Questions tagged [web-application]

An application that is accessed over a network such as the Internet or an intranet using a browser.

231 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
176 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
5
votes
0answers
822 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
5
votes
0answers
98 views

Arbitrary methods directly callable with Front Controller pattern

I'm working on converting an application that uses the traditional Page Controller pattern to start using the Front Controller pattern. One of the potential problems I'm thinking about is that with a ...
4
votes
0answers
807 views

Approach for testing XXE injection

I have been discussing xxe injection in my web application,My web application allows expansion of user-supplied XML entities What i did: Intercepted traffic using Burp. Changed the request with ...
4
votes
1answer
466 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
3
votes
0answers
90 views

Should you terminate a session when an incorrect CSRF token is submitted?

According to the OWASP CSRF Prevention Guide if the server fails to ...verify the existence and validity of the token in the request compared to the token found in the user session ... then the ...
3
votes
1answer
59 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
3
votes
2answers
135 views

Testing web applications from an end user's perspective

I have been looking at OWASP and other forms of checklists on testing web applications. One of the best practices is to ensure session IDs generated are sufficiently random and unpredictable. ...
3
votes
0answers
56 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
3
votes
0answers
116 views

Is this XSS filter for HTML comments safe?

HTML comments can be notoriously tricky from an XSS standpoint, and the standard recommendation seems to be to never put untrusted user data in them. But shouldn't it be possible to strip out a few ...
3
votes
1answer
194 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
3
votes
0answers
2k views

How can Web Crypto API and IndexedDB protect data stored on the client side against user manipulation?

Imagine web apps that are supposed to work with no or only a few interactions with the web server, for example: a browser game in which the player's level and progress are to be saved locally. a game,...
3
votes
0answers
45 views

Are environmental variables for web PaaS a bad security smell?

I'm seeing a trend for deploying web apps to PaaS that the config is typically defined in environmental variables. e.g. Azure Functions or .net core apis Assuming this has been done to follow good ...
3
votes
1answer
505 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
3
votes
3answers
348 views

Web Application Firewall using web app source code analysis

I read this page: Category:OWASP Best Practices: Use of Web Application Firewalls, and I found that WAF cannot generally detect logical attacks. We know each web application has a number of input ...
3
votes
0answers
82 views

Is it safe to show a session activity summary after logout?

As noted in DBS' internet banking system, it shows a summary after I clicked logout. It gives an activity log performed during the session. Which I thought, during the logout process, the current ...
3
votes
0answers
218 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
3
votes
1answer
5k views

XSS not exploitable when POST data is sent in JSON?

There is a reflected XSS flaw in an application I am testing. Initially, the payload is sent in POST request as value of a JSON key and the response is also a JSON object. The returned value in the ...
2
votes
1answer
63 views

Fail to understand how hash length extension might work in real application

I'm trying to understand how the hash length extension might work on real web applications using a hash for MAC. Especially what I don't get is, how the application considers the evil forged hash ...
2
votes
1answer
62 views

Content-Secure-Policy headers

I am performing a security assessment on a web application and I found it doesn't have the Content-Security-Policy, but instead it has Content-Secure-Policy. It is literally the first time I'm seeing ...
2
votes
1answer
159 views

XSS chained with CSRF = Stored XSS?

I have recently heard that XSS + CSRF = stored XSS. I didn't think too much about it at the time, but now it's bugging me, because it doesn't make too much sense. I would say that it can stand true, ...
2
votes
0answers
44 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
2
votes
0answers
320 views

Is it possible to launch XSS if only the left angle bracket is encoded

I find some website only encode the left angle bracket of inserted HTML tag, for example: <div style="position:absolute;left:63.35px;top:108.41px" class="cls_002"><span class="cls_002">&...
2
votes
0answers
72 views

How to defend against brute-force form submissions

(To be clear, in this question I'm not asking about how to protect a login form against brute-force attacks.) I work for a company which designs and builds microsites for competitions that appear on ...
2
votes
0answers
142 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
2
votes
0answers
82 views

What's the use of an “extra” dynamic declaration in an external DTD blind XXE attack?

