Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
82 views

Why does this SQL Injection payload fail on vulnweb.com?

I have tried this payload: http://testphp.vulnweb.com/listproducts.php?cat=2 +OR+1+GROUP+BY+CONCAT_WS(0x3a,VERSION(),FLOOR(RAND(0)*2))+HAVING+MIN(0)+OR+1 -- - However, the vulnweb server did not show ...
0 votes
0 answers
45 views

What kind of security is it? Base64/MD5. Key with 22 characters and 32 characters

What kind of security do you suggest for this case? What do you think is the security flow? It is happening in a web which download a PDF document, inside the document has a QR code. This QR code has ...
0 votes
1 answer
24 views

Interpreting OWASP prohibition: no sensitive-account login to any frontend interface

OWASP’s Authentication Cheat Sheet states unequivocally: Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
1 vote
1 answer
145 views

PCI & e-banking sensitive information tokenization/encryption/obfuscation - Which fields require to be secured?

According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant. Taking into account that we are talking about a bank, fields like card number ...
2 votes
2 answers
250 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with an LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in Linux behave like a file or ...
12 votes
2 answers
4k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
0 votes
2 answers
283 views

Path traversal limited

I trying to pentest website. I know that there are files named "file1" and "file2". The server is nginx. So I did this test: http://example.com/file1..%2ffile2 => 404 http://...
0 votes
0 answers
46 views

How to do code signing with Visual Studio 2022

I am new to code signing and would like to do it using Visual Studio 2022. I got a MS article showing how to do Code Signing here and was trying to use it. For me, the "Sign the ClickOnce ...
2 votes
1 answer
197 views

Dangers of using the web applications provided by password managers

The password manager bitwarden requires the user to log in to their account on their web site to allow them to enable 2FA, import passwords and manage other account related details, as that ...
1 vote
0 answers
32 views

Why is it a security concern to modify http.sys registry entries to allow web service to accept a longer query string?

I have an Http web service running on IIS. The Http service will be exposed to the public internet, but only authenticated client requests will be processed by the web service. The service allows ...
0 votes
0 answers
44 views

Why is not there encrypted way of sharing/showing data such as Password to the user (hidden from web app Source code)?

I wonder if there will be (or is) a way to hide data such as passwords from the HTML/DOM structure? As, password fields can hide from external person other than the main user with something like "...
4 votes
1 answer
854 views

Approach for testing XXE injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did: Intercepted traffic using Burp. Changed the request with ...
0 votes
0 answers
4 views

User-Friendly PGP Verification tool [migrated]

Is there an online tool which allows users to verify that an armoured, detached PGP signature for a file is valid? The closest thing I found was PGPTool.org, which is quite nice but unfortunately does ...
2 votes
1 answer
596 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
0 votes
3 answers
651 views

Can a password change via CSRF lead to account takeover?

If a website has a password change functionality where the user isn't prompted for the current password and the form isn't using tokens to mitigate CSRF attacks, an attacker can easily execute a CSRF ...
24 votes
8 answers
24k views

What chars should I not allow in passwords?

I am planning to develop a website that require that the users register a username and a password. When I let the user choose a password, what chars should I allow the users to have in the password? ...
0 votes
0 answers
31 views

Is tsheets.intuit.com a safe website? If so, why does it try to access a chrome-extension:// url?

This really doesn't seem safe to me, and I am wondering if there is a MITM attack happening or if this is somehow legit. I am worried something might be happening with my company's payroll data. Here ...
0 votes
2 answers
808 views

Prevent URL encoding on form submit

During an engagement, I found a potential XSS vulnerability on a page. There is an HTML form that is submitted to this page (POST method) and sent parameters are reflected (without encoding) in the ...
0 votes
0 answers
36 views

Hydra brute force not working for web app, but the correct password is in the list

I'm trying to brute force an Instagram account I created to play with Hydra. I ran the following command: Even though the correct password is in the list, it didn't work. This is the output I get: ...
0 votes
1 answer
204 views

How apache tomcat favicon can be malicious or cause unintended results in application?

At the moment, there aren't any of those vulnerabilities that we know. I was looking the docs on what damages can be done by hackers if apache tomcat favicon is revealed in web application.
0 votes
1 answer
2k views

XSS in <span> where only < and > are encoded

When im doing a penitent, I noticed the application takes the user input and put it in a tag. When I used the string of '';!--"<XSS>=&{()}, I noticed the returned output (when viewing ...
1 vote
1 answer
61 views

The server acts as a database server , but there is no open port regarding that why?

