal_id but cannot guess what kind of ID this ...
2
votes
2answers
99 views
CAPTCHA w/o Server-Side Persistence
I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server's private key.
The ...
0
votes
0answers
39 views
How to generate a secure invite token in a Firebase app?
I have a Firebase app using Realtime Database and cloud functions
In my app, a user is part of a group and has access to all the data in the group
I'm trying to create a way for a user to invite ...
18
votes
1answer
3k views
CRM with Client Side Encryption
The company I'm working in wants to develop a CRM that is cloud-based and we will need to store the data safely.
I've been searching for a way to create a strategy to save and secure data but I don't ...
0
votes
1answer
104 views
Is it possible to protect browser credentials from malicious processes?
What items should be considered to create a browser that prevents all access to stored credentials by a malicious process? Hardware attacks being out of scope.
Are there public projects addressing ...
0
votes
0answers
57 views
How is web cache poisoning possible?
There is a lot of literature out there about this, and I've read many of it, but one question I couldn't rectify is this. Consider this quote from netsparker.com:
Reflected unkeyed headers:
If the ...
0
votes
1answer
142 views
How to bypass an XSS filter encoding single quotes? [duplicate]
I'm trying to do an XSS attack test on a website.
I am using " and <> just fine and I have managed to escape the string. Now I'm trying to send my own cookie to my server that saves it to a ...
1
vote
1answer
127 views
Your username can only be changed once?
I've seen quite a few security centric sites enforce this policy:
Your username can only be changed once
My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
0
votes
1answer
90 views
What are the security implications of licensing out a copy of your codebase, and can they be mitigated?
Background information:
I am a manager of a SaaS CRM application for a highly competitive industry.
We have a large number of users who utilize our platform as the back-end of their business.
It was ...
0
votes
3answers
74 views
Transmission of CSRF tokens from client to server
I was reading up on the usage of CSRF tokens at https://portswigger.net/web-security/csrf/tokens and one section mentioned it should be transmitted to the client in a hidden field in a HTML form.
How ...
0
votes
0answers
62 views
Authenticating for multiple services with a single JWT token (Single sign-on)
I am working on an authentication system using JWT bearer tokens. Currently every single service our company provides has it's own JWT sign key, but uses the same data structure for the token data. ...
3
votes
2answers
610 views
What constitutes "military grade encryption" in 2021?
I often see it claimed on a website that they use banking or military grade encryption. As of 2021, what kind of encryption do the majority of (Western) banks and militaries currently use? Or in other ...
0
votes
1answer
99 views
Flask XSS prevention
I'm trying to fix a possible XSS vulnerability in WebApp (Flask) and I'm not sure what is the best way to prevent XSS without breaking functionality. For example, I have the following code block:
... ...
0
votes
0answers
83 views
Exploit an XSS without <> and valid encoding
I'm making a web penetration test, so I trying to exploit a XSS, I've looked that if I use a payload like the following:
<script>alert(document.domain)</script>
The output in the page ...
1
vote
0answers
77 views
Is it secure that anyone could claim Google My Business ownership? [closed]
Today I found that Google has a funny feature that allows everyone to claim ownership of a particular business, and if the owner does not reject it in 3 days, then the business ownership is set to the ...
1
vote
1answer
93 views
Does it make sense to configure the web server to deny obviously malicious requests?
I have a Ruby on Rails app behind Nginx. Every once in a while I see requests like GET /phpmyadmin or GET /wp-login.php. Since I don't have those tools installed, it's obvious that those are from ...
0
votes
0answers
62 views
Using predictable incrementing nonces
I need validation / feedback please with the implementation of a web based client-server application that I am building.
I need to make sure that a client's cookies can't be hijacked and therefore I ...
0
votes
0answers
82 views
What are the security considerations for coding a website with interactive scripts but no backend?
I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to ...
0
votes
1answer
145 views
Attempting remote code execution, why does this php webshell code fail with single quotes?
In working on a vulnerable box, I found a field in a database table where one can insert php code. Based on this exploit:
https://www.exploit-db.com/exploits/24044
I tried to use this code to make a ...
1
vote
1answer
93 views
PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?
According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number ...
0
votes
1answer
61 views
Security for website admin panel [closed]
I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
0
votes
1answer
52 views
Reverse-proxy issues
I am trying to create a reverse-proxy web application using Flask. I don't really know weather to call it reverse-proxy or not but my idea is that the web app gets a URL from ../proxy/<URL>, ...
1
vote
0answers
295 views
NodeJS, unrestricted file upload, RCE [closed]
I'm testing on application which runs on NodeJS, and discovered unrestriced file upload vulnerability, path traversal is not possible.
Uploaded file is visitable, I can upload .html to perform XSS ...
0
votes
0answers
124 views
How to automatically find all forms in a website?
Is there a tool or technique that can identify all the forms in a website so that we don't have to visit the entire website manually to look for forms?
0
votes
1answer
84 views
Upload Private Key into Web App
I am developing a web application that is integrating with a third-party that does not have OAuth capability, but instead use a variety of account IDs and keys to generate tokens for API calls.
On the ...
11
votes
2answers
4k views
Tips on performing a web penetration testing on a static website
No idea where to begin, I would like to ask for tips, direction and approaches when it comes to performing such a web testing.
Source code analysis is not within scope for this test. I intend to run ...
0
votes
2answers
365 views
Prevent URL encoding on form submit
During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
2
votes
2answers
227 views
Semicolon's relation with reverse proxy
What is the relation of semicolon with reverse proxy and how is it able to escape context/servlet mapping in reverse proxies such as IIS, NGINX, Apache?
Like I've seen multiple times where people have ...
0
votes
0answers
50 views
How to detect and prevent webshell uploading with offline methods?
We're developing a website using aspnet5, and providing a simple web page for uploading images by users. Users should only able to upload image files (jpg, png).
We're using some mechanisms to check ...
0
votes
1answer
73 views
DOM-based XSS - via URL
I have a website that I am testing but I am pretty new to all of this security stuff and would appreciate some help!.
I have a url similar to the following:
http://testurl?nexturl=whatever
The ...
0
votes
2answers
116 views
CSRF attack when form data isn't parsed
How can you do a CRSF attack on express if it only accepts JSON?
Sample Node app:
const express = require('express');
const app = express();
app.use(express.json());
app.post('/item', (req, res, ...