I've been studying XXE attacks through portswigger blog. I don't understand the extra step of a dynamic declaration (i.e. <!ENTITY % eval...) in the below external DTD: <!ENTITY % file SYSTEM ...
2
votes
0answers
51 views

Can we use cookie session id value in the body of the request?

A tester mark this as a vulnerability in the web application that a session id is in the post request instead of cookie header.
2
votes
1answer
152 views

How to securely share only some information with a middle-man site

Scenario: you run an app OurApp which deals with users' sensitive data, some of which you are allowed to share with third parties (with the user's consent, of course) and some of which you are not ...
2
votes
0answers
51 views

Does not using CAS when it's availible encourage phishing?

My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services. However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
2
votes
1answer
952 views

Flask/Jinja2 SSTI to get RCE. <type 'file'> not in object subclasses

I'm trying to get RCE in a simple Flask web app I developed, which is vulnerable to server side template injection (SSTI). RCE is usually obtained by uploading the reverse shell script on the target, ...
2
votes
0answers
110 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
2
votes
0answers
69 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
2
votes
0answers
94 views

Is the PHP BB code extension safe against XSS?

Bad home brew implementations of BB code (especially in PHP) are a common source of XSS vulnerabilities. Usually they rely on a bunch of regexes, a tool that is not fit for the job. But lo and ...
2
votes
0answers
53 views

Burp Suite - Mark Issues as “Validated”

After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
2
votes
0answers
291 views

How to protect data at rest in a small web application where it’s hard to protect keys

A small web application typically consists of a web server (e.g. Apache or nginx) and a database server (e.g. MySQL or PostgreSQL). Often, the two are hosted on a single physical server or on a ...
2
votes
0answers
976 views

Testing a padding oracle vulnerability with PadBuster

I scanned my server with nikto and it shows me that its vulnerable to padding oracle vulnerability + OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070....
2
votes
0answers
678 views

Data image with CSP

I am trying to get an image that is within JavaScript to work with our CSP. I have read that using data: (even in img-src) is an XSS risk so I'm trying to avoid that. Because it is called from within ...
2
votes
0answers
107 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
2
votes
0answers
81 views

User has been authenticated. Now what?

I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net. Not wanting to ...
2
votes
0answers
514 views

Web app access control system design

I am having trouble finding a scalable way to create a access control system which both follows best practices and can scale well. I have looked at various approaches like RBAC and ABAC. For the ...
2
votes
0answers
94 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
2
votes
0answers
110 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with a LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in linux behaves like a file or ...
2
votes
0answers
488 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
2
votes
0answers
158 views

Secure user logins in applications

We wish to create a Java GUI desktop application for our authorised helpdesk staff to perform their normal operations. For e.g. they often have to check log files for errors if a user called or verify ...
2
votes
0answers
98 views

How to safely decrypt user data in scheduled script

I have a web application with a lot of stored db data, some of which is encrypted. The data is encrypted with a surrogate key, which itself is encrypted with a hash of a user password. Upon request ...
2
votes
0answers
150 views

Suspicious web-application requests containing encoded JavaScript function(?)

I've been seeing some odd traffic in the logs for a web-application (Apache) that I'm wondering about, and I'm hoping that someone here has seen this before. The raw requests were variations of: ...
2
votes
0answers
427 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
0answers
1k views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
2
votes
2answers
88 views

Use delay with a fixed total time to defend against timing attacks

Consider this common example used to demonstrate timing attacks: async def sign_in(username, password): user = await get_user_from_db(username) if user is None: return False # early return :(...
2
votes
1answer
66 views

Does embedding (concatenating) a user ID in a session token for logging have any security implications?

Assuming there's a user with ID 123456 logging into a web application where the randomly generated session identifier to be stored in the cookie looks like this 123456zXRL9DWpPtaAhkPzhemQZE5P5F (that ...

1
2 3 4 5