I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities. The server does multiple functionalities, It acts as a web ...
0 votes
2 answers
199 views

How can you exploit a website that resolves to localhost?

Let's say you're on a pentest (or bug bounty hunting) and you meet a domain that resolves to 127.0.0.1, How can you exploit that? is that even considered a misconfiguration ? sometimes i see domains ...
0 votes
1 answer
48 views

How to prevent shopping cart alterations in another tab when paymentintent is already created?

Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution. If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
3 votes
2 answers
19k views

Nikto authentication

I am trying to complete a war game on Hell Bound Hackers. I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, and ...
1 vote
2 answers
60 views

Reflected XSS found in web application via POST request with JSON body. Is this issue exploitable?

I was testing an application recently and i came across with a Reflected XSS vulnerability via HTTP POST Request with JSON body. Although this condition can't be exploitable from his own, due respond'...
4 votes
3 answers
466 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
3 votes
3 answers
3k views

How is the same origin policy causing my PoC to fail when I don't need to read return data?

I'm performing an authorized vulnerability analysis on a custom web service and have discovered a CSRF vulnerability. Due to there not being form tokens coupled with the service not checking for the ...
0 votes
1 answer
51 views

Privacy for web service operators (activism & journalism)

I'm planning to develop and operate a web service that might agitate a certain authoritarian government (not in G20, not known for its good human-rights record). I'd like to prevent any kind of leak ...
2 votes
1 answer
161 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
1 vote
1 answer
178 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
0 votes
2 answers
2k views

Session id remain same after and before logging in asp.net application

Before logging in to the asp.net application, i checked the headers and there was already a session id in cookie header cookie: ASP.NET_SessionId=3de0es3brpfbcmvkzhkidsmt And when i logged in to the ...
0 votes
1 answer
26 views

WSS protocol vs HTTPS protocol as an iframe embedded source in a web page

until recently, I've been embedding a chatbot service from a different/external site with an iframe tag. it's a paid service, not a free one. today I saw that they changed a few urls, swithing from &...
0 votes
2 answers
764 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0 votes
1 answer
46 views

refresh token without client_id and client_secret

I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
0 votes
0 answers
52 views

Possibility of using content disposition header to bypass CORB?

Consider a response with the following headers: Content-Type: application/json;charset=UTF-8 Content-Disposition: attachment;filename=text.txt where Content-Disposition appears first, I am able to ...
5 votes
1 answer
948 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
154 votes
12 answers
88k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
0 votes
0 answers
22 views

SpringBoot Web Application Security for apis working on static token?

I have one Spring boot Web application which has few apis facing internet, deployed on aws, they work on JWT token, they're fairly secure. But there are few apis that work on static token validation. ...
0 votes
0 answers
26 views

Vulnerability: Standalone Library vs. Same Code Elsewhere

Are libraries inherently more vulnerable than in-house application code? The speaker of this talk generally advises folks against creating wrapper libraries for Erlang in Elixir rather than just ...
0 votes
1 answer
173 views

What's the best way to encrypt and store text in a MongoDB database?

I have a "cloud service", which consists of 2 parts: Web application, written in Next.js; MongoDB database (uses MongoDB Atlas). I allow users to sign in with GitHub and handle ...
0 votes
2 answers
53 views

Windows IP Helper service listening on port 1000

On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
3 votes
1 answer
226 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
5 votes
2 answers
2k views

Token based API security over repeated username/password requests

What are the security benefits over a token based API security model versus sending the username & password every time? The process of the token based approach is: Send a 'login' request with ...
2 votes
1 answer
2k views

PHP File Upload Vulnerability

I'm assessing the security of a webportal for a client and I found a vulnerability. I found a function where it handles file uploads. Its supposed to be used only by admins, but the actual function ...
2 votes
1 answer
227 views

Is it safe to view video files on Google Drive online?

I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
0 votes
2 answers
109 views

Storing Anti-CSRF token in cookie with samesite=strict

The (anti) CSRF Token should protect user from executing a action on the website by clicking a link or a form that is created by an attacker. In the application that I want to secure I can't use an ...
0 votes
1 answer
40 views

Is it possible to get xss in json body request?

I was doing a VAPT assessment in which I see some JSON body in the request which has orgid deviceid So there any possibility to get XSS in json body?
22 votes
4 answers
1k views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
0 votes
1 answer
59 views

Does user uploaded image file to HTML input form pose a risk?

I have a site where I need to get a logo from the user, they can click the input form and upload only .jpeg or .png files. After this the file will stay client side and be used to automatically create ...

1
2 3 4 5